#25146 [NEW]: Crashed intermittantly when getting the bounding box

From: mmusone at shatterit dot com Operating system: Linux (Redhat 9) PHP version: 4.3.2 PHP Bug Type: Reproducible crash Bug description: Crashed intermittantly when getting the bounding box Description: ------------ I am having intermittant but frequent crashes (not all the time, but about 3 out of every 5 page loads) when using either imageftbbox OR imagettfbbox. Below is a sample code snippet that i can use to reproduce the crash. Note, this is using apache2. I am unable to reproduce this crash when trying to run it from the command line. it only seems to happen via the browser/apache Note also, that i tried out two system installed fonts, and both of them caused the same problem. I have not tried additional fonts. PHP configure Line: './configure' '--with-apxs2=/usr/local/apache2/bin/apxs' '--with-mysql' '--with-gd=/usr/local' '--with-zlib-dir=/usr/lib' '--with-freetype-dir' '--with-ttf' Gd Details (installed the most recent 2.0.15 GD) gd GD Support enabled GD Version 2.0 or higher FreeType Support enabled FreeType Linkage with freetype JPG Support enabled PNG Support enabled WBMP Support enabled Reproduce code: --------------- <? $fontfile="/usr/share/fonts/local/arial.ttf"; $fontfile="/usr/X11R6/lib/X11/fonts/TTF/luximr.ttf"; $bbox = imageftbbox(10, 0, $fontfile, "50",array()); print_r($bbox); ?> Expected result: ---------------- Array ( [0] => 0 [1] => -1 [2] => 15 [3] => -1 [4] => 15 [5] => -11 [6] => 0 [7] => -11 ) Actual result: -------------- Starting program: /usr/local/apache2/bin/httpd -X -k start [New Thread 1075570272 (LWP 4630)] httpd: Could not determine the server's fully qualified domain name, using 127.0.0.1 for ServerName Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 1075570272 (LWP 4630)] fontTest (element=0x20, key=0x20) at gdft.c:337 337 return (strcmp (a->fontlist, b->fontlist) == 0); (gdb) where #0 fontTest (element=0x20, key=0x20) at gdft.c:337 #1 0x40311b13 in gdCacheGet (head=0x817db00, keydata=0xbfffbc58) at gdcache.c:108 #2 0x4031284d in gdImageStringFTEx (im=0x0, brect=0xbfffbd40, fg=-1, fontlist=0x20 <Address 0x20 out of bounds>, ptsize=10, angle=0, x=-1, y=-1, string=0x817d25c "50", strex=0xbfffbd30) at gdft.c:856 #3 0x401f55ca in php_imagettftext_common (ht=135781120, return_value=0x817cc84, this_ptr=0x0, return_value_used=1, mode=1, extended=1) at /usr/local/src/php-4.3.2/ext/gd/gd.c:3052 #4 0x401f5173 in zif_imageftbbox (ht=5, return_value=0x817cc84, this_ptr=0x0, return_value_used=1) at /usr/local/src/php-4.3.2/ext/gd/gd.c:2921 #5 0x402b5d62 in execute (op_array=0x8182fd4) at /usr/local/src/php-4.3.2/Zend/zend_execute.c:1606 #6 0x402a95fd in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /usr/local/src/php-4.3.2/Zend/zend.c:869 #7 0x402842eb in php_execute_script (primary_file=0xbfffe270) at /usr/local/src/php-4.3.2/main/main.c:1671 #8 0x402ba348 in php_handler (r=0x818bd58) at /usr/local/src/php-4.3.2/sapi/apache2handler/sapi_apache2.c:525 #9 0x0807b952 in ap_run_handler (r=0x818bd58) at config.c:195 #10 0x0807be6a in ap_invoke_handler (r=0x818bd58) at config.c:401 #11 0x0806bc73 in ap_process_request (r=0x818bd58) at http_request.c:288 #12 0x08067ec1 in ap_process_http_connection (c=0x816d1a0) at http_core.c:293 #13 0x0808474a in ap_run_process_connection (c=0x816d1a0) at connection.c:85 #14 0x0807a513 in child_main (child_num_arg=32) at prefork.c:694 #15 0x0807a6be in make_child (s=0x80b5ed8, slot=0) at prefork.c:734 #16 0x0807a717 in startup_children (number_to_start=5) at prefork.c:806 #17 0x0807adfd in ap_mpm_run (_pconf=0x8079dfc, plog=0x80eb8b0, s=0x80b5ed8) at prefork.c:1022 #18 0x0807fb16 in main (argc=4, argv=0xbfffe524) at main.c:660 #19 0x420156a4 in __libc_start_main () from /lib/tls/libc.so.6 (gdb) quit -- Edit bug report at http://bugs.php.net/?id=25146&edit=1 -- Try a CVS snapshot (php4): http://bugs.php.net/fix.php?id=25146&r=trysnapshot4 Try a CVS snapshot (php5): http://bugs.php.net/fix.php?id=25146&r=trysnapshot5 Fixed in CVS: http://bugs.php.net/fix.php?id=25146&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=25146&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=25146&r=needtrace Try newer version: http://bugs.php.net/fix.php?id=25146&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=25146&r=support Expected behavior: http://bugs.php.net/fix.php?id=25146&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=25146&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=25146&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=25146&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=25146&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=25146&r=dst IIS Stability: http://bugs.php.net/fix.php?id=25146&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=25146&r=gnused