#25146 [Opn->Fbk]: Crashed intermittantly when getting the bounding box

ID: 25146 Updated by: derick@php.net Reported By: mmusone at shatterit dot com -Status: Open +Status: Feedback Bug Type: Reproducible crash Operating System: Linux (Redhat 9) PHP Version: 4.3.2 New Comment: Which Apache 2 MPM are you using? Previous Comments: ------------------------------------------------------------------------ [2003-08-19 07:27:39] mmusone at shatterit dot com Description: ------------ I am having intermittant but frequent crashes (not all the time, but about 3 out of every 5 page loads) when using either imageftbbox OR imagettfbbox. Below is a sample code snippet that i can use to reproduce the crash. Note, this is using apache2. I am unable to reproduce this crash when trying to run it from the command line. it only seems to happen via the browser/apache Note also, that i tried out two system installed fonts, and both of them caused the same problem. I have not tried additional fonts. PHP configure Line: './configure' '--with-apxs2=/usr/local/apache2/bin/apxs' '--with-mysql' '--with-gd=/usr/local' '--with-zlib-dir=/usr/lib' '--with-freetype-dir' '--with-ttf' Gd Details (installed the most recent 2.0.15 GD) gd GD Support enabled GD Version 2.0 or higher FreeType Support enabled FreeType Linkage with freetype JPG Support enabled PNG Support enabled WBMP Support enabled Reproduce code: --------------- <? $fontfile="/usr/share/fonts/local/arial.ttf"; $fontfile="/usr/X11R6/lib/X11/fonts/TTF/luximr.ttf"; $bbox = imageftbbox(10, 0, $fontfile, "50",array()); print_r($bbox); ?> Expected result: ---------------- Array ( [0] => 0 [1] => -1 [2] => 15 [3] => -1 [4] => 15 [5] => -11 [6] => 0 [7] => -11 ) Actual result: -------------- Starting program: /usr/local/apache2/bin/httpd -X -k start [New Thread 1075570272 (LWP 4630)] httpd: Could not determine the server's fully qualified domain name, using 127.0.0.1 for ServerName Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 1075570272 (LWP 4630)] fontTest (element=0x20, key=0x20) at gdft.c:337 337 return (strcmp (a->fontlist, b->fontlist) == 0); (gdb) where #0 fontTest (element=0x20, key=0x20) at gdft.c:337 #1 0x40311b13 in gdCacheGet (head=0x817db00, keydata=0xbfffbc58) at gdcache.c:108 #2 0x4031284d in gdImageStringFTEx (im=0x0, brect=0xbfffbd40, fg=-1, fontlist=0x20 <Address 0x20 out of bounds>, ptsize=10, angle=0, x=-1, y=-1, string=0x817d25c "50", strex=0xbfffbd30) at gdft.c:856 #3 0x401f55ca in php_imagettftext_common (ht=135781120, return_value=0x817cc84, this_ptr=0x0, return_value_used=1, mode=1, extended=1) at /usr/local/src/php-4.3.2/ext/gd/gd.c:3052 #4 0x401f5173 in zif_imageftbbox (ht=5, return_value=0x817cc84, this_ptr=0x0, return_value_used=1) at /usr/local/src/php-4.3.2/ext/gd/gd.c:2921 #5 0x402b5d62 in execute (op_array=0x8182fd4) at /usr/local/src/php-4.3.2/Zend/zend_execute.c:1606 #6 0x402a95fd in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /usr/local/src/php-4.3.2/Zend/zend.c:869 #7 0x402842eb in php_execute_script (primary_file=0xbfffe270) at /usr/local/src/php-4.3.2/main/main.c:1671 #8 0x402ba348 in php_handler (r=0x818bd58) at /usr/local/src/php-4.3.2/sapi/apache2handler/sapi_apache2.c:525 #9 0x0807b952 in ap_run_handler (r=0x818bd58) at config.c:195 #10 0x0807be6a in ap_invoke_handler (r=0x818bd58) at config.c:401 #11 0x0806bc73 in ap_process_request (r=0x818bd58) at http_request.c:288 #12 0x08067ec1 in ap_process_http_connection (c=0x816d1a0) at http_core.c:293 #13 0x0808474a in ap_run_process_connection (c=0x816d1a0) at connection.c:85 #14 0x0807a513 in child_main (child_num_arg=32) at prefork.c:694 #15 0x0807a6be in make_child (s=0x80b5ed8, slot=0) at prefork.c:734 #16 0x0807a717 in startup_children (number_to_start=5) at prefork.c:806 #17 0x0807adfd in ap_mpm_run (_pconf=0x8079dfc, plog=0x80eb8b0, s=0x80b5ed8) at prefork.c:1022 #18 0x0807fb16 in main (argc=4, argv=0xbfffe524) at main.c:660 #19 0x420156a4 in __libc_start_main () from /lib/tls/libc.so.6 (gdb) quit ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=25146&edit=1