PHP 4.0 Bug #4297 Updated: segfault under Apache when using bad cleanup function

ID: 4297 Updated by: derick Reported By: vorlon@netexpress.net Status: Open Bug Type: Reproduceable crash Assigned To: Comments: I can reproduces this with 4.0.1pl2. Backtrace follows: GNU gdb 4.17.0.11 with Linux support Copyright 1998 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-redhat-linux"... (gdb) run -X Starting program: /dat/APACHE-PHP4/apache_1.3.12/src/./httpd -X Program received signal SIGSEGV, Segmentation fault. 0x80f8c85 in _zval_ptr_dtor (zval_ptr=0xbffffaac) at zend_execute_API.c:270 270 (*zval_ptr)->refcount--; (gdb) bt #0 0x80f8c85 in _zval_ptr_dtor (zval_ptr=0xbffffaac) at zend_execute_API.c:270 #1 0x80f8ab2 in shutdown_executor () at zend_execute_API.c:161 #2 0x80fe34d in zend_deactivate () at zend.c:515 #3 0x8088644 in php_request_shutdown (dummy=0x0) at main.c:672 #4 0x8086ba5 in php_apache_request_shutdown (dummy=0x0) at mod_php4.c:291 #5 0x812929e in run_cleanups () #6 0x8127acd in ap_clear_pool () #7 0x8127b41 in ap_destroy_pool () #8 0x8127abc in ap_clear_pool () #9 0x8136f8f in child_main () #10 0x813752c in make_child () #11 0x8137689 in startup_children () #12 0x8137cb6 in standalone_main () #13 0x8138443 in main () #14 0x401f9cb3 in __libc_start_main (main=0x81380fc <main>, argc=2, argv=0xbffffd24, init=0x806d970 <_init>, fini=0x81b720c <_fini>, rtld_fini=0x4000a350 <_dl_fini>, stack_end=0xbffffd1c) at ../sysdeps/generic/libc-start.c:78 (gdb) print zval_ptr $1 = (zval **) 0xbffffaac (gdb) print (*zval_ptr)->refcount Cannot access memory at address 0xa. (gdb) print *zval_ptr $2 = (zval *) 0x0 (gdb) quit Full Bug description available at: http://bugs.php.net/?id=4297