PHP 4.0 Bug #6558: corrupted/wrong pointer with --trans-sid

From: Andreas.Schultz@eastlink.de Operating system: Linux / SuSE 6.4 PHP version: 4.0 Latest CVS (05/09/2000) PHP Bug Type: Reproduceable crash Bug description: corrupted/wrong pointer with --trans-sid Hi, The rewritting of URL's contained in a large (about 5k) echo ".." statement causes the engine to SegFault in free(). The problem can be forced by setting MALLOC_CHECK_=2 in the environment. Apache error_log shows multiple with MALLOC_CHECK: free(): invalid pointer xxxxx! System used: SuSE 6.4, Linux 2.4.0-test7, glibc-2.1.2, gcc 2.95.2 gdb backtrace with MALLOC_CHECK: (gdb) bt #0 0x400d2a71 in __kill () from /lib/libc.so.6 #1 0x400d2745 in raise () at ../sysdeps/posix/raise.c:28 #2 0x400d3e0f in abort () at ../sysdeps/generic/abort.c:139 #3 0x40107606 in free_check (mem=0x8541498, caller=0x4027e4ee) at malloc.c:4520 #4 0x401056df in free () at malloc.c:2952 #5 0x4027e4ee in php_ub_body_write_no_header ( str=0x853702c "\n<HTML> \n <HEAD>\n <LINK REL=\"stylesheet\" HREF=\"/css/standard.css\" TITLE=\"standardcss\"> \n <TITLE>Freie Presse Online - Support Server</TITLE>\n <META NAME=\"author\" CONTENT=\"EastLink WEB Se"..., str_length=5599) at output.c:350 #6 0x4027de18 in php_body_write () at output.c:53 #7 0x401f7ee3 in php_body_write_wrapper ( str=0x853702c "\n<HTML> \n <HEAD>\n <LINK REL=\"stylesheet\" HREF=\"/css/standard.css\" TITLE=\"standardcss\"> \n <TITLE>Freie Presse Online - Support Server</TITLE>\n <META NAME=\"author\" CONTENT=\"EastLink WEB Se"..., str_length=5599) at main.c:691 #8 0x401e658c in zend_print_zval_ex () at zend.c:115 #9 0x401e650c in zend_print_zval () at zend.c:115 #10 0x401e6001 in zend_print_variable () at zend_variables.c:157 #11 0x401d170b in execute () at ./zend_execute.c:876 #12 0x401d672a in execute () at ./zend_execute.c:876 #13 0x401d672a in execute () at ./zend_execute.c:876 #14 0x401e7486 in zend_execute_scripts () at zend.c:246 #15 0x401f8c44 in php_execute_script () at main.c:1096 #16 0x401f4f93 in apache_php_module_main () at sapi_apache.c:95 #17 0x401f59e9 in send_php () at mod_php4.c:430 #18 0x401f5a33 in send_parsed_php () at mod_php4.c:430 without MALLOC_CHECK: #0 0x401058b0 in chunk_free (ar_ptr=0x401901a0, p=0x8504d20) at malloc.c:3111 #1 0x4010573f in free () at malloc.c:2952 #2 0x4027e4ee in php_ub_body_write_no_header ( str=0x82310ac "\n<HTML> \n <HEAD>\n <LINK REL=\"stylesheet\" HREF=\"/css/standard.css\" TITLE=\"standardcss\"> \n <TITLE>F reie Presse Online - Support Server</TITLE>\n <META NAME=\"author\" CONTENT=\"EastLink WEB Se"..., str_length=5602) at output.c:350 #3 0x4027de18 in php_body_write () at output.c:53 #4 0x401f7ee3 in php_body_write_wrapper ( str=0x82310ac "\n<HTML> \n <HEAD>\n <LINK REL=\"stylesheet\" HREF=\"/css/standard.css\" TITLE=\"standardcss\"> \n <TITLE>F