#23356 [NEW]: Segmentation fault using FreeType functions

From: steven at pyro dot eu dot org Operating system: Linux PHP version: 4.3.2RC1 PHP Bug Type: Reproducible crash Bug description: Segmentation fault using FreeType functions I seem to have found an intermittent, but reproducable segmentation fault when PHP 4.3.2RC1 uses functions from the FreeType library. The following script is enough to reproduce the error, but I've encountered this problem before in a larger script which also uses imagettftext: <?php header ("Content-type: image/png"); $im = imagecreate (500, 100); $black = imagecolorallocate ($im, 0, 0, 0); $white = imagecolorallocate ($im, 255, 255, 255); imagettftext ($im, 20, 0, 10, 20, $white, "/home/www/xfer/arial.ttf", "TEST!"); imagepng ($im); ?> (in case anyone suspects my arial.ttf may be involved somehow, the one I use has MD5 hash 8d223b3ad8d4819e9dcf22757e4cc2c4) On my server the script will sometimes cause a segmentation fault. I've produced this backtrace: #0 0x40253fed in FT_Free (memory=0x0, P=0xbfffec10) at /root/webserver/freetype-2.1.4rc2/src/base/ftutil.c:134 #1 0x4025883f in FT_Done_Library (library=0x8135590) at /root/webserver/freetype-2.1.4rc2/src/base/ftobjs.c:2616 #2 0x40253ecf in FT_Done_FreeType (library=0xbfffec10) at /root/webserver/freetype-2.1.4rc2/src/base/ftinit.c:151 #3 0x40224eb5 in gdFreeFontCache () at gdft.c:760 #4 0x400cd029 in zm_deactivate_gd () from /usr/local/apache/libexec/libphp4.so #5 0x401bbb69 in module_registry_cleanup () from /usr/local/apache/libexec/libphp4.so #6 0x401be129 in zend_hash_apply () from /usr/local/apache/libexec/libphp4.so #7 0x401b8950 in zend_deactivate_modules () from /usr/local/apache/libexec/libphp4.so #8 0x4018b3b5 in php_request_shutdown () from /usr/local/apache/libexec/libphp4.so #9 0x401cc160 in apache_php_module_main () from /usr/local/apache/libexec/libphp4.so #10 0x401ccd2b in send_php () from /usr/local/apache/libexec/libphp4.so #11 0x401ccee5 in send_parsed_php () from /usr/local/apache/libexec/libphp4.so #12 0x080697ec in ap_invoke_handler () #13 0x0807dbe2 in process_request_internal () #14 0x0807dff5 in ap_internal_redirect () #15 0x40097e8a in mod_gzip_redir1_handler () from /usr/local/apache/libexec/mod_gzip.so #16 0x40095fa5 in mod_gzip_handler () from /usr/local/apache/libexec/mod_gzip.so #17 0x080697ec in ap_invoke_handler () #18 0x0807dbe2 in process_request_internal () #19 0x0807dc42 in ap_process_request () #20 0x08074f06 in child_main () #21 0x080750a6 in make_child () #22 0x0807520d in startup_children () #23 0x0807583a in standalone_main () #24 0x08076058 in main () #25 0x420158d4 in __libc_start_main () from /lib/i686/libc.so.6 As you can see I am using FreeType 2.1.4RC2 in this example, and I suspect this is what's causing the problem, but I will try on the latest release. I'll keep playing around and add more info. if it's needed. Thanks! -- Edit bug report at http://bugs.php.net/?id=23356&edit=1 -- Try a CVS snapshot: http://bugs.php.net/fix.php?id=23356&r=trysnapshot Fixed in CVS: http://bugs.php.net/fix.php?id=23356&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=23356&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=23356&r=needtrace Try newer version: http://bugs.php.net/fix.php?id=23356&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=23356&r=support Expected behavior: http://bugs.php.net/fix.php?id=23356&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=23356&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=23356&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=23356&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=23356&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=23356&r=dst IIS Stability: http://bugs.php.net/fix.php?id=23356&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=23356&r=gnused