#37061 [NEW]: Zend HashTable getting corrupted

From: ceo at l-i-e dot com Operating system: 5.3-RELEASE PHP version: 5.1.2 PHP Bug Type: Reproducible crash Bug description: Zend HashTable getting corrupted Description: ------------ It's a LONG script, but it always ends up in: Zend/zend_hash.c:66 (give or take lines changed in CVS) zend_output_debug_string(1, "%s(%d) : ht=%p is being cleaned", file, line, ht); and then it just quits, with no other error output. I *suspect* that the root cause is in something like this: curl_setopt($curl, CURLOPT_BINARYTRANSFER, 1); curl_setopt($curl, CURLOPT_URL, 'http://example.com/example.jpg'); $jpeg = curl_exec($curl); //ASSUME that the server bounces us around with 302s and gives: <html><head><meta http-equiv="Refresh" src="0;http://example.com/"></head><body></body></html> curl_setopt($curl, CURLOPT_BINARYTRANSFER, 0); curl_setopt($curl, CURLOPT_URL, 'http://example.com'); $html = curl_exec($curl); At this point, I get warnings about $html not being zero-terminated if I try to use it, and, sure enough, it's got garbage characters at the end. I SUSPECT that the curl handle is getting forced into non-binary mode because of the 302s and the fact that plain/text comes out at the end of that -- And I SUSPECT that this somehow gets the curl handle's "binary" status out of sync somehow with itself, and gets curl all confused. All of this, however, is just my suspicion... It COULD be the OCR GD stuff I'm doing... But something is definitely corrupting thing somewhere. Hopefully somebody who understand backtrace better than I can track it down... Reproduce code: --------------- http://acousticdemo.com/info.com/overture/overture.phps http://acousticdemo.com/info.com/overture/overture.inc.phps I am happy to provide my login/password to *@php.net if you can't reproduce and want to run this from CLI under gdb and see it in action. I've already done that, and can reproduce it in gdb. It just takes awhile to get to that state, and my "short" scripts are not yet causing the bug. :-( Also happens in: php_5.1.2 (release) php5.1-200604071630 php5.1-200604102030 Take your pick. Expected result: ---------------- Ideally, it would just "work" and continue on, keeping track of strings and binary strings without me worrying about it. I'd settle for an E_ERROR for conditions where a server returns plain-text instead of binary expected. Or even an E_ERROR when the strings are known to be corrupted. But a "silent" failure with only C errors under --with-debug is pretty harsh. Actual result: -------------- Silent script end prematurely under normal CLI. --with-debug and gdb get me this: #0 _zend_is_inconsistent (ht=0x83e14a4, file=0x823e6b4 "/www/acousticdemo.com/php_cvs/php5.1-200604102030/Zend/zend_hash.c", line=752) at /www/acousticdemo.com/php_cvs/php5.1-200604102030/Zend/zend_hash.c:67 #1 0x081a899f in zend_hash_copy (target=0x83e0ca4, source=0x83e14a4, pCopyConstructor=0x819d0cc <zval_add_ref>, tmp=0xbfbfc950, size=4) at /www/acousticdemo.com/php_cvs/php5.1-200604102030/Zend/zend_hash.c:752 #2 0x0819d1ed in _zval_copy_ctor_func (zvalue=0x839ce64, __zend_filename=0x823d6b0 "/www/acousticdemo.com/php_cvs/php5.1-200604102030/Zend/zend_variables.h", __zend_lineno=45) at /www/acousticdemo.com/php_cvs/php5.1-200604102030/Zend/zend_variables.c:134 #3 0x0819da97 in _zval_copy_ctor (zvalue=0x839ce64, __zend_filename=0x823d628 "/www/acousticdemo.com/php_cvs/php5.1-200604102030/Zend/zend.c", __zend_lineno=1009) at zend_variables.h:45 #4 0x0819ec52 in zend_error (type=2, format=0x823d488 "String is not zero-terminated (%s) (source: %s:%d)") at /www/acousticdemo.com/php_cvs/php5.1-200604102030/Zend/zend.c:1009 #5 0x0819cfb9 in _zval_dtor_func (zvalue=0x84c68a4, __zend_filename=0x823c3e0 "/www/acousticdemo.com/php_cvs/php5.1-200604102030/Zend/zend_variables.h", __zend_lineno=35) at /www/acousticdemo.com/php_cvs/php5.1-200604102030/Zend/zend_variables.c:35 #6 0x081919cb in _zval_dtor (zvalue=0x84c68a4, __zend_filename=0x823c344 "/www/acousticdemo.com/php_cvs/php5.1-200604102030/Zend/zend_execute_API.c", __zend_lineno=395) at zend_variables.h:35 #7 0x08191b84 in _zval_ptr_dtor (zval_ptr=0x83e0730, __zend_filename=0x823d4bc "/www/acousticdemo.com/php_cvs/php5.1-200604102030/Zend/zend_variables.c", __zend_lineno=175) at /www/acousticdemo.com/php_cvs/php5.1-200604102030/Zend/zend_execute_API.c:395 #8 0x0819d2f7 in _zval_ptr_dtor_wrapper (zval_ptr=0x83e0730) at /www/acousticdemo.com/php_cvs/php5.1-200604102030/Zend/zend_variables.c:175 #9 0x081a8338 in zend_hash_clean (ht=0x83e14a4) at /www/acousticdemo.com/php_cvs/php5.1-200604102030/Zend/zend_hash.c:547 #10 0x081bcae1 in zend_do_fcall_common_helper_SPEC (execute_data=0xbfbfd3e0) at zend_vm_execute.h:255 #11 0x081bd2f1 in ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER (execute_data=0xbfbfd3e0) at zend_vm_execute.h:322 #12 0x081bc486 in execute (op_array=0x8387124) at zend_vm_execute.h:92 #13 0x0819ef70 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /www/acousticdemo.com/php_cvs/php5.1-200604102030/Zend/zend.c:1109 #14 0x0815bae9 in php_execute_script (primary_file=0xbfbfeb98) at /www/acousticdemo.com/php_cvs/php5.1-200604102030/main/main.c:1728 #15 0x08202e1b in main (argc=2, argv=0xbfbfec28) at /www/acousticdemo.com/php_cvs/php5.1-200604102030/sapi/cli/php_cli.c:1092 -- Edit bug report at http://bugs.php.net/?id=37061&edit=1 -- Try a CVS snapshot (PHP 4.4): http://bugs.php.net/fix.php?id=37061&r=trysnapshot44 Try a CVS snapshot (PHP 5.1): http://bugs.php.net/fix.php?id=37061&r=trysnapshot51 Try a CVS snapshot (PHP 6.0): http://bugs.php.net/fix.php?id=37061&r=trysnapshot60 Fixed in CVS: http://bugs.php.net/fix.php?id=37061&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=37061&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=37061&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=37061&r=needscript Try newer version: http://bugs.php.net/fix.php?id=37061&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=37061&r=support Expected behavior: http://bugs.php.net/fix.php?id=37061&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=37061&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=37061&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=37061&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=37061&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=37061&r=dst IIS Stability: http://bugs.php.net/fix.php?id=37061&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=37061&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=37061&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=37061&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=37061&r=mysqlcfg