PHP 4.0 Bug #7686 Updated: Segmentation fault in complex pages when using sessions

ID: 7686 Updated by: waldschrott Reported By: paul@rydell.com Old-Status: Open Status: Feedback Bug Type: Unknown/Other Function Assigned To: Comments: Please provide a reduced code fragment (<15 lines) producing this behaviour. Put no database queries etc. in it to ensure that we can reproduce it easily. in your case, save the selected field to a file and apply word_wrap() in another simple script and see if it still crashes, if yes reduce it so far that you know what causes php to crash and post it here Previous Comments: --------------------------------------------------------------------------- [2000-11-14 05:21:18] paul@rydell.com Well after spending several more hours with this segmentation fault problem I *NOW* think that the problem is in the wordwrap function. If I take out the wordwrap on the results from the DB I can't generate the seg fault. If it is in there I get the seg fault pretty often but not always. Start <? mysql_connect("xxx", "xxx", "xxx") or $errors = $errors . "Could not connect to database.n"; @mysql_select_db("xxx") or $errors = $errors . "Unable to select databasen"; $title = array(); $url = array(); $description = array(); $oldpicid = array(); $id = array(); $picdone = array(); $y=0; for ($x=15000;$x<15100;$x++) { $selectsites = mysql_query("select url,title,description,oldpicid,picdone,id from content where id=$x"); if ($selectsites) { if(!mysql_numrows($selectsites)) { #This should not happen } else { while ($q = mysql_fetch_array($selectsites)) { $title[] = wordwrap($q["title"],21," ",1); $description[] = wordwrap($q["description"], 30, " ", 1); print "<P>"; print $x; print "<BR>"; print $q["title"]; print "<BR>"; print $q["description"]; print "</P>n"; } } } } ?> <br>Done --------------------------------------------------------------------------- [2000-11-13 04:06:10] paul@rydell.com I started taking code out of my script to reduce its complexity while maintaining the occasional segmentation faults. The session code is gone and the segmentation faults still happen every now and then. I am posting a sample script that will generate the segmentation fault but as far as I can tell it only happens intermittently <? $debug=0; #Connect to the database mysql_connect("localhost", "xxxx", "xxxx") or $errors = $errors . "Could not connect to database.n"; @mysql_select_db("xxxx") or $errors = $errors . "Unable to select databasen"; print "$errors"; $foundsearch=0; $nosites = 0; $singleword = addslashes($searchwords); if ($singleword != "") { if ($debug==1){ print "We are looking for the ID of this word: $singleword<br>n"; } $selectwordids = mysql_query("select wordid from wordidx where word='$singleword'"); if ($selectwordids) { if (!mysql_numrows($selectwordids)) { $nosites=1; } else { $foundsearch=1; while ($r = mysql_fetch_array($selectwordids)) { $wordidsarray[]=$r["wordid"]; if ($debug==1){ print "We found that word: $singleword has id: " . $r["wordid"] . "<BR>n"; } } } } } if ($foundsearch==0){ ?>Nothing found.<? } else{ #Get sites that have the words in wordidsarray $wordidcounter=0; foreach ($wordidsarray as $wordid) { if ($debug==1){ print "We are looking for sites that contain this wordid: $wordid<br>n"; } $selectsiteswithwordid = mysql_query("select distinct(siteid) from iindex where wordid=$wordid limit 750"); if ($selectsiteswithwordid) { if (!mysql_numrows($selectsiteswithwordid)) { #There were no sites that matched the word if ($debug==1){ print "There were no words that matched<BR>n"; } } else { while ($s = mysql_fetch_array($selectsiteswithwordid)) { $siteswithwordsarray[]=$s["siteid"]; if ($debug==1){ print "Found siteid: " . $s["siteid"] . "<br>n"; } } $wordidcounter++; } } } $title = array(); $url = array(); $description = array(); $oldpicid = array(); $id = array(); $picdone = array(); $y=0; foreach ($siteswithwordsarray as $csiteid) { #Get the info about the sites that match $selectsites = mysql_query("select url,title,description,oldpicid,picdone,id from content where id=$csiteid"); if ($selectsites) { if(!mysql_numrows($selectsites)) { #This should not happen } else { while ($q = mysql_fetch_array($selectsites)) { $title[] = wordwrap($q["title"],21," ",1); $url[] = $q["url"]; $description[] = wordwrap($q["description"], 30, " ", 1); $oldpicid[] = $q["oldpicid"]; $picdone[]=$q["picdone"]; $id[]=$q["id"]; $y++; } } } } } ?> <BR> Done --------------------------------------------------------------------------- [2000-11-07 22:53:22] paul@rydell.com Complex script that uses 2 include files and does many MySQL selects. Once I added in some session support and started storing some user preferences in an array I put into the session I started getting segmentation faults. Compile info: #PHP ./configure --with-mysql=/usr/local/mysql --with-apache=../apache_1.3.14 --enable-track-vars --enable-debug #Apache ./configure --activate-module=src/modules/php4/libphp4.a --enable-module=php4 --prefix=/usr/local/apache Backtrace: (gdb) run -X Starting program: /usr/local/apache/bin/httpd -X (no debugging symbols found)... Program received signal SIGSEGV, Segmentation fault. 0x401370b9 in chunk_free (ar_ptr=0x401cbd60, p=0x882322e0) at malloc.c:3094 3094 malloc.c: No such file or directory. (gdb) bt #0 0x401370b9 in chunk_free (ar_ptr=0x401cbd60, p=0x882322e0) at malloc.c:3094 #1 0x40136fba in __libc_free (mem=0x82322e8) at malloc.c:3023 #2 0x80cdaec in _efree () #3 0x80d80e4 in _zval_dtor () #4 0x80d3c4f in destroy_op_array () #5 0x80d3b69 in destroy_zend_function () #6 0x80dba77 in zend_hash_clean () #7 0x80dbbbf in zend_hash_apply () #8 0x80d2618 in shutdown_executor () #9 0x80d8a87 in zend_deactivate () #10 0x807b59d in php_request_shutdown () #11 0x80797ea in sapi_apache_send_headers () #12 0x81029ae in ap_run_cleanup () #13 0x81011dd in ap_clear_pool () #14 0x8101251 in ap_destroy_pool () #15 0x81011cc in ap_clear_pool () #16 0x811099f in ap_child_terminate () #17 0x8110f3c in ap_child_terminate () #18 0x8111099 in ap_child_terminate () #19 0x81116c6 in ap_child_terminate () #20 0x8111e53 in main () #21 0x400f59cb in __libc_start_main (main=0x8111b0c <main>, argc=2, argv=0xbffffb14, init=0x80606dc <_init>, fini=0x813f79c <_fini>, rtld_fini=0x4000ae60 <_dl_fini>, stack_end=0xbffffb0c) at ../sysdeps/generic/libc-start.c:92 I can provide script but it is very lengthy. Hopefully the backtrace can give some information. Thanks much. --------------------------------------------------------------------------- Full Bug description available at: http://bugs.php.net/?id=7686