PHP 4.0 Bug #2344: Apache SEGV on all php4 files

From: rroberts@muller.com Operating system: Linux Mandrake 6.0 PHP version: 4.0 Latest CVS (21/09/1999) PHP Bug Type: Reproduceable crash Bug description: Apache SEGV on all php4 files Program received signal SIGSEGV, Segmentation fault. _get_zval_ptr (node=0x80e540c, Ts=0xbfffeca8, should_free=0x403da140) at zend_execute.c:85 85 PZVAL_UNLOCK(*Ts[node->u.var].var); (gdb) where #0 _get_zval_ptr (node=0x80e540c, Ts=0xbfffeca8, should_free=0x403da140) at zend_execute.c:85 #1 0x4039a936 in execute (op_array=0x80de9c8) at zend_execute.c:1543 #2 0x40347880 in php_execute_script (primary_file=0xbffff2b4) at main.c:1171 #3 0x40347901 in apache_php_module_main (r=0x80da144, fd=19, display_source_mode=0) at main.c:1212 #4 0x40345968 in send_php () from /usr/lib/apache/libphp4.so Cannot access memory at address 0x1f4. (gdb) l 80 *should_free = 1; 81 return &Ts[node->u.var].tmp_var; 82 break; 83 case IS_VAR: 84 if (Ts[node->u.var].var) { 85 PZVAL_UNLOCK(*Ts[node->u.var].var); 86 *should_free = 0; 87 return *Ts[node->u.var].var; 88 } else { 89 *should_free = 1; (gdb) p *Ts $1 = {tmp_var = {value = {lval = 135129452, dval = 8.554745983835643e-314, str = {val = 0x80de96c " |\016\b", len = 4}, chval = 108 'l', ht = 0x80de96c, obj = {ce = 0x80de96c, properties = 0x4}}, type = 244 'ô', EA = {locks = 19, is_ref = 1}, refcount = -14118}, var = 0x80de96c, EA = {tmp_var = {value = {lval = 135129452, dval = 8.554745983835643e-314, str = {val = 0x80de96c " |\016\b", len = 4}, chval = 108 'l', ht = 0x80de96c, obj = {ce = 0x80de96c, properties = 0x4}}, type = 244 'ô', EA = {locks = 19, is_ref = 1}, refcount = -14118}, str = 0x4019c8cf, offset = 13, type = 255 'ÿ'}} (gdb) p * node $2 = {op_type = 4, u = {constant = {value = {lval = 10, dval = 4.9406564584124654e-323, str = {val = 0xa <Address 0xa out of bounds>, len = 0}, chval = 10 '\n', ht = 0xa, obj = {ce = 0xa, properties = 0x0}}, type = 81 'Q', EA = {locks = 56, is_ref = 0}, refcount = -9316}, var = 10, opline_num = 10, fetch_type = 10, op_array = 0xa, EA = {var = 10, type = 0}}} (gdb) p Ts[10] $3 = {tmp_var = {value = {lval = 1851749235, dval = 2.0391515370628635e+180, str = {val = 0x6e5f7373 <Address 0x6e5f7373 out of bounds>, len = 1700754281}, chval = 115 's', ht = 0x6e5f7373, obj = {ce = 0x6e5f7373, properties = 0x655f7369}}, type = 110 'n', EA = { locks = 114, is_ref = 0}, refcount = 116}, var = 0x6e5f7373, EA = {tmp_var = {value = {lval = 1851749235, dval = 2.0391515370628635e+180, str = {val = 0x6e5f7373 <Address 0x6e5f7373 out of bounds>, len = 1700754281}, chval = 115 's', ht = 0x6e5f7373, obj = {ce = 0x6e5f7373, properties = 0x655f7369}}, type = 110 'n', EA = {locks = 114, is_ref = 0}, refcount = 116}, str = 0x6e5f7373, offset = 1734308713, type = 101 'e'}}