Apache+php3 coredumps: more funk..

From: Date: Fri, 05 Nov 1999 15:28:18 +0000
Subject: Apache+php3 coredumps: more funk..
Groups: php.dev 
Request: Send a blank email to php-dev+get-12197@lists.php.net to get a copy of this message
I am not sure if that's more apache bug than php, but here's what I found out: I am running apache+php3+mod_perl+fp extentions and I get a coredump whenever php3 script requested. Oddy enough, but when I recompiled php3 module with -ggdb switch the problem has gone (mistery). However I've saved the sick binary (and I recompiled apache twice without -ggdb flag, coredump remained, so the problem is reproductable). Here's what I have been able to find out so far: The coredump is caused in php3_init_request_info routine: (gdb) where #0 0x809b692 in php3_init_request_info () #1 0x8091174 in php3_request_startup () #2 0x8092816 in apache_php3_module_main () #3 0x808f956 in send_php3 () #4 0x808f9d2 in send_parsed_php3 () #5 0x80d9bb3 in ap_invoke_handler () #6 0x80efd69 in ap_some_auth_required () #7 0x80f01e4 in ap_internal_redirect () #8 0x80886cd in mod_perl_set_opmask () #9 0x80d9bb3 in ap_invoke_handler () #10 0x80efd69 in ap_some_auth_required () #11 0x80efdcc in ap_process_request () #12 0x80e6239 in ap_child_terminate () #13 0x80e64ac in ap_child_terminate () #14 0x80e686a in ap_child_terminate () #15 0x80e6df5 in ap_child_terminate () #16 0x80e7563 in main () #17 0x8067dfe in _start () (gdb) And when we are about to call _estrdup... (gdb) x/20i php3_init_request_info 0x809b670 <php3_init_request_info>: push %ebp 0x809b671 <php3_init_request_info+1>: mov %esp,%ebp 0x809b673 <php3_init_request_info+3>: movl $0x0,0x81e1794 0x809b67d <php3_init_request_info+13>: movl $0x0,0x81e1798 0x809b687 <php3_init_request_info+23>: mov 0x81c06c0,%eax 0x809b68c <php3_init_request_info+28>: mov 0xbc(%eax),%eax 0x809b692 <php3_init_request_info+34>: push %eax <--- here 0x809b693 <php3_init_request_info+35>: call 0x8099500 <_estrdup> ... we are passing a nullpointer to the routine: (gdb) info regi eax eax 0x0 0 in php3_init_request_info we basically just use `filename' which has been set in `r' struct earlier, and reassigned to php3_rqst in apache_php3_module_main later. #if APACHE int php3_init_request_info(void *conf) { const char *buf; TLS_VARS; GLOBAL(request_info).current_user = NULL; GLOBAL(request_info).current_user_length = 0; /* see above for why this has to be estrdup()'d */ GLOBAL(request_info).filename = estrdup(GLOBAL(php3_rqst)->filename); ... so the filename is basically what we get get from apache. I am not quite sure why the filename goes as `NULL' here, need to dig into apache code alitle bit, but I am curious why not make php code alittle more error resistant? I would suggest following fix in alloc.c --- alloc.c.orig Fri Nov 5 20:23:02 1999 +++ alloc.c Fri Nov 5 20:23:44 1999 @@ -264,6 +264,8 @@ int length; char *p; + if (!s) return NULL; + length = strlen(s)+1; BLOCK_INTERRUPTIONS; #if DEBUG and make apropriate sanity checks in every place where estrdup is being called from. If anyone with better understanding of apache code is willing to track down this problem, I am willing to help with further investigation. regards Fyodor

« previous php.dev (#12197) next »