PHP 4.0 Bug #8850: Crash when trying to view tables in phpMyAdmin

From: neotron@php.net Operating system: Mandrake 7.1, freebsd 4.2 PHP version: 4.0 Latest CVS (23/01/2001) PHP Bug Type: Reproduceable crash Bug description: Crash when trying to view tables in phpMyAdmin I got a report that phpMyAdmin crashed Caudium sometimes. After fetching the latest version (as reported by freshmeat), unpacking it and testing it I did indeed get a crash. However it's not specific to Caudium since the CGI version crashes as well. I used latest CVS (10 minutes old) and the CGI version for the backtraces. Let me know if anything more than the below is needed. Program received signal SIGSEGV, Segmentation fault. 0x80d006c in zend_hash_index_update_or_next_insert (ht=0x0, h=1, pData=0xbfffb998, nDataSize=4, pDest=0x0, flag=1) at ../../../Zend/zend_hash.c:396 396 nIndex = h % ht->nTableSize; (gdb) bt #0 0x80d006c in zend_hash_index_update_or_next_insert (ht=0x0, h=1, pData=0xbfffb998, nDataSize=4, pDest=0x0, flag=1) at ../../../Zend/zend_hash.c:396 #1 0x80ce7e1 in add_index_bool (arg=0x819a654, index=1, b=0) at ../../../Zend/zend_API.c:337 #2 0x80a17f1 in php_ereg (ht=3, return_value=0x819a22c, this_ptr=0x0, return_value_used=1, icase=1) at /home/neotron/src/php4/ext/standard/reg.c:250 #3 0x80a18a1 in php_if_eregi (ht=3, return_value=0x819a22c, this_ptr=0x0, return_value_used=1) at /home/neotron/src/php4/ext/standard/reg.c:279 #4 0x80f5fff in execute (op_array=0x816a60c) at ../../../Zend/zend_execute.c:1493 #5 0x80cd5eb in zend_execute_scripts (type=8, file_count=3) at ../../../Zend/zend.c:743 #6 0x805f0cb in php_execute_script (primary_file=0xbffff858) at /home/neotron/src/php4/main/main.c:1166 #7 0x805d65c in main (argc=2, argv=0xbffff8d4) at /home/neotron/src/php4/sapi/cgi/cgi_main.c:736 #8 0x400b4cae in __libc_start_main () from /lib/libc.so.6 (gdb) p h $3 = 1 (gdb) p ht $4 = (HashTable *) 0x0 (gdb) up #1 0x80ce7e1 in add_index_bool (arg=0x819a654, index=1, b=0) at ../../../Zend/zend_API.c:337 337 return zend_hash_index_update(Z_ARRVAL_P(arg), index, (void *) &tmp, sizeof(zval *),NULL); (gdb) p arg $5 = (zval *) 0x819a654 *(gdb) p *arg $6 = {value = {lval = 0, dval = 0, str = {val = 0x0, len = 0}, ht = 0x0, obj = {ce = 0x0, properties = 0x0}}, type = 6 '\006', is_ref = 1 '\001', refcount = 2} (gdb) up #2 0x80a17f1 in php_ereg (ht=3, return_value=0x819a22c, this_ptr=0x0, return_value_used=1, icase=1) at /home/neotron/src/php4/ext/standard/reg.c:250 250 add_index_bool(*array, i, 0); (gdb) p array $7 = (pval **) 0x816728c *(gdb) p **array $8 = {value = {lval = 0, dval = 0, str = {val = 0x0, len = 0}, ht = 0x0, obj = {ce = 0x0, properties = 0x0}}, type = 6 '\006', is_ref = 1 '\001', refcount = 2} (gdb) p i $9 = 1 (gdb) up #3 0x80a18a1 in php_if_eregi (ht=3, return_value=0x819a22c, this_ptr=0x0, return_value_used=1) at /home/neotron/src/php4/ext/standard/reg.c:279 279 php_ereg(INTERNAL_FUNCTION_PARAM_PASSTHRU, 1); (gdb) p return_value $10 = (zval *) 0xbfffb9f0 *(gdb) p *return_value $11 = {value = {lval = 16, dval = -NaN(0xfffff00000010), str = { val = 0x10 <Address 0x10 out of bounds>, len = -1}, ht = 0x10, obj = { ce = 0x10, properties = 0xffffffff}}, type = 255 'ÿ', is_ref = 255 'ÿ', refcount = 65535} (gdb) up #4 0x80f5fff in execute (op_array=0x816a60c) at ../../../Zend/zend_execute.c:1493 1493 ((zend_internal_function *) function_state.function)->handler(opline->extended_value, Ts[opline->result.u.var].var.ptr, object.ptr, return_value_used ELS_CC); (gdb) p op_array $12 = (zend_op_array *) 0x816a60c *(gdb) p *op_array $13 = {type = 2 '\002', arg_types = 0x0, function_name = 0x0, refcount = 0x8145114, opcodes = 0x816f96c, last = 844, size = 844, T = 400, brk_cont_array = 0x8180c1c, last_brk_cont = 4, current_brk_cont = 4294967295, uses_globals = 0 '\000', static_variables = 0x0, start_op_number = 0, end_op_number = 0, last_executed_op_number = 0, backpatch_count = 0, return_reference = 0 '\000', done_pass_two = 1 '\001', filename = 0x81457a4 "tbl_properties.php3", reserved = {0x0, 0x0}} -- Edit Bug report at: http://bugs.php.net/?id=8850&edit=1