ID: 23122
Updated by: rasmus@php.net
Reported By: 1413 at blargh dot com
-Status: Verified
+Status: Feedback
Bug Type: GD related
Operating System: Debian Linux
PHP Version: 4.3.2-RC
New Comment:
I think I just fixed this issue. The bt doesn't look the same, but the
fact that it only happens on the second request would indicate that it
was getting a bogus cache pointer which is what I fixed. Someone
please verify that this doesn't happen under current CVS.
Previous Comments:
------------------------------------------------------------------------
[2003-04-25 05:48:34] sniper@php.net
Note: This happens on the 2nd run on same apache child.
------------------------------------------------------------------------
[2003-04-25 05:47:23] sniper@php.net
Reproduced with latest stable CVS:
(gdb) bt
#0 0x40442b0b in gdCacheGet (head=0x8409648, keydata=0xbfffca48) at
/usr/src/web/php/php4/ext/gd/libgd/gdcache.c:101
#1 0x40441c1a in gdImageStringFTEx (im=0x83faf24, brect=0xbfffcbbc,
fg=1,
fontlist=0x84034a4 "/usr/share/fonts/default/TrueType/arialbd.ttf",
ptsize=10, angle=1.5707963267948966, x=11,
y=150, string=0x8400524 "foobar", strex=0x0) at
/usr/src/web/php/php4/ext/gd/libgd/gdft.c:825
#2 0x40441a6b in gdImageStringFT (im=0x83faf24, brect=0xbfffcbbc,
fg=1,
fontlist=0x84034a4 "/usr/share/fonts/default/TrueType/arialbd.ttf",
ptsize=10, angle=1.5707963267948966, x=11,
y=150, string=0x8400524 "foobar") at
/usr/src/web/php/php4/ext/gd/libgd/gdft.c:767
#3 0x4042d36a in php_imagettftext_common (ht=8,
return_value=0x8403504, this_ptr=0x0, return_value_used=0, mode=0,
extended=0) at /usr/src/web/php/php4/ext/gd/gd.c:3058
#4 0x4042c822 in zif_imagettftext (ht=8, return_value=0x8403504,
this_ptr=0x0, return_value_used=0)
at /usr/src/web/php/php4/ext/gd/gd.c:2947
#5 0x405f5492 in execute (op_array=0x83fac7c) at
/usr/src/web/php/php4/Zend/zend_execute.c:1606
#6 0x405e1f64 in zend_execute_scripts (type=8, retval=0x0,
file_count=3) at /usr/src/web/php/php4/Zend/zend.c:864
#7 0x405a56b7 in php_execute_script (primary_file=0xbffff284) at
/usr/src/web/php/php4/main/main.c:1637
#8 0x405faa50 in apache_php_module_main (r=0x82e532c,
display_source_mode=0)
at /usr/src/web/php/php4/sapi/apache/sapi_apache.c:55
#9 0x405fbb78 in send_php (r=0x82e532c, display_source_mode=0,
filename=0x82e742c "/www/apache/htdocs/t.php")
at /usr/src/web/php/php4/sapi/apache/mod_php4.c:617
#10 0x405fbc02 in send_parsed_php (r=0x82e532c) at
/usr/src/web/php/php4/sapi/apache/mod_php4.c:632
#11 0x8054f09 in ap_invoke_handler () at md4.c:255
#12 0x806b0cf in process_request_internal () at md4.c:255
#13 0x806b13a in ap_process_request () at md4.c:255
#14 0x8061916 in child_main () at md4.c:255
#15 0x8061af5 in make_child () at md4.c:255
#16 0x8061c76 in startup_children () at md4.c:255
#17 0x806230d in standalone_main () at md4.c:255
#18 0x8062b9c in main () at md4.c:255
#19 0x4016c9cb in __libc_start_main (main=0x80627d8 <main>, argc=3,
argv=0xbffff694, init=0x804ed2c <_init>,
fini=0x8082e64 <_fini>, rtld_fini=0x4000aea0 <_dl_fini>,
stack_end=0xbffff68c)
at ../sysdeps/generic/libc-start.c:92
(gdb) list
96 {
97 int i = 0;
98 gdCache_element_t *elem, *prev = NULL, *prevprev = NULL;
99 void *userdata;
100
101 elem = head->mru;
102 while (elem)
103 {
104 if ((*(head->gdCacheTest)) (elem->userdata, keydata))
105 {
------------------------------------------------------------------------
[2003-04-09 22:00:50] 1413 at blargh dot com
No - I converted the script to:
<?
/* Vertial Label maker */
$in = $_SERVER['argv'][1];
$im = ImageCreate(14,150);
$cBlack = ImageColorAllocate($im, 0, 0, 0);
$cWhite = ImageColorAllocate($im, 255, 255, 255);
$cBlue = ImageColorAllocate($im, 100, 100, 255);
ImageTTFText($im, 10, 90, 11, 150, $cWhite,
"/var/www/prime/common/arialbd.ttf", $in);
Header("Content-type: image/png");
ImagePng($im);
ImageDestroy($im);
?>
and tried it hundreds of times without getting a segfault. When going
through Apache I get segfaults.
------------------------------------------------------------------------
[2003-04-09 21:16:14] iliaa@php.net
Can you replicate the problem using CLI sapi?
