#34883 [Fbk->Opn]: crash when accessing superglobals

ID: 34883 User updated by: sveta at microbecal dot com Reported By: sveta at microbecal dot com -Status: Feedback +Status: Open Bug Type: Apache2 related Operating System: Windows XP SP1 PHP Version: 5CVS-2005-10-16 (snap) New Comment: Same result after renaming php.ini. I experience with different sets of modules. Above stack with usefull information was created with option: extension=php_runkit.dll Below stack with option: extension=php_xdebug.dll --- (gdb) run -X Starting program: /cygdrive/d/Program Files/Apache Group/Apache2/bin/Apache.exe -X ---Type <return> to continue, or q <return> to quit--- Program received signal SIGSEGV, Segmentation fault. [Switching to thread 2016.0x42c] 0x7801b674 in TowerExplode () from /cygdrive/c/WINDOWS/system32/rpcrt4.dll (gdb) c Continuing. warning: HEAP[Apache.exe]: warning: Invalid Address specified to RtlFreeHeap( 05D70000, 01220650 ) Program received signal SIGTRAP, Trace/breakpoint trap. 0x77f76491 in ntdll!DbgUiConnectToDbg () from ntdll.dll (gdb) bt #0 0x77f76491 in ntdll!DbgUiConnectToDbg () from ntdll.dll #1 0x77fa1699 in ntdll!RtlpNtMakeTemporaryKey () from ntdll.dll #2 0x77f87c1b in ntdll!RtlCheckRegistryKey () from ntdll.dll #3 0x05d70000 in ?? () #4 0x01220650 in ?? () #5 0x0582f980 in ?? () #6 0x77fa2400 in ntdll!RtlpNtMakeTemporaryKey () from ntdll.dll #7 0x05d70000 in ?? () #8 0x01220648 in ?? () #9 0x77fb152c in wcstombs () from ntdll.dll Previous frame inner to this frame (corrupt stack?) (gdb) c Continuing. Program received signal SIGSEGV, Segmentation fault. 0x7801b674 in TowerExplode () from /cygdrive/c/WINDOWS/system32/rpcrt4.dll (gdb) bt #0 0x7801b674 in TowerExplode () from /cygdrive/c/WINDOWS/system32/rpcrt4.dll #1 0x77dd8de5 in ElfNumberOfRecords () from /cygdrive/c/WINDOWS/system32/advapi32.dll #2 0x77ded830 in CredWriteA () from /cygdrive/c/WINDOWS/system32/advapi32.dll #3 0x77dd8d9b in DestroyPrivateObjectSecurity () from /cygdrive/c/WINDOWS/system32/advapi32.dll #4 0x00000000 in ?? () from (gdb) c Continuing. Program received signal SIGSEGV, Segmentation fault. [Switching to thread 2016.0xb60] 0x7801b674 in TowerExplode () from /cygdrive/c/WINDOWS/system32/rpcrt4.dll (gdb) c Continuing. warning: HEAP[Apache.exe]: warning: Invalid Address specified to RtlFreeHeap( 05F30000, 01220650 ) Program received signal SIGTRAP, Trace/breakpoint trap. 0x77f76491 in ntdll!DbgUiConnectToDbg () from ntdll.dll (gdb) bt #0 0x77f76491 in ntdll!DbgUiConnectToDbg () from ntdll.dll #1 0x77fa1699 in ntdll!RtlpNtMakeTemporaryKey () from ntdll.dll #2 0x77f87c1b in ntdll!RtlCheckRegistryKey () from ntdll.dll #3 0x05f30000 in ?? () #4 0x01220650 in ?? () #5 0x053ef980 in ?? () #6 0x77fa2400 in ntdll!RtlpNtMakeTemporaryKey () from ntdll.dll #7 0x05f30000 in ?? () #8 0x01220648 in ?? () #9 0x77fb152c in wcstombs () from ntdll.dll Previous frame inner to this frame (corrupt stack?) (gdb) c Continuing. Program received signal SIGSEGV, Segmentation fault. [Switching to thread 2016.0x42c] 0x10003383 in crc32_table () (gdb) bt #0 0x10003383 in crc32_table () #1 0x00000005 in ?? () #2 0x010631b4 in ?? () #3 0x0121b0c0 in ?? () #4 0xbaadf00d in ?? () #5 0xbaadf00d in ?? () #6 0xbaadf00d in ?? () #7 0xbaadf00d in ?? () #8 0xbaadf00d in ?? () #9 0xbaadf00d in ?? () #10 0xbaadf00d in ?? () #11 0xbaadf00d in ?? () #12 0xbaadf00d in ?? () #13 0xbaadf00d in ?? () #14 0xbaadf00d in ?? () #15 0xbaadf00d in ?? () #16 0xbaadf00d in ?? () #17 0xbaadf00d in ?? () #18 0xbaadf00d in ?? () #19 0xbaadf00d in ?? () #20 0x01214830 in ?? () #21 0x6eed0cbf in libapr!_apr_array_pop@4 () from /cygdrive/d/Program Files/Apache Group/Apache2/bin/libapr.dll #22 0x01214830 in ?? () #23 0x00000008 in ?? () #24 0x00000004 in ?? () #25 0x00000002 in ?? () #26 0x00000002 in ?? () #27 0x6eed0c8e in libapr!