PHP 4.0 Bug #8487: Crashing while reading a RSS file

From: matt@linuxworx.com.au Operating system: Linux 2.2.16-22 PHP version: 4.0.4 PHP Bug Type: Reproduceable crash Bug description: Crashing while reading a RSS file Here is the BT: This GDB was configured as "i386-redhat-linux"... (gdb) run -X Starting program: /www/bin/./httpd -X Program received signal SIGSEGV, Segmentation fault. 0x4036f142 in call_user_function_ex (function_table=0x80c9b18, object_pp=0x81f12a0, function_name=0x81f4d6c, retval_ptr_ptr=0xbfffc3a8, param_count=3, params=0x81f4a54, no_separation=1, symbol_table=0x0) at zend_execute_API.c:365 365 if (Z_TYPE_PP(object_pp) != IS_OBJECT) { (gdb) bt #0 0x4036f142 in call_user_function_ex (function_table=0x80c9b18, object_pp=0x81f12a0, function_name=0x81f4d6c, retval_ptr_ptr=0xbfffc3a8, param_count=3, params=0x81f4a54, no_separation=1, symbol_table=0x0) at zend_execute_API.c:365 #1 0x4036efc0 in call_user_function (function_table=0x80c9b18, object_pp=0x81f12a0, function_name=0x81f4d6c, retval_ptr=0x81f4a8c, param_count=3, params=0xbfffc450) at zend_execute_API.c:325 #2 0x403f0b4f in xml_call_handler (parser=0x81f126c, handler=0x81f4d6c, argc=3, argv=0xbfffc450) at xml.c:361 #3 0x403f127b in _xml_startElementHandler (userData=0x81f126c, name=0x81f0794 "RSS", attributes=0x81226f0) at xml.c:648 #4 0x40402de9 in doContent (parser=0x81f17a8, startTagLevel=0, enc=0x40435840, s=0x8107f93 "<rss version=\"0.91\">\n <channel>\n <title> Insurance industry news</title>\n <link>http://www.moreover.com</link>\n <description>Insurance industry news - news headlines from around the web, ref"..., end=0x8108f3a "", nextPtr=0x0) at xmlparse.c:1268 #5 0x4040258d in contentProcessor (parser=0x81f17a8, start=0x8107f93 "<rss version=\"0.91\">\n <channel>\n <title> Insurance industry news</title>\n <link>http://www.moreover.com</link>\n <description>Insurance industry news - news headlines from around the web, ref"..., end=0x8108f3a "", endPtr=0x0) at xmlparse.c:957 #6 0x40404527 in prologProcessor (parser=0x81f17a8, s=0x8107f93 "<rss version=\"0.91\">\n <channel>\n <title> Insurance industry news</title>\n <link>http://www.moreover.com</link>\n <description>Insurance industry news - news headlines from around the web, ref"..., end=0x8108f3a "", nextPtr=0x0) at xmlparse.c:2036 #7 0x4040210d in php_XML_Parse (parser=0x81f17a8, s=0x8107eec "<?xml version=\"1.0\" encoding=\"iso-8859-1\"?>\n<!DOCTYPE rss PUBLIC \"-//Netscape Communications//DTD RSS 0.91//EN\"\n\"http://my.netscape.com/publish/formats/rss-0.91.dtd\">\n<rss version=\"0.91\">\n <channel>\n"..., len=4174, isFinal=1) at xmlparse.c:767 #8 0x403f25b6 in php_if_xml_parse (ht=3, return_value=0x81f1734, this_ptr=0x0, return_value_used=1) at xml.c:1221 #9 0x40368c3f in execute (op_array=0x81f0730) at ./zend_execute.c:1519 #10 0x40368e7a in execute (op_array=0x80f880c) at ./zend_execute.c:1559 #11 0x40376fe1 in zend_execute_scripts (type=8, file_count=3) at zend.c:729 #12 0x403881cf in php_execute_script (primary_file=0xbffff8f0) at main.c:1221 #13 0x40384b02 in apache_php_module_main (r=0x80f4b24, display_source_mode=0) at sapi_apache.c:89 #14 0x40385415 in send_php (r=0x80f4b24, display_source_mode=0, filename=0x0) at mod_php4.c:506 #15 0x4038544a in send_parsed_php (r=0x80f4b24) at mod_php4.c:517 #16 0x80542e3 in ap_invoke_handler () #17 0x8067819 in process_request_internal () #18 0x8067c38 in ap_internal_redirect () #19 0x401bae92 in handle_dir () from /www/libexec/mod_dir.so #20 0x80542e3 in ap_invoke_handler () #21 0x8067819 in process_request_internal () #22 0x806787c in ap_process_request () #23 0x805f11e in child_main () #24 0x805f2ac in make_child () #25 0x805f409 in startup_children () #26 0x805fa36 in standalone_main () #27 0x80601c3 in main () #28 0x4008cb65 in __libc_start_main (main=0x805fe7c <main>, argc=2, ubp_av=0xbffffb64, init=0x804e864 <_init>, fini=0x809419c <_fini>, rtld_fini=0x4000df24 <_dl_fini>, stack_end=0xbffffb5c) at ../sysdeps/generic/libc-start.c:111 -- Edit Bug report at: http://bugs.php.net/?id=8487&edit=1