PHP 4.0 Bug #5731 Updated: Segmentation fault with dbase_add_record() (trace included)

ID: 5731 Updated by: joey Reported By: cahagn_o@epita.fr Status: Analyzed Bug Type: dBase related Assigned To: Comments: Can duplicate using CVS a/o 23 Jul 2000. Here is a more complete example (using dbase_create() instead of db_open()): <?php $def = array( array("Name", "C", 250), array("Foo", "N", 5, 2), array("Date", "D"), array("Bar", "L") ); $db = dbase_create("customer.dbf", $def); //$db = dbase_open("customer.dbf", 2); $newRecord = array("John Smith", 100.00, "199980901", "Y"); dbase_add_record($db, $newRecord); dbase_close($db); ?> #0 0x80e5878 in _zval_ptr_dtor (zval_ptr=0x842c1b0, __zend_filename=0x8185ba9 "zend_variables.c", __zend_lineno=182) at zend_execute_API.c:270 #1 0x80eb083 in _zval_ptr_dtor_wrapper (zval_ptr=0x842c1b0) at zend_variables.c:182 #2 0x80eeca0 in zend_hash_destroy (ht=0x842c124) at zend_hash.c:564 #3 0x80eae26 in _zval_dtor (zvalue=0x8427c64, __zend_filename=0x818543c "zend_execute_API.c", __zend_lineno=272) at zend_variables.c:69 #4 0x80e589a in _zval_ptr_dtor (zval_ptr=0x8255e28, __zend_filename=0x81911e0 "zend_execute.h", __zend_lineno=123) at zend_execute_API.c:272 #5 0x80f6bd4 in zend_ptr_stack_clear_multiple () at zend_execute.h:123 #6 0x8118ce2 in execute (op_array=0x8205fa4) at ./zend_execute.c:1638 #7 0x8070607 in php_execute_script (primary_file=0xbffffbb8) at main.c:1169 #8 0x806ee0e in main (argc=3, argv=0xbffffc34) at cgi_main.c:674 (gdb) print **zval_ptr $1 = {value = {lval = 1852144128, dval = 3.1453911460008387e+161, str = {val = 0x6e657a00 <Address 0x6e657a00 out of bounds>, len = 1635147620}, ht = 0x6e657a00, obj = { ce = 0x6e657a00, properties = 0x61765f64}}, type = 114 'r', is_ref = 105 'i', refcount = 25185} Looks to me like zval_ptr has already been freed at this point? And a more complete backtrace: Full Bug description available at: http://bugs.php.net/?id=5731