Bug #2161 Updated: wddx deserializes crashes httpd

ID: 2161 User Update by: jeffgus@sdnonline.com Status: Analyzed Bug Type: Reproduceable crash Description: wddx deserializes crashes httpd New backtrace... hope this helps things. #0 0x400a9902 in chunk_free (ar_ptr=0x400fe420, p=0x810cd20) at malloc.c:2948 #1 0x400a97c1 in __libc_free (mem=0x810cd28) at malloc.c:2872 #2 0x401aa0b9 in _efree (ptr=0x810cd38) at alloc.c:173 #3 0x401e704f in _php3_free_packet_chunk (chunk_ptr=0x810cd20) at functions/wddx_a.c:206 #4 0x4020277d in dlst_kill (l=0x80e8bd8, freeNode=0x401e7030 <_php3_free_packet_chunk>) at functions/dlist.c:151 #5 0x401e7083 in _php3_wddx_destructor (packet=0x80e8b50) at functions/wddx_a.c:214 #6 0x401aa593 in list_entry_destructor (ptr=0x80e8f30) at list.c:99 #7 0x401a3748 in _php3_hash_del_key_or_index (ht=0x40279888, arKey=0x0, nKeyLength=0, h=1, flag=1) at php3_hash.c:639 #8 0x401aa4e3 in php3_list_do_delete (list=0x40279888, id=1) at list.c:75 #9 0x401e81c6 in php3_wddx_packet_end (ht=0x80e8dc8, return_value=0x40267eec, list=0x40279888, plist=0x4027985c) at functions/wddx_a.c:791 #10 0x401fc484 in phpparse () at control_structures_inline.h:934 #11 0x401a247b in php3_parse (yyin=0x80b8be0) at main.c:1554 #12 0x401a27ad in apache_php3_module_main (r=0x80b5e64, fd=23, display_source_mode=0, preprocessed=0) at main.c:1935 #13 0x4019f5d5 in send_php3 () #14 0x4019f64f in send_parsed_php3 () #15 0x80515b2 in ap_invoke_handler () #16 0x805fb4b in ap_some_auth_required () #17 0x805fba8 in ap_process_request () ---Type <return> to continue, or q <return> to quit--- #18 0x8059b84 in ap_child_terminate () #19 0x8059cbb in ap_child_terminate () #20 0x8059dc4 in ap_child_terminate () #21 0x805a27b in ap_child_terminate () #22 0x805a9ce in main () Full Bug description available at: http://bugs.php.net/?id=2161