------------------------------------------------------------------------
[2003-04-08 19:52:58] 1413 at blargh dot com
Downloaded, compiled with same options as before, and
installed. Still crashes. New GDB output follows.
Starting program: /usr/sbin/apache -X
(no debugging symbols found)...(no debugging symbols
found)...(no debugging symbols found)...(no debugging
symbols found)...(no debugging symbols found)...(no
debugging symbols found)...(no debugging symbols found)...
(no debugging symbols found)...(no debugging symbols
found)...(no debugging symbols found)...(no debugging
symbols found)...(no debugging symbols found)...(no
debugging symbols found)...(no debugging symbols found)...
(no debugging symbols found)...(no debugging symbols
found)...(no debugging symbols found)...(no debugging
symbols found)...(no debugging symbols found)...(no
debugging symbols found)...(no debugging symbols found)...
(no debugging symbols found)...(no debugging symbols
found)...(no debugging symbols found)...(no debugging
symbols found)...(no debugging symbols found)...(no
debugging symbols found)...(no debugging symbols found)...
(no debugging symbols found)...(no debugging symbols
found)...(no debugging symbols found)...(no debugging
symbols found)...(no debugging symbols found)...(no
debugging symbols found)...(no debugging symbols found)...
(no debugging symbols found)...(no debugging symbols
found)...(no debugging symbols found)...(no debugging
symbols found)...(no debugging symbols found)...(no
debugging symbols found)...(no debugging symbols found)...
Program received signal SIGSEGV, Segmentation fault.
0x402b9c13 in fontTest (element=0x31, key=0xbfffd12c) at
/root/php4-STABLE-200304082330/ext/gd/libgd/gdft.c:349
349 return (strcmp (a->fontlist, b->fontlist) == 0);
(gdb) bt
#0 0x402b9c13 in fontTest (element=0x31, key=0xbfffd12c)
at /root/php4-STABLE-200304082330/ext/gd/libgd/gdft.c:349
#1 0x402bbb7e in gdCacheGet (head=0x8129210,
keydata=0xbfffd12c) at
/root/php4-STABLE-200304082330/ext/gd/libgd/gdcache.c:104
#2 0x402bac80 in gdImageStringFTEx (im=0x8118d34,
brect=0xbfffd2a0, fg=1, fontlist=0x811fd3c
"/var/www/prime/common/arialbd.ttf", ptsize=10,
angle=1.5707963267948966, x=11, y=150, string=0x810680c
"Bonus 16-Mar-2003",
strex=0x0) at
/root/php4-STABLE-200304082330/ext/gd/libgd/gdft.c:825
#3 0x402baad4 in gdImageStringFT (im=0x8118d34,
brect=0xbfffd2a0, fg=1, fontlist=0x811fd3c
"/var/www/prime/common/arialbd.ttf", ptsize=10,
angle=1.5707963267948966, x=11, y=150, string=0x810680c
"Bonus 16-Mar-2003")
at
/root/php4-STABLE-200304082330/ext/gd/libgd/gdft.c:767
#4 0x402a8f7a in php_imagettftext_common (ht=8,
return_value=0x811fd94, this_ptr=0x0, return_value_used=0,
mode=0, extended=0) at
/root/php4-STABLE-200304082330/ext/gd/gd.c:3050
#5 0x402a8443 in zif_imagettftext (ht=8,
return_value=0x811fd94, this_ptr=0x0, return_value_used=0)
at /root/php4-STABLE-200304082330/ext/gd/gd.c:2939
#6 0x403d2a52 in execute (op_array=0x810cb34) at
/root/php4-STABLE-200304082330/Zend/zend_execute.c:1606
#7 0x403bf8e4 in zend_execute_scripts (type=8, retval=0x0,
file_count=3) at
/root/php4-STABLE-200304082330/Zend/zend.c:864
#8 0x4038465e in php_execute_script
(primary_file=0xbffff9d8) at
/root/php4-STABLE-200304082330/main/main.c:1653
#9 0x403d7fd0 in apache_php_module_main (r=0x8101b2c,
display_source_mode=0) at
/root/php4-STABLE-200304082330/sapi/apache/sapi_apache.c:55
#10 0x403d9080 in send_php (r=0x8101b2c,
display_source_mode=0, filename=0x8103704
"/var/www/prime/common/vl.php") at
/root/php4-STABLE-200304082330/sapi/apache/mod_php4.c:617
#11 0x403d90ff in send_parsed_php (r=0x8101b2c) at
/root/php4-STABLE-200304082330/sapi/apache/mod_php4.c:632
#12 0x08053ab4 in ap_invoke_handler ()
#13 0x0806342c in ap_some_auth_required ()
#14 0x08063488 in ap_process_request ()
#15 0x0805cc6b in ap_child_terminate ()
#16 0x0805cdfc in ap_child_terminate ()
#17 0x0805cf19 in ap_child_terminate ()
#18 0x0805d3f5 in ap_child_terminate ()
#19 0x0805dafd in main ()
#20 0x400f314f in __libc_start_main () from /lib/libc.so.6
(gdb) print a
$1 = (font_t *) 0x31
(gdb) print b
$2 = (fontkey_t *) 0xbfffd12c
------------------------------------------------------------------------
The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
http://bugs.php.net/23122
--
Edit this bug report at http://bugs.php.net/?id=23122&edit=1