PHP 4.0 Bug #4873: Apache child crash when use ImagePng();

From: sitnikov@infonet.ee Operating system: Linux 2.2.14-5.0 #1 Tue Mar 7 21:07:39 EST 2000 i686 unknown PHP version: 4.0.0 Release PHP Bug Type: Reproduceable crash Bug description: Apache child crash when use ImagePng(); <? Header( "Content-type: image/png"); $im = ImageCreate(200, 200); $black = ImageColorAllocate($im, 0, 0, 0); $white = ImageColorAllocate($im, 255, 255, 255); $blue = ImageColorAllocate($im, 0, 0, 255); $red = ImageColorAllocate($im, 255, 0, 0); $green = ImageColorAllocate($im, 0, 255, 0); $blue1 = ImageColorAllocate($im, 100, 0, 255); $red1 = ImageColorAllocate($im, 255,100, 0); $green1 = ImageColorAllocate($im, 0, 255, 100); ImageLine($im, 1, 1, 199, 199, $white); ImageLine($im, 199, 1, 1, 199, $white); ImageTTFText($im, 36, 0, 1, 30,$blue, "TEXTBKB.TTF", "TEST TEST"); ImagePng($im); ImageDestroy($im); ?> gdb backtrace: Program received signal SIGSEGV, Segmentation fault. crc32 (crc=0x4, given_buf=0x400bf660, len=4) at crc32.c:107 107 (*crc) = ((*crc) << 8) ^ crc32_table[((*crc) >> 24) ^ *p]; (gdb) bt #0 crc32 (crc=0x4, given_buf=0x400bf660, len=4) at crc32.c:107 #1 0x40091a18 in png_calculate_crc () from /usr/local/lib/libpng.so.2 #2 0x400a2739 in png_write_chunk_start () from /usr/local/lib/libpng.so.2 #3 0x4009ce46 in png_write_IHDR () from /usr/local/lib/libpng.so.2 #4 0x400a53e5 in png_write_info_before_PLTE () from /usr/local/lib/libpng.so.2 #5 0x400a55c2 in png_write_info () from /usr/local/lib/libpng.so.2 #6 0x8145b50 in gdImagePngCtx () #7 0x81456c1 in gdImagePng () #8 0x809f07b in php_if_imagepng (ht=1, return_value=0x82ef72c, this_ptr=0x0, return_value_used=0) at gd.c:513 #9 0x80f179c in execute (op_array=0x821ced4) at ./zend_execute.c:1574 #10 0x808002b in php_execute_script (primary_file=0xbffff828) at main.c:1198 #11 0x809db20 in apache_php_module_main (r=0x822ad7c, fd=34, display_source_mode=0) at sapi_apache.c:93 #12 0x807c23a in send_php () #13 0x807c73b in send_parsed_php () #14 0x810eb11 in ap_invoke_handler () #15 0x811e011 in process_request_internal () #16 0x811e35f in ap_process_request () #17 0x8116a41 in child_main () #18 0x8116c47 in startup_children () #19 0x811745d in standalone_main () #20 0x8117dfb in main () #21 0x401969cb in __libc_start_main (main=0x81179c4 <main>, argc=2, argv=0xbffffa54, init=0x806373c <_init>, fini=0x814653c <_fini>, rtld_fini=0x4000ae60 <_dl_fini>, stack_end=0xbffffa4c) at ../sysdeps/generic/libc-start.c:92