ID: 23415
Updated by: sniper@php.net
Reported By: bginter at ndevtech dot net
-Status: Open
+Status: Feedback
Bug Type: Scripting Engine problem
Operating System: Linux 2.4.20
PHP Version: 4CVS-2003-04-29 (stable)
New Comment:
Please try using this CVS snapshot:
http://snaps.php.net/php4-STABLE-latest.tar.gz
For Windows:
http://snaps.php.net/win32/php4-win32-STABLE-latest.zip
Some fixes have been made since you tried last time.
Previous Comments:
------------------------------------------------------------------------
[2003-05-14 13:34:42] vlad@php.net
In my case I can't get it to crash, but instead I see this in the
logs:
May 14 11:34:21 wb-01 project.ipv: PHP Fatal error: Cannot redeclare
class baseobject:hosting in /imprev/include/hosting.inc on line 10
May 14 11:34:28 wb-01 \204W^Z^H: PHP Fatal error: Cannot redeclare
class baseobject:hosting in /imprev/include/hosting.inc on line 10
May 14 11:34:48 wb-01 autoForms.ip\200^C: PHP Fatal error: Cannot
redeclare class baseobject:hosting in /imprev/include/hosting.inc on
line 10
May 14 11:35:02 wb-01 (\237ÿ¿-«M@\220®ÿ¿v: PHP
Fatal error: Cannot redeclare class baseobject:hosting in
/imprev/include/hosting.inc on line 10
May 14 11:35:55 wb-01 : PHP Fatal error: Cannot redeclare class
baseobject:hosting in /imprev/include/hosting.inc on line 10
May 14 11:37:12 wb-01 8¯ÿ¿-«M@ ¾ÿ¿nsCoA:
PHP Fatal error: Cannot redeclare class baseobject:hosting in
/imprev/include/hosting.inc on line 10
May 14 11:37:15 wb-01 ^B\210P@: PHP Fatal error: Cannot redeclare
class baseobject:hosting in /imprev/include/hosting.inc on line 10
May 14 11:37:30 wb-01 ^S: PHP Fatal error: Cannot redeclare class
baseobject:hosting in /imprev/include/hosting.inc on line 10
May 14 11:38:10 wb-01 ^C: PHP Fatal error: Cannot redeclare class
baseobject:hosting in /imprev/include/hosting.inc on line 10
May 14 11:39:05 wb-01 i: PHP Fatal error: Cannot redeclare class
baseobject:hosting in /imprev/include/hosting.inc on line 10
May 14 11:39:23 wb-01 A: PHP Fatal error: Cannot redeclare class
baseobject:hosting in /imprev/include/hosting.inc on line 10
Notice the garbage instead of the filename. The website uses classes
extensively, and other pages seem to work just fine while this is the
only one that bombs (started to bomb earlier today after working for a
few weeks with no trouble). I can't verify that this is the SAME bug,
but it sure does look similar.
------------------------------------------------------------------------
[2003-04-29 13:10:38] bginter at ndevtech dot net
<?php
error_reporting(E_ALL);
ob_implicit_flush();
set_time_limit( 30 );
class Group {
var $list = array();
var $position = 0;
//--------------------------------------------------------------------
//
//--------------------------------------------------------------------
function add ( $value ) {
if ( isset( $value ) ) {
$this->list[] = $value;
$this->position = sizeof( $this->list ) - 1;
return 1;
}
return 0;
}
//--------------------------------------------------------------------
//
//--------------------------------------------------------------------
function &get ( $value ) {
if ( is_array( $this->list ) &&
isset( $value ) &&
is_numeric( $value ) &&
$value >= 0 &&
$value < $this->count() )
{
return $this->list[$value];
}
return NULL;
}
//--------------------------------------------------------------------
//
//--------------------------------------------------------------------
function count () {
return count( $this->list );
}
}
session_name( 'crash3' );
session_start();
if ( !session_is_registered( 'group1' ) ) {
session_register( 'group1' );
$group1 = new Group;
for ( $i = 0; $i < 3; $i++ ) {
$subgroup = new Group;
for ( $j = 0; $j < 3; $j++ ) {
$subgroup->add( "Subgroup $i Element $j" );
}
$group1->add( $subgroup );
}
}
for ( $i = 0; $i < $group1->count(); $i++ ) {
$subgroup = $group1->get( $i );
for ( $j = 0; $j < $subgroup->count(); $j++ ) {
$element = $subgroup->get( $j );
print $element . "<br/>\n";
}
}
$group2 = new Group;
while ( true ) {
for ( $i = 0; $i < $group1->count(); $i++ ) {
// $subgroup = $group1->get( $i );
// Uncomment this and comment line above for Overrun messages
$subgroup =& $group1->get( $i );
$group2->add( $subgroup );
}
}
exit;
?>
This code consistantly crashes PHP, including the latest CVS
snapshot (php4-STABLE-200304291730). I expected it to simply
stop executing after the time limit was reached.
If the session code is commented/removed, it does not crash.
In the second code block, if an ampersand is added to the get()
method call, the script does not segfault consistantly but
produces errors in the Apache log concerning overruns:
e.g.
[Tue Apr 29 11:03:19 2003] Script:
'/usr/local/apache/lariat/lariat2/test/test4/crash3.php'
---------------------------------------
/usr/local/src/php4-STABLE-200304291730/Zend/zend_execute.h(44) : Block
0x0816DB20 status:
Beginning: Overrun (magic=0x0816D548, expected=0x7312F8DC)
End: Unknown
---------------------------------------
The relevant lines of the backtrace are provided below. The call to
php_var_serialize_intern is repeated tens of thousands of times.
Program received signal SIGSEGV, Segmentation fault.
smart_str_print_unsigned (buf=0xbf800087
"@\210¯3@ì\001\200¿\222Ó9@tñÿ¿ta\026\bä\001\200¿oÓ9@¬OT@h\n\026\bì",
num=135684468)
at
/usr/local/src/php4-STABLE-200304291730/ext/standard/php_smart_str.h:90
90 {
(gdb) bt
#0 smart_str_print_unsigned (buf=0xbf800087
"@\210¯3@ì\001\200¿\222Ó9@tñÿ¿ta\026\bä\001\200¿oÓ9@¬OT@h\n\026\bì",
num=135684468)
at
/usr/local/src/php4-STABLE-200304291730/ext/standard/php_smart_str.h:90
#1 0x4039ddef in php_add_var_hash (var_hash=0xbffff174, var=0x8166174,
var_old=0xbf8001e4) at
/usr/local/src/php4-STABLE-200304291730/ext/standard/var.c:377
#2 0x4039d392 in php_var_serialize_intern (buf=0xbffff1a0,
struc=0x1416d9d0, var_hash=0xbffff174)
at /usr/local/src/php4-STABLE-200304291730/ext/standard/var.c:489
#3 0x4039d897 in php_var_serialize_intern (buf=0xbffff1a0,
struc=0x1416cb78, var_hash=0xbffff174)
at /usr/local/src/php4-STABLE-200304291730/ext/standard/var.c:598
This is Apache 1.3.27 with php4-STABLE-200304291730 compiled with:
./configure \
--prefix=/usr/local/php_4.3.1 \
--with-apxs=/usr/local/apache/bin/apxs \
--enable-bcmath \
--enable-gd-native-ttf \
--with-gd \
--with-ttf \
--enable-calendar \
--with-mysql \
--with-openssl \
--with-iconv \
--enable-xml \
--with-pgsql=/usr/local/pgsql-7.3 \
--with-mcrypt \
--with-curl \
--with-zip \
--enable-ftp \
--with-zlib-dir=/usr \
--enable-debug
------------------------------------------------------------------------
--
Edit this bug report at http://bugs.php.net/?id=23415&edit=1