Re: PHP4 Bug #1768: Code crashes PHP when it tries to print warning

Oh and please do a make clean; make before you answer me in case you're using my latest patch :) Thanks, Andi At 08:55 PM 7/20/99 +0000, zmievski@ispi.net wrote:

From:             zmievski@ispi.net

Operating system: Solaris 2.7

PHP version:      4.0 Beta 1
PHP Bug Type:     Reproduceable crash

Bug description: Code crashes PHP when it tries to print warning Running the following piece of code results in a segmentation fault. <? $ar = preg_split("/<\/?[^>]+>/", "<a href='test'>a <b>test</b> of this function</a>"); print "$ar[0], $ar[1], $ar[2], $ar[3], $ar[4], $ar[5]\n"; ?> Backtrace: (gdb) bt #0 0xff136c5c in strlen () from /usr/lib/libc.so.1 #1 0xff17ec20 in _doprnt () from /usr/lib/libc.so.1 #2 0xff180c18 in vsprintf () from /usr/lib/libc.so.1 #3 0x1383c in php3_printf (

    format=0xa4b60 "<br>\n<b>%s</b>:  %s in <b>%s</b> on line <b>%d</b><br>\n")
    at main.c:329

#4 0x13ad8 in php3_error (type=8, format=0xb74a0 "Undefined index: %s")

    at main.c:421

#5 0x33e44 in zend_fetch_dimension_address_inner (ht=0x1395a0, op2=0x1410c0,

    Ts=0xffbeecf8, type=0) at zend_execute.c:459

#6 0x34308 in zend_fetch_dimension_address (result=0x141080, op1=0x146118,

    op2=0x1410c0, Ts=0xffbeecf8, type=0) at zend_execute.c:602

#7 0x35578 in execute (op_array=0x140130) at zend_execute.c:1086 #8 0x14d00 in php_execute_script (primary_file=0xffbef0f8) at main.c:1121 #9 0x1ab7c in main (argc=3, argv=0xffbef17c) at cgi_main.c:448 I guess it's trying to print a warning, but error_filename ends up being NULL. This makes it crash, on Solaris at least. -- PHP Development Mailing List <http://www.php.net/> To unsubscribe, e-mail: php-dev-unsubscribe@lists.php.net For additional commands, e-mail: php-dev-help@lists.php.net To contact the list administrators, e-mail: php-list-admin@lists.php.net

--- Andi Gutmans <andi@zend.com> http://www.zend.com/