Re: PHP 4.0 Bug #2344: Apache SEGV on all php4 files

In fact, this happens even in cgi executable. Did some patch break Zend? rroberts@muller.com wrote: > From: rroberts@muller.com > Operating system: Linux Mandrake 6.0 > PHP version: 4.0 Latest CVS (21/09/1999) > PHP Bug Type: Reproduceable crash > Bug description: Apache SEGV on all php4 files > > Program received signal SIGSEGV, Segmentation fault. > _get_zval_ptr (node=0x80e540c, Ts=0xbfffeca8, should_free=0x403da140) at zend_execute.c:85 > 85 PZVAL_UNLOCK(*Ts[node->u.var].var); > (gdb) where > #0 _get_zval_ptr (node=0x80e540c, Ts=0xbfffeca8, should_free=0x403da140) at zend_execute.c:85 > #1 0x4039a936 in execute (op_array=0x80de9c8) at zend_execute.c:1543 > #2 0x40347880 in php_execute_script (primary_file=0xbffff2b4) at main.c:1171 > #3 0x40347901 in apache_php_module_main (r=0x80da144, fd=19, display_source_mode=0) at main.c:1212 > #4 0x40345968 in send_php () from /usr/lib/apache/libphp4.so > Cannot access memory at address 0x1f4. > (gdb) l > 80 *should_free = 1; > 81 return &Ts[node->u.var].tmp_var; > 82 break; > 83 case IS_VAR: > 84 if (Ts[node->u.var].var) { > 85 PZVAL_UNLOCK(*Ts[node->u.var].var); > 86 *should_free = 0; > 87 return *Ts[node->u.var].var; > 88 } else { > 89 *should_free = 1; > (gdb) p *Ts > $1 = {tmp_var = {value = {lval = 135129452, dval = 8.554745983835643e-314, str = {val = 0x80de96c " |\016\b", len = 4}, chval = 108 'l', > ht = 0x80de96c, obj = {ce = 0x80de96c, properties = 0x4}}, type = 244 'ô', EA = {locks = 19, is_ref = 1}, refcount = -14118}, > var = 0x80de96c, EA = {tmp_var = {value = {lval = 135129452, dval = 8.554745983835643e-314, str = {val = 0x80de96c " |\016\b", > len = 4}, chval = 108 'l', ht = 0x80de96c, obj = {ce = 0x80de96c, properties = 0x4}}, type = 244 'ô', EA = {locks = 19, > is_ref = 1}, refcount = -14118}, str = 0x4019c8cf, offset = 13, type = 255 'ÿ'}} > (gdb) p * node > $2 = {op_type = 4, u = {constant = {value = {lval = 10, dval = 4.9406564584124654e-323, str = {val = 0xa <Address 0xa out of bounds>, > len = 0}, chval = 10 '\n', ht = 0xa, obj = {ce = 0xa, properties = 0x0}}, type = 81 'Q', EA = {locks = 56, is_ref = 0}, > refcount = -9316}, var = 10, opline_num = 10, fetch_type = 10, op_array = 0xa, EA = {var = 10, type = 0}}} > (gdb) p Ts[10] > $3 = {tmp_var = {value = {lval = 1851749235, dval = 2.0391515370628635e+180, str = {val = 0x6e5f7373 <Address 0x6e5f7373 out of bounds>, > len = 1700754281}, chval = 115 's', ht = 0x6e5f7373, obj = {ce = 0x6e5f7373, properties = 0x655f7369}}, type = 110 'n', EA = { > locks = 114, is_ref = 0}, refcount = 116}, var = 0x6e5f7373, EA = {tmp_var = {value = {lval = 1851749235, > dval = 2.0391515370628635e+180, str = {val = 0x6e5f7373 <Address 0x6e5f7373 out of bounds>, len = 1700754281}, chval = 115 's', > ht = 0x6e5f7373, obj = {ce = 0x6e5f7373, properties = 0x655f7369}}, type = 110 'n', EA = {locks = 114, is_ref = 0}, > refcount = 116}, str = 0x6e5f7373, offset = 1734308713, type = 101 'e'}} > > > > -- > PHP Development Mailing List <http://www.php.net/> > To unsubscribe, e-mail: php-dev-unsubscribe@lists.php.net > For additional commands, e-mail: php-dev-help@lists.php.net > To contact the list administrators, e-mail: php-list-admin@lists.php.net > -- End of excerpt from rroberts@muller.com -Andrei "Later in this talk, I intend to define the universe and give three examples." -- Larry Wall