PHP 4.0 Bug #2659: ldap_add or ldap_modify crashes Apache

From: jmeskill@libertydistribution.com Operating system: RedHat 6.1 PHP version: 4.0 Latest CVS (03/11/1999) PHP Bug Type: Reproduceable crash Bug description: ldap_add or ldap_modify crashes Apache using the example scripts for ldap_add causes Apache to crash, ldap_search works fine. Setup: RedHat 6.1 Apache 1.3.9 backtrace: (gdb) run -X Starting program: /usr/sbin/httpd -X Program received signal SIGSEGV, Segmentation fault. 0x4022f20a in php_sprintf_appenddouble (buffer=0x8106900, pos=0x0, size=0xffffffff, number=3.236156144000506e-313, width=135293184, padding=64 '@', alignment=135291336, precision=-1073751856, adjust=1075964675, fmt=11 '\013') at formatted_print.c:267 (gdb) bt #0 0x4022f20a in php_sprintf_appenddouble (buffer=0x8106900, pos=0x0, size=0xffffffff, number=3.236156144000506e-313, width=135293184, padding=64 '@', alignment=135291336, precision=-1073751856, adjust=1075964675, fmt=11 '\013') at formatted_print.c:267 #1 0xffffffff in ?? () #2 0x4022f934 in php3_formatted_print (ht=135293184, len=0x40229eb5) at formatted_print.c:501 #3 0x4021eb03 in ps_call_handler (name=0x80fe160 "\006", argc=135289552, argv=0x8106128) at mod_user.c:64 #4 0x4021eba5 in ps_call_handler (name=0x80fe160 "\006", argc=135289552, argv=0x8106128) at mod_user.c:80 #5 0x402fba61 in Horizontal_Sweep_Drop (raster=0x3, y=18944, x1=1077371876, x2=1077371920, left=0x0, right=0x2) at ttraster.c:1864 #6 0x402fbb72 in Horizontal_Sweep_Drop (raster=0x3, y=11084, x1=1077371876, x2=1077371920, left=0x0, right=0xbfffe03c) at ttraster.c:1931 #7 0x402d5709 in gdFontGiantData () from /usr/lib/libgd.so.1 #8 0x402a8230 in nis_getservlist (dir=0xbffff7c0 "\002") at nis_getservlist.c:42 #9 0x402eeae9 in ZeroDataBlock () from /usr/lib/libttf.so.2 #10 0x402ef114 in ZeroDataBlock () from /usr/lib/libttf.so.2 #11 0x402ef150 in ZeroDataBlock () from /usr/lib/libttf.so.2 #12 0x80542f3 in ap_invoke_handler () #13 0x80675e9 in process_request_internal () #14 0x806764c in ap_process_request () #15 0x805f00e in child_main () #16 0x805f19c in make_child () #17 0x805f2f9 in startup_children () #18 0x805f926 in standalone_main () #19 0x80600a3 in main () #20 0x4007d1eb in __libc_start_main (main=0x805fd6c <main>, argc=2, argv=0xbffff984, init=0x804e884 <_init>, fini=0x8093d6c <_fini>, rtld_fini=0x4000a610 <_dl_fini>, stack_end=0xbffff97c) at ../sysdeps/generic/libc-start.c:90 (gdb)