PHP 4.0 Bug #6836 Updated: PHP crashes on specific use of arrays (example script)

ID: 6836 Updated by: andi Reported By: mail@andreas-schmitz.de Status: Closed Bug Type: Reproduceable crash Assigned To: Comments: This doesn't crash for me. Please try 4.0.3pl1 (or the latest snapshot from snaps.php.net). If it still happens then reopen a bug report with a shorter reproducing script. Thanks Previous Comments: --------------------------------------------------------------------------- [2000-09-21 18:25:18] mail@andreas-schmitz.de If I use the script below and push the refreshbutton of my browser several times Apache generate a segfault. I think this is a problem with arrays in PHP. <gdb> run -DSSL -X Starting program: /usr/local/apache/bin/httpd -X -DSSL (no debugging symbols found) ((now, I am pushing the refreshbutton in my netscape several times)) Program received signal SIGSEGV, Segmentation fault. 0x4048598c in chunk_free (ar_ptr=0x4051dba0, p=0x835edb0) at malloc.c:3055 3055 malloc.c: No such file or directory. <gdb> bt #0 0x4048598c in chunk_free (ar_ptr=0x4051dba0, p=0x835edb0) at malloc.c:3055 #1 0x40485807 in __libc_free (mem=0x835edb8) at malloc.c:2967 #2 0x80e0b80 in php_ob_get_length () #3 0x80e06fe in php_body_write () #4 0x8081182 in php_request_shutdown () #5 0x81000d5 in zend_print_zval_ex () #6 0x8100050 in zend_print_zval () #7 0x80ffa98 in zend_print_variable () #8 0x8135a29 in execute () #9 0x8100d84 in zend_execute_scripts () #10 0x8081def in php_execute_script () #11 0x810f2ec in apache_php_module_main () #12 0x807ed46 in send_php () #13 0x807ed7e in send_parsed_php () #14 0x81844c9 in ap_invoke_handler () #15 0x8198d3f in ap_some_auth_required () #16 0x8198daa in ap_process_request () #17 0x818fef6 in ap_child_terminate () #18 0x81900d1 in ap_child_terminate () #19 0x819024c in ap_child_terminate () #20 0x81908ad in ap_child_terminate () #21 0x81910fc in main () #22 0x40441313 in __libc_start_main (main=0x8190d44 <main>, argc=3, argv=0xbffff834, init=0x807cf30 <_init>, fini=0x822cfb4 <_fini>, rtld_fini=0x4000ac70 <_dl_fini>, stack_end=0xbffff82c) at ../sysdeps/generic/libc-start.c:90 Here ist die php script, which produce the crash: <?PHP function test($arResult) { // In this function, we build an array. $arResult=array("DOMAIN_ID"=>array(1,2,3,4,5,6,7,8,9,10, 11,12,13,14,15,16,17,18,19,20, 21,22,23,24,25,26,27,28,29,30, 31,32,33,34,35,36,37,38,39,30, 41,42,43,44,45,46,47,48,49,50), "FQDN"=>array("andreas.de","schmitz.de","test.de","2","3", "1andreas.de","1schmitz.de","1test.de","12","13", "2andreas.de","2schmitz.de","2test.de","22","23", "3andreas.de","3schmitz.de","3test.de","32","33", "4andreas.de","4schmitz.de","4test.de","42","43", "5andreas.de","5schmitz.de","5test.de","52","53", "6andreas.de","6schmitz.de","6test.de","62","63", "7andreas.de","7schmitz.de","7test.de","72","73", "8andreas.de","8schmitz.de","8test.de","82","83", "8andreas.de","8schmitz.de","8test.de","82","83")); return true; } ?> <HTML> <!-- CREATION DATE: 11.09.2000 --> <HEAD> <TITLE>test</TITLE> <META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"> </HEAD> <BODY> <?PHP echo "<CENTER> <FORM ACTION="test.php?".SID."" METHOD=POST> <INPUT TYPE="hidden" NAME="cSearch" VALUE=$cSearch> <table>"; // Get the arry in $arResult $ret=test(&$arResult); if ($ret) { $arFqdn = $arResult[FQDN]; $arDomain_id = $arResult[DOMAIN_ID]; $iMaxFqdn = sizeof($arFqdn); echo "<TR> <TH>&nbsp;</TH> <TH ALIGN=LEFT>Domain:</TH> </TR>n"; for ($i=0;$i < $iMaxFqdn;$i++) { echo "<TR>"; echo "<TD> <INPUT TYPE="checkbox" NAME="bDelete_$i" VALUE=$arDomain_id[$i]> </TD>"; if (1 == $i%2) { echo "<TD bgcolor="#EEEEEE">"; } else { echo "<TD bgcolor="#FFFFFF">"; } // If you replace the following echo funktion with: // // echo "</TD></TR>n"; // // there isn't any problem. If you leave this // echo function, there is a notice in te error_log // of the apache: // [notice] child pid x exit signal segmentation fault // (11) // // The below echo function access the array echo "<font face="Arial, Helvetica" color="#ff0000"> <A HREF="dom_zone.php?iDomain_id=$arDomain_id[$i]">$arFqdn[$i]</A> <BR></font></TD></TR>n"; } } echo "</table> <INPUT TYPE="submit" VALUE="Ausgew&auml;hlte Domains l&ouml;schen">"; echo "</FORM> </CENTER>"; ?> </BODY> </HTML> -- PHPinfo (short) PHP Version 4.0.2 System Linux andy 2.2.13 #1 Mon Nov 8 15:51:29 CET 1999 i686 unknown Build Date Sep 20 2000 Configure Command './configure' '--with-oci8' '--with-apache=/usr/downloads/apache_1.3.12' '--enable-track-vars' '--enable-sigchild' '--enable-debug' '--with-mm=/usr/local/mm' '--enable-sysvsem' '--enable-sysvshm' '--disable-magic-quotes' '--enable-trans-sid' '--with-mysql=no' Server API Apache Virtual Directory Support disabled Configuration File (php.ini) Path /usr/local/lib ZEND_DEBUG enabled Thread Safety disabled --------------------------------------------------------------------------- Full Bug description available at: http://bugs.php.net/?id=6836