PHP 4.0 Bug #2986: Apache crashes when compiling php4/mod_perl-1.21 monolithically.

From: dominic@the-infinite.org Operating system: Linux 2.2.13/rh6.0 PHP version: 4.0 Latest CVS (16/12/1999) PHP Bug Type: Reproduceable crash Bug description: Apache crashes when compiling php4/mod_perl-1.21 monolithically. When compiling apache/php4b4-dev/mod_perl-1.21 w/o using DSO - apache crashes after having read the request. The gdb backtrace shows: Compile environment: PHP4: ./configure --with-pgsql --with-apache=../apache_1.3.9 --enable-track-vars --with-gd=/home/sauron/mrtg/gd1.3 --with-zlib --enable-debug --enable-debugger APACHE: ./configure --enable-module=unique_id --enable-module=rewrite --enable-module=digest --enable-module=info --activate-module=src/modulesperl/libperl.a --activate-module=src/modules/php4/libphp4.a MOD_PERL: perl Makefile.PL APACHE_SRC=../apache_1.3.9/src DO_HTTPD=1 USE_APACI=1 PREP_HTTPD=1 EVERYTHING=1 Debugging: [root@morannon bin]# gdb /usr/local/bin/httpd (gdb) run -f /home/httpd/conf/httpd.conf -X Program received signal SIGSEGV, Segmentation fault. Starting program: /usr/local/bin/httpd -f /home/httpd/conf/httpd.conf -X 0x80ad40a in do_end_variable_parse (type=0, arg_offset=0) at zend_compile.c:525 525 le = fetch_list_ptr->head; (gdb) bt #0 0x80ad40a in do_end_variable_parse (type=0, arg_offset=0) at zend_compile.c:525 #1 0x80adff9 in do_return (expr=0xbfffd7e4) at zend_compile.c:976 #2 0x80f98c9 in zendparse () at /home/sauron/updates/php4/./libzend/zend-parser.y:184 #3 0x80babfc in require_file (file_handle=0xbfffe4fc, unique=0) at /home/sauron/updates/php4/./libzend/zend-scanner.l:544 #4 0x80ba9e7 in require_filename (filename=0x8308d00 "db_pgsql.inc") at /home/sauron/updates/php4/./libzend/zend-scanner.l:486 #5 0x80f98e5 in zendparse () at /home/sauron/updates/php4/./libzend/zend-parser.y:190 #6 0x80ba69c in v_compile_files (mark_as_ref=0, file_count=3, files=0xbffff4e0) at /home/sauron/updates/php4/./libzend/zend-scanner.l:355 #7 0x80ba5d2 in compile_files (mark_as_ref=0, file_count=3) at /home/sauron/updates/php4/./libzend/zend-scanner.l:325 #8 0x80a79a3 in php_execute_script (primary_file=0xbffff540) at main.c:1281 #9 0x80be1b1 in apache_php_module_main (r=0x8300764, fd=33, display_source_mode=0) at sapi_apache.c:87 #10 0x80a60c3 in send_php () #11 0x80a6108 in send_parsed_php () #12 0x811fdb3 in ap_invoke_handler () #13 0x81330a9 in process_request_internal () #14 0x81334c8 in ap_internal_redirect () #15 0x8080d3d in handle_dir () #16 0x811fdb3 in ap_invoke_handler () #17 0x81330a9 in process_request_internal () #18 0x813310c in ap_process_request () #19 0x812aace in child_main () #20 0x812ac5c in make_child () #21 0x812adb9 in startup_children () #22 0x812b3e6 in standalone_main () #23 0x812bb63 in main () #24 0x40103cb3 in __libc_start_main (main=0x812b82c <main>, argc=4, argv=0xbffff774, init=0x806dc4c <_init>, fini=0x81bca5c <_fini>, rtld_fini=0x4000a350 <_dl_fini>, stack_end=0xbffff76c) at ../sysdeps/generic/libc-start.c:78 (gdb) list 520 zend_llist_element *le; 521 zend_op *opline, *opline_ptr; 522 523 zend_stack_top(&CG(bp_stack), (void **) &fetch_list_ptr); 524 525 le = fetch_list_ptr->head; 526 527 while (le) { 528 opline_ptr = (zend_op *)le->data; 529 opline = get_next_op(CG(active_op_array) CLS_CC); (gdb) info locals fetch_list_ptr = (zend_llist *) 0x0 le = (zend_llist_element *) 0x8318e30 opline = (zend_op *) 0x1aa opline_ptr = (zend_op *) 0xbfffd7e4 Obviously it's crashing because fetch_list_ptr is 0x0 - why this is occurring, I don't know. Thanks in advance, Dominic