Bug #14690 Updated: Crash in many functions

ID: 14690 User updated by: sitnikov@infonet.ee Reported By: sitnikov@infonet.ee Old Status: Feedback Status: Open Bug Type: mcrypt related Operating System: Linux PHP Version: 4.1.0 New Comment: (gdb) bt #0 0x0814cd43 in zif_mcrypt_module_self_test (ht=2, return_value=0x83c6144, this_ptr=0x0, return_value_used=0) at mcrypt.c:851 #1 0x081aae4a in execute (op_array=0x83c1e6c) at ./zend_execute.c:1590 #2 0x080e5239 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at zend.c:814 #3 0x080801c1 in php_execute_script (primary_file=0xbffff7f0) at main.c:1307 #4 0x0807a8cc in main (argc=3, argv=0xbffff864) at cgi_main.c:738 #5 0x404f19cb in __libc_start_main (main=0x8079f34 <main>, argc=3, argv=0xbffff864, init=0x8076e1c <_init>, fini=0x82310b0 <_fini>, rtld_fini=0x4000aea0 <_dl_fini>, stack_end=0xbffff85c) at ../sysdeps/generic/libc-start.c:92 (gdb) bt full #0 0x0814cd43 in zif_mcrypt_module_self_test (ht=2, return_value=0x83c6144, this_ptr=0x0, return_value_used=0) at mcrypt.c:851 arg1 = (struct _zval_struct **) 0x8277e01 lib_dir = (struct _zval_struct **) 0xc lib_dir_s = 0x81aadbb "\203Ä \211À\213Mü\213Q\b\211Ó\215\fÝ" argc = 2 #1 0x081aae4a in execute (op_array=0x83c1e6c) at ./zend_execute.c:1590 original_return_value = (struct _zval_struct **) 0x83c60b4 return_value_used = 0 opline = (struct _zend_op *) 0x83c609c function_state = {function_symbol_table = 0x0, function = 0x83953b8, reserved = {0xbffff7f0, 0x80ea508, 0x0, 0x0}} fbc = (union _zend_function *) 0x0 object = {ptr = 0x0} Ts = (union _temp_variable *) 0xbfffe480 original_in_execution = 0 '\000' #2 0x080e5239 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at zend.c:814 files = (void *) 0xbfffe5d4 i = 1 file_handle = (struct _zend_file_handle *) 0xbffff7f0 orig_op_array = (struct _zend_op_array *) 0x0 local_retval = (struct _zval_struct *) 0x0 #3 0x080801c1 in php_execute_script (primary_file=0xbffff7f0) at main.c:1307 orig_bailout = {{__jmpbuf = {1079808588, 1073786528, -1073743772, -1073743848, -1073744176, 134717703}, __mask_was_saved = 0, __saved_mask = {__val = {0 <repeats 32 times>}}}} orig_bailout_set = 1 '\001' prepend_file_p = (struct _zend_file_handle *) 0x0 append_file_p = (struct _zend_file_handle *) 0x0 prepend_file = {type = 1 '\001', filename = 0x4000aea0 "U\211å\203ì\004WVSè", opened_path = 0xbffff864 