_apr_array_pop@4 () from /cygdrive/d/Program Files/Apache Group/Apache2/bin/libapr.dll #28 0x009e36c8 in ?? () #29 0x0121b0c0 in ?? () #30 0x00000000 in ?? () from ---- (gdb) c Continuing. Program exited with code 0200. Previous Comments: ------------------------------------------------------------------------ [2005-10-18 23:48:04] tony2001@php.net Sveta, please rename your php.ini to something else to be sure you're not loading any modules and restart the web-server. And try to reproduce it again. ------------------------------------------------------------------------ [2005-10-18 23:38:16] sveta at microbecal dot com Same result. Same stack with php.ini-recommended. From Windows system alert: --- szAppName : Apache.exe szAppVer : 2.0.54.0 szModName : php5apache2.dll szModVer : 5.1.0.0 offset : 00003383 --- With my custom php.ini stack is other: --- (gdb) run -X Starting program: /cygdrive/d/Program Files/Apache Group/Apache2/bin/Apache.exe -X ---Type <return> to continue, or q <return> to quit--- ---Type <return> to continue, or q <return> to quit--- Program received signal SIGSEGV, Segmentation fault. [Switching to thread 3840.0xfe8] 0x7801b674 in TowerExplode () from /cygdrive/c/WINDOWS/system32/rpcrt4.dll (gdb) bt #0 0x7801b674 in TowerExplode () from /cygdrive/c/WINDOWS/system32/rpcrt4.dll #1 0x77dd8de5 in ElfNumberOfRecords () from /cygdrive/c/WINDOWS/system32/advapi32.dll #2 0x77ded830 in CredWriteA () from /cygdrive/c/WINDOWS/system32/advapi32.dll #3 0x77dd8d9b in DestroyPrivateObjectSecurity () from /cygdrive/c/WINDOWS/system32/advapi32.dll #4 0x00000000 in ?? () from (gdb) c Continuing. Program received signal SIGSEGV, Segmentation fault. 0x00aa9b95 in zend_hash_apply () from /cygdrive/d/Program Files/PHP4/php5ts.dll (gdb) bt #0 0x00aa9b95 in zend_hash_apply () from /cygdrive/d/Program Files/PHP4/php5ts.dll #1 0x01d71475 in php_runkit!get_module () from /cygdrive/d/Program Files/PHP4/ext/php_runkit.dll #2 0xbaadf00d in ?? () #3 0x01d726c0 in php_runkit!get_module () from /cygdrive/d/Program Files/PHP4/ext/php_runkit.dll #4 0x01fb6180 in ?? () #5 0x00e0e800 in ?? () #6 0x010f7600 in ?? () #7 0x00a16cc0 in zend_get_module_started () from /cygdrive/d/Program Files/PHP4/php5ts.dll #8 0x01fb6180 in ?? () #9 0x00a16cdc in zend_get_module_started () from /cygdrive/d/Program Files/PHP4/php5ts.dll #10 0x00000001 in ?? () #11 0x0000002e in ?? () #12 0x01fb6180 in ?? () #13 0x00aa9bd2 in zend_hash_apply () from /cygdrive/d/Program Files/PHP4/php5ts.dll #14 0x01fb6180 in ?? () #15 0x05f7fb54 in ?? () #16 0x01fb6180 in ?? () #17 0x0202e1d0 in ?? () #18 0x05f7fb50 in ?? () #19 0x00a1246d in php5ts!get_active_class_name () from /cygdrive/d/Program Files/PHP4/php5ts.dll #20 0x00e0e800 in ?? () #21 0x00a16cc0 in zend_get_module_started () from /cygdrive/d/Program Files/PHP4/php5ts.dll #22 0x01fb6180 in ?? () #23 0x0202e1d0 in ?? () #24 0x05f7fcec in ?? () #25 0x01fb6180 in ?? () #26 0xbaadf00d in ?? () #27 0xbaadf00d in ?? () #28 0xbaadf00d in ?? () #29 0xbaadf00d in ?? () #30 0xbaadf00d in ?? () #31 0xbaadf00d in ?? () #32 0xbaadf00d in ?? () #33 0xbaadf00d in ?? () #34 0xbaadf00d in ?? () #35 0xbaadf00d in ?? () #36 0xbaadf00d in ?? () #37 0xbaadf00d in ?? () #38 0xbaadf00d in ?? () #39 0xbaadf00d in ?? () #40 0xbaadf00d in ?? () #41 0xbaadf00d in ?? () #42 0x0002e1d0 in ?? () #43 0x05f7fdfc in ?? () #44 0x00ad1849 in php_register_variable_safe () Previous frame inner to this frame (corrupt stack?) ------------------------------------------------------------------------ [2005-10-18 14:42:41] tony2001@php.net Please try using this CVS snapshot: http://snaps.php.net/php5-latest.tar.gz For Windows: http://snaps.php.net/win32/php5-win32-latest.zip Please try next Win32 snapshot. ------------------------------------------------------------------------ [2005-10-18 13:20:49] sveta at microbecal dot com I can reproduce crash with php.ini-recommended. But I can not reproduce backtrace "that starts somewhere in PHP". ------------------------------------------------------------------------ [2005-10-18 13:07:25] tony2001@php.net Are you able to reproduce it without php_mime_magic.dll loaded ? ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at http://bugs.php.net/34883 -- Edit this bug report at http://bugs.php.net/?id=34883&edit=1