#27178 [NEW]: PHP segfault (sometimes) when runnig the script

From: bjoern at thinkphphq dot de Operating system: Linux (Debian, RedHat, SuSE) PHP version: 4.3.4 PHP Bug Type: Scripting Engine problem Bug description: PHP segfault (sometimes) when runnig the script Description: ------------ Hi there, http://www.rent-a-phpwizard.de/2debug.tgz On a RedHat 7.3 (512 MB): [bjoern@baer 2debug]$ php segf.php Segmentation fault gdb output: (gdb) run /home/bjoern/2debug/segf.php Starting program: /usr/local/bin/php /home/bjoern/2debug/segf.php Program received signal SIGSEGV, Segmentation fault. 0x0813adff in execute (op_array=0x81b436c) at /usr/local/src/php-4.3.4/Zend/zend_execute.c:1758 1758 ALLOC_ZVAL(valptr); (gdb) bt full #0 0x0813adff in execute (op_array=0x81b436c) at /usr/local/src/php-4.3.4/Zend/zend_execute.c:1758 valptr = (zval *) 0x0 value = (zval *) 0x4213502c execute_data = {opline = 0x42135014, function_state = { function_symbol_table = 0x0, function = 0x81b436c, reserved = {0x81206e9, 0x81b43d4, 0xbffffaa0, 0x0}}, fbc = 0x0, ce = 0x0, object = {ptr = 0x0}, Ts = 0xbeeba750, original_in_execution = 0 '\0', op_array = 0x81b436c, prev_execute_data = 0x0} #1 0x08127c44 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /usr/local/src/php-4.3.4/Zend/zend.c:884 files = 0xbfffd834 i = 1 file_handle = (zend_file_handle *) 0xbffffaa0 orig_op_array = (zend_op_array *) 0x0 local_retval = (zval *) 0x0 #2 0x08100f5c in php_execute_script (primary_file=0xbffffaa0) at /usr/local/src/php-4.3.4/main/main.c:1729 orig_bailout = {{__jmpbuf = {135755056, 135777368, -1073743236, -1073743144, -1073743520, 135536498}, __mask_was_saved = 0, __saved_mask = {__val = { 0 <repeats 32 times>}}}} orig_bailout_set = 1 '\001' prepend_file_p = (zend_file_handle *) 0x0 append_file_p = (zend_file_handle *) 0x0 prepend_file = {type = 0 '\0', filename = 0x0, opened_path = 0x0, handle = { fd = 0, fp = 0x0}, free_filename = 0 '\0'} append_file = {type = 0 '\0', filename = 0x0, opened_path = 0x0, handle = { fd = 0, fp = 0x0}, free_filename = 0 '\0'} old_cwd = 0xbfffd840 "" old_primary_file_path = 0x0 retval = 0 #3 0x081426fc in main (argc=2, argv=0xbffffb44) at /usr/local/src/php-4.3.4/sapi/cli/php_cli.c:819 orig_bailout = {{__jmpbuf = {0, 0, 0, 0, 0, 0}, __mask_was_saved = 0, __saved_mask = {__val = {0 <repeats 32 times>}}}} exit_status = 0 c = 135506888 file_handle = {type = 2 '\002', ---Type <return> to continue, or q <return> to quit--- filename = 0xbffffc44 "/home/bjoern/2debug/segf.php", opened_path = 0x0, handle = { fd = 135989232, fp = 0x81b07f0}, free_filename = 0 '\0'} behavior = 1 orig_optind = 1 orig_optarg = 0x0 arg_free = 0xbffffc44 "/home/bjoern/2debug/segf.php" arg_excp = (char **) 0x42135014 script_file = 0xbffffc44 "/home/bjoern/2debug/segf.php" global_vars = {head = 0x0, tail = 0x0, size = 4, count = 0, dtor = 0, persistent = 0 '\0', traverse_ptr = 0x8177aac} interactive = 0 module_started = 1 lineno = 1 exec_direct = 0x0 param_error = 0x0 hide_argv = 0 #4 0x42017589 in __libc_start_main () from /lib/i686/libc.so.6 No symbol table info available. georg, Andrey and Sterling already had a look at the problem. It seemed to be an error in the Fastcache function but they also weren't sure if the problem really was in the FASTCACHE function. The strangeness is, on a SuSE 7.3 (1 GB RAM, 256 MB swap) the script works. On a debian with 256 MB PHP says "Could not allocate <huge number> bytes of memory" and terminates (which would be okay), on an old SuSE 6.4 with 392 MB RAM the script segfaults again, same bt as above. We're not really sure where the problem could be. Reproduce code: --------------- http://www.rent-a-phpwizard.de/2debug.tgz extract, cd to 2debug/ and then run "php segf.php". Expected result: ---------------- a message like "Done" Actual result: -------------- see above, on some systems a segfault with the bt shown above, on some systems it does work correctly. -- Edit bug report at http://bugs.php.net/?id=27178&edit=1 -- Try a CVS snapshot (php4): http://bugs.php.net/fix.php?id=27178&r=trysnapshot4 Try a CVS snapshot (php5): http://bugs.php.net/fix.php?id=27178&r=trysnapshot5 Fixed in CVS: http://bugs.php.net/fix.php?id=27178&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=27178&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=27178&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=27178&r=needscript Try newer version: http://bugs.php.net/fix.php?id=27178&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=27178&r=support Expected behavior: http://bugs.php.net/fix.php?id=27178&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=27178&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=27178&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=27178&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=27178&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=27178&r=dst IIS Stability: http://bugs.php.net/fix.php?id=27178&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=27178&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=27178&r=float