PHP 4.0 Bug #6558 Updated: corrupted/wrong pointer with --trans-sid

ID: 6558 Updated by: sniper Reported By: Andreas.Schultz@eastlink.de Status: Closed Bug Type: Reproduceable crash Assigned To: Comments: This should be fixed in PHP 4.0.3 --Jani Previous Comments: --------------------------------------------------------------------------- [2000-09-20 10:11:14] sas@php.net Let us know whether the latest checkout works for you, we have a new scanner now. --------------------------------------------------------------------------- [2000-09-05 14:18:31] Andreas.Schultz@eastlink.de Hi, The rewritting of URL's contained in a large (about 5k) echo ".." statement causes the engine to SegFault in free(). The problem can be forced by setting MALLOC_CHECK_=2 in the environment. Apache error_log shows multiple with MALLOC_CHECK: free(): invalid pointer xxxxx! System used: SuSE 6.4, Linux 2.4.0-test7, glibc-2.1.2, gcc 2.95.2 gdb backtrace with MALLOC_CHECK: (gdb) bt #0 0x400d2a71 in __kill () from /lib/libc.so.6 #1 0x400d2745 in raise () at ../sysdeps/posix/raise.c:28 #2 0x400d3e0f in abort () at ../sysdeps/generic/abort.c:139 #3 0x40107606 in free_check (mem=0x8541498, caller=0x4027e4ee) at malloc.c:4520 #4 0x401056df in free () at malloc.c:2952 #5 0x4027e4ee in php_ub_body_write_no_header ( str=0x853702c "n<HTML> n <HEAD>n <LINK REL="stylesheet" HREF="/css/standard.css" TITLE="standardcss"> n <TITLE>Freie Presse Online - Support Server</TITLE>n <META NAME="author" CONTENT="EastLink WEB Se"..., str_length=5599) at output.c:350 #6 0x4027de18 in php_body_write () at output.c:53 #7 0x401f7ee3 in php_body_write_wrapper ( str=0x853702c "n<HTML> n <HEAD>n <LINK REL="stylesheet" HREF="/css/standard.css" TITLE="standardcss"> n <TITLE>Freie Presse Online - Support Server</TITLE>n <META NAME="author" CONTENT="EastLink WEB Se"..., str_length=5599) at main.c:691 #8 0x401e658c in zend_print_zval_ex () at zend.c:115 #9 0x401e650c in zend_print_zval () at zend.c:115 #10 0x401e6001 in zend_print_variable () at zend_variables.c:157 #11 0x401d170b in execute () at ./zend_execute.c:876 #12 0x401d672a in execute () at ./zend_execute.c:876 #13 0x401d672a in execute () at ./zend_execute.c:876 #14 0x401e7486 in zend_execute_scripts () at zend.c:246 #15 0x401f8c44 in php_execute_script () at main.c:1096 #16 0x401f4f93 in apache_php_module_main () at sapi_apache.c:95 #17 0x401f59e9 in send_php () at mod_php4.c:430 #18 0x401f5a33 in send_parsed_php () at mod_php4.c:430 without MALLOC_CHECK: #0 0x401058b0 in chunk_free (ar_ptr=0x401901a0, p=0x8504d20) at malloc.c:3111 #1 0x4010573f in free () at malloc.c:2952 #2 0x4027e4ee in php_ub_body_write_no_header ( str=0x82310ac "n<HTML> n <HEAD>n <LINK REL="stylesheet" HREF="/css/standard.css" TITLE="standardcss"> n <TITLE>F reie Presse Online - Support Server</TITLE>n <META NAME="author" CONTENT="EastLink WEB Se"..., str_length=5602) at output.c:350 #3 0x4027de18 in php_body_write () at output.c:53 #4 0x401f7ee3 in php_body_write_wrapper ( str=0x82310ac "n<HTML> n <HEAD>n <LINK REL="stylesheet" HREF="/css/standard.css" TITLE="standardcss"> n <TITLE>F --------------------------------------------------------------------------- Full Bug description available at: http://bugs.php.net/?id=6558