#24316 [Fbk]: imagepng() crashes apache2

ID: 24316 Updated by: joerg@php.net Reported By: joerg@php.net Status: Feedback Bug Type: GD related Operating System: IRIX64 indigo2 6.5 04091957 IP28 PHP Version: 4.3.3RC1 New Comment: No, its using preforking. I create now a build with less extensions... only php gd+png and try again. Previous Comments: ------------------------------------------------------------------------ [2003-06-24 08:59:29] iliaa@php.net Are you using the 'worker' (thread) based model? If that is the case try removing '--with-ttf=/usr/local' from your configure line and see if you can still replicate the scrash. ------------------------------------------------------------------------ [2003-06-24 08:56:38] joerg@php.net Description: ------------ Apache2 produce a core when using the imagepng() function that would returns the image direcly to the browser. That wont happend when testing the same script with php cli version. First i thought that i can avoid this when saving the image to disk but thats produce only 0 bytes files. The whole box get a fresh install of everything and a plain php was built. './configure' \ '--with-zlib-dir=/usr/local' \ '--with-zlib' \ '--with-apxs2filter=/usr/local/apache2/bin/apxs' \ '--with-config-file-path=/etc' \ '--with-mysql=/usr/local/mysql' \ '--with-pear' \ '--with-gd' \ '--with-jpeg-dir=/usr/local' \ '--with-png-dir=/usr/local' \ '--with-ttf=/usr/local' \ '--enable-debug' \ ldd /usr/local/apache2/modules/libphp4.so libmysqlclient.so.13 => /usr/local/mysql/lib/mysql/libmysqlclient.so.13 libttf.so.3 => /usr/local/lib/libttf.so.3 libpng.so.3 => /usr/local/lib/libpng.so.3 libz.so => /usr/local/lib/libz.so libjpeg.so => /usr/local/lib/libjpeg.so libm.so => /usr/lib32/libm.so libc.so.1 => /usr/lib32/libc.so.1 libcrypt.so => /usr/lib32/libcrypt.so libgen.so => /usr/lib32/libgen.so libnsl.so => /usr/lib32/libnsl.so Reproduce code: --------------- <?php $format = 'png'; $im = ImageCreate (250, 100) or die ("Canot create GD-Stream"); ImageColorAllocate ($im, 120, 255, 255); header('Content-type: image/'.$format); ImagePNG ($im); ?> Expected result: ---------------- Something like \211PNG^M ^Z ^MIHDRúd^A^C\225N¿M^CPLTExÿÿC¾^VÍ^ZIDATx\234íÁ^A^M ÷Om^O^G^TÀ\217^A^Lä^AÒ±ódIEND®B`\202 Actual result: -------------- I get /usr/local/apache2/bin/httpd -X Trace/BPT/RangeErr/DivZero/Ovflow trap (core dumped) when run that script. gdb /usr/local/apache2/bin/httpd core GNU gdb 5.3 Copyright 2002 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "mips-sgi-irix6.5"... Core was generated by `httpd'. Program terminated with signal 5, Trace/breakpoint trap. Reading symbols from /usr/local/lib32/libssl.so.0.9.7...done. Loaded symbols for /usr/local/lib32/libssl.so.0.9.7 Reading symbols from /usr/local/lib32/libcrypto.so.0.9.7...done. Loaded symbols for /usr/local/lib32/libcrypto.so.0.9.7 Reading symbols from /usr/local/apache2/lib/libaprutil-0.so.1...done. Loaded symbols for /usr/local/apache2/lib/libaprutil-0.so.1 Reading symbols from /usr/local/lib32/libexpat.so.1...done. Loaded symbols for /usr/local/lib32/libexpat.so.1 Reading symbols from /usr/local/lib32/libiconv.so.3...done. Loaded symbols for /usr/local/lib32/libiconv.so.3 Reading symbols from /usr/local/apache2/lib/libapr-0.so.1...done. Loaded symbols for /usr/local/apache2/lib/libapr-0.so.1 Reading symbols from /usr/lib32/libm.so...done. Loaded symbols for /usr/lib32/libm.so Reading symbols from /usr/lib32/libsocket.so...done. Loaded symbols for /usr/lib32/libsocket.so Reading symbols from /usr/lib32/libnsl.so...done. Loaded symbols for /usr/lib32/libnsl.so Reading symbols from /usr/lib32/libpthread.so...done. Loaded symbols for /usr/lib32/libpthread.so Reading symbols from /usr/lib32/libmp.so...done. Loaded symbols for /usr/lib32/libmp.so Reading symbols from /usr/lib32/libc.so.1...done. Loaded symbols for /usr/lib32/libc.so.1 Reading symbols from /usr/local/lib32/libz.so...done. Loaded symbols for /usr/local/lib32/libz.so [skip apache module] Reading symbols from /usr/local/apache2/modules/libphp4.so...done. Loaded symbols for /usr/local/apache2/modules/libphp4.so Reading symbols from /usr/local/mysql/lib/mysql/libmysqlclient.so.13...done. Loaded symbols for /usr/local/mysql/lib/mysql/libmysqlclient.so.13 Reading symbols from /usr/local/lib32/libttf.so.3...done. Loaded symbols for /usr/local/lib32/libttf.so.3 Reading symbols from /usr/local/lib32/libpng.so.3...done. Loaded symbols for /usr/local/lib32/libpng.so.3 Loaded symbols for /usr/local/lib32/libz.so Reading symbols from /usr/local/lib32/libjpeg.so...done. Loaded symbols for /usr/local/lib32/libjpeg.so Loaded symbols for /usr/local/lib32/libz.so Reading symbols from /usr/lib32/libcrypt.so...done. Loaded symbols for /usr/lib32/libcrypt.so Reading symbols from /usr/lib32/libgen.so...done. Loaded symbols for /usr/lib32/libgen.so (gdb) bt #0 0x047a0b84 in ?? () from /usr/local/lib32/libz.so #1 0x047ec9b0 in deflateInit2_ () at deflate.c:280 #2 0x047ec9b0 in deflateInit2_ () at deflate.c:280 .... ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=24316&edit=1