#30397 [Opn->Csd]: Segmentation fault in php_printf

ID: 30397 Updated by: tony2001@php.net Reported By: kameshj at fastmail dot fm -Status: Open +Status: Closed Bug Type: Zend Engine 2 problem Operating System: Any Operating System PHP Version: Irrelevant New Comment: kameshj at fastmail dot fm: If the bug has been fixed, than the bug report should be closed probably? Previous Comments: ------------------------------------------------------------------------ [2004-10-16 12:37:25] kameshj at fastmail dot fm Commited both in 5_0 branch and 5_1 HEAD ------------------------------------------------------------------------ [2004-10-16 12:35:50] kameshj at fastmail dot fm Fixed from hyanantha's account. ------------------------------------------------------------------------ [2004-10-11 16:49:29] kameshj at fastmail dot fm Description: ------------ Startup errors causes the segmentation fault if display_startup_errors is enabled. Reproduce code: --------------- display_startup_errors=On extension=kamesh.so(Any nonexistent module) start apache Segmentation fault will happen inside php_printf. Expected result: ---------------- It should log in a error log that non existent module. But should not seg fault. Actual result: -------------- I could see php_output_activate(TSRMLS_C) getting called from php_module_startup immedeately after php_output_startup. Why is this needed? As each SAPI modules call php_output_activate(TSRMLS_C) explicitly as a part of request startup. Why am I concerned about this? Ans: php_output_activate(TSRMLS_C) sets OG(php_body_write) = php_ub_body_write; which causes calls to php_printf to use php_ub_body_write which depends on SG(request_info) which is null while php_printf is invoked as part of apache startup error(Like Invalid extension/ Non existent extension) logging. This causes segmentation fault. This change seems to have been introduced in version 1.371 of main/main.c by Zeev(3 years and 3 months ago). The comment says, Fix a major thread safety bug in the output mechanism @- Fixed a major memory corruption bug in the thread safe version (Zeev) Can I remove a call to php_output_activate(TSRMLS_C) from php_module_startup? PS:What is the use of display_startup_errors? What does display mean with respect to startup as it might not have any associated request context? ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=30397&edit=1