#27011 [NEW]: Seg Fault While View A Message In IMP

From: ehicks at binarymagi dot com Operating system: Solaris 9 PHP version: 4.3.4 PHP Bug Type: IMAP related Bug description: Seg Fault While View A Message In IMP Description: ------------ The error occurs when trying to view a message in Horde's IMP. My configure line is as follows: LDFLAGS="-L/usr/local/lib/sparcv9 -L/usr/local/lib -L/home/pgsql/lib -L/home/mysql/lib/mysql -L/usr/local/ssl/lib -R/usr/local/lib/sparcv9 -R/usr/local/lib -R/home/pgsql/lib -R/home/mysql/lib/mysql -R/usr/local/ssl/lib" \ CFLAGS="-mcpu=ultrasparc -Wa,-xarch=v9 -Wl,-R/usr/local/lib/sparcv9 -Wl,-R/usr/local/lib -Wl,-R/usr/local/ssl/lib -Wl,-R/home/pgsql/lib -Wl,-R/home/mysql/lib/mysql" \ ./configure \ --host=sparcv9-sun-solaris2 \ --prefix=/home/httpd/php \ --with-apxs2=/home/httpd/bin/apxs \ --with-openssl=/usr/local/ssl \ --with-mhash=/usr/local \ --with-mcrypt=/usr/local \ --with-mysql=/home/mysql \ --with-pgsql=/home/pgsql \ --with-mm=/usr/local \ --with-curl=/usr/local \ --with-gd \ --enable-memory-limit=yes \ --enable-debug=no \ --with-pear \ --with-jpeg-dir=/usr/local \ --with-png-dir=/usr/local \ --enable-bcmath \ --with-gdbm \ --enable-ftp \ --with-xpm-dir=/usr/local \ --with-gettext \ --with-zlib \ --with-zlib-dir=/usr/local \ --with-gnu-ld \ --with-xml \ --with-imap My IMAP server is from the Courier package and IMAP client is from WU's c-client v2002e Reproduce code: --------------- The code seems to be in the message.php in IMP. Expected result: ---------------- I should see the message I requested Actual result: -------------- [root@lurch httpd]# gdb /home/httpd/bin/httpd GNU gdb 5.3 Copyright 2002 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "sparcv9-sun-solaris2"...(no debugging symbols found)... (gdb) run -X Starting program: /home/httpd/bin/httpd -X (no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)... (no debugging symbols found)... ((Then I hit a page I knew would crash Apache)) Program received signal SIGSEGV, Segmentation fault. 0xffffffff7bacedcc in zend_parse_arg_impl (arg=0x1003853d0, va=0xffffffff7ffe3a78, spec=0xffffffff7ffe3a48) at /root/build/php-4.3.4/Zend/zend_API.c:259 259 *p = Z_LVAL_PP(arg); (gdb) bt #0 0xffffffff7bacedcc in zend_parse_arg_impl (arg=0x1003853d0, va=0xffffffff7ffe3a78, spec=0xffffffff7ffe3a48) at /root/build/php-4.3.4/Zend/zend_API.c:259 #1 0xffffffff7bacfa54 in zend_parse_arg (arg_num=4, arg=0x1003853d0, va=0xffffffff7ffe3a78, spec=0xffffffff7ffe3a48, quiet=0) at /root/build/php-4.3.4/Zend/zend_API.c:439 #2 0xffffffff7bacff40 in zend_parse_va_args (num_args=0, type_spec=0xffffffff7bb6906c "ll", va=0xffffffff7ffe3a78, flags=0) at /root/build/php-4.3.4/Zend/zend_API.c:524 #3 0xffffffff7bad032c in zend_parse_parameters (num_args=4, type_spec=0xffffffff7bb69068 "ssz|ll") at /root/build/php-4.3.4/Zend/zend_API.c:551 #4 0xffffffff7b9493cc in php_pcre_match (ht=4, return_value=0x1008c4c60, this_ptr=0x0, return_value_used=0, global=1) at /root/build/php-4.3.4/ext/pcre/php_pcre.c:375 #5 0xffffffff7b94a464 in zif_preg_match_all (ht=4, return_value=0x1008c4c60, this_ptr=0x0, return_value_used=0) at /root/build/php-4.3.4/ext/pcre/php_pcre.c:608 #6 0xffffffff7baea870 in execute (op_array=0x1008ac670) at /root/build/php-4.3.4/Zend/zend_execute.c:1616 #7 0xffffffff7baeabe4 in execute (op_array=0x100884c20) at /root/build/php-4.3.4/Zend/zend_execute.c:1660 #8 0xffffffff7baeabe4 in execute (op_array=0x1003a07d0) at /root/build/php-4.3.4/Zend/zend_execute.c:1660 #9 0xffffffff7baeabe4 in execute (op_array=0x1003af0c0) at /root/build/php-4.3.4/Zend/zend_execute.c:1660 #10 0xffffffff7baeabe4 in execute (op_array=0x10038f230) at /root/build/php-4.3.4/Zend/zend_execute.c:1660 #11 0xffffffff7bacde24 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /root/build/php-4.3.4/Zend/zend.c:884 #12 0xffffffff7ba6dd08 in php_execute_script (primary_file=0xffffffff7fffef20) at /root/build/php-4.3.4/main/main.c:1729 #13 0xffffffff7baf3914 in php_handler (r=0x10037e6e0) at /root/build/php-4.3.4/sapi/apache2handler/sapi_apache2.c:537 #14 0x00000001000ac8a0 in ap_run_handler () #15 0x00000001000ad798 in ap_invoke_handler () #16 0x000000010007b6d0 in ap_process_request () #17 0x00000001000712e4 in ap_process_http_connection () #18 0x00000001000c55b8 in ap_run_process_connection () #19 0x00000001000c5c18 in ap_process_connection () #20 0x00000001000a8e28 in child_main () #21 0x00000001000a9030 in make_child () #22 0x00000001000a92a4 in startup_children () #23 0x00000001000a9da8 in ap_mpm_run () #24 0x00000001000b79d8 in main () (gdb) print (char *)(executor_globals.function_state_ptr->function)->common.function_name $1 = 0xffffffff7bb69250 "preg_match_all" (gdb) frame 6 #6 0xffffffff7baea870 in execute (op_array=0x1008ac670) at /root/build/php-4.3.4/Zend/zend_execute.c:1616 1616 ((zend_internal_function *) EX(function_state).function)->handler(EX(opline)->extended_value, EX(Ts)[EX(opline)->result.u.var].var.ptr, EX(object).ptr, return_value_used TSRMLS_CC); (gdb) frame 7 #7 0xffffffff7baeabe4 in execute (op_array=0x100884c20) at /root/build/php-4.3.4/Zend/zend_execute.c:1660 1660 zend_execute(EG(active_op_array) TSRMLS_CC); (gdb) frame 8 #8 0xffffffff7baeabe4 in execute (op_array=0x1003a07d0) at /root/build/php-4.3.4/Zend/zend_execute.c:1660 1660 zend_execute(EG(active_op_array) TSRMLS_CC); (gdb) frame 9 #9 0xffffffff7baeabe4 in execute (op_array=0x1003af0c0) at /root/build/php-4.3.4/Zend/zend_execute.c:1660 1660 zend_execute(EG(active_op_array) TSRMLS_CC); (gdb) frame 10 #10 0xffffffff7baeabe4 in execute (op_array=0x10038f230) at /root/build/php-4.3.4/Zend/zend_execute.c:1660 1660 zend_execute(EG(active_op_array) TSRMLS_CC); If you need anything more, please email me directly as, for some reason, I can't access bugs.php.net from my computer. (Traceroue shows the link dieing at cr0.pc0.rdu.redundant.com) I am currently suffering through a lynx session on a server that can connect successfully. -- Edit bug report at http://bugs.php.net/?id=27011&edit=1 -- Try a CVS snapshot (php4): http://bugs.php.net/fix.php?id=27011&r=trysnapshot4 Try a CVS snapshot (php5): http://bugs.php.net/fix.php?id=27011&r=trysnapshot5 Fixed in CVS: http://bugs.php.net/fix.php?id=27011&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=27011&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=27011&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=27011&r=needscript Try newer version: http://bugs.php.net/fix.php?id=27011&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=27011&r=support Expected behavior: http://bugs.php.net/fix.php?id=27011&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=27011&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=27011&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=27011&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=27011&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=27011&r=dst IIS Stability: http://bugs.php.net/fix.php?id=27011&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=27011&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=27011&r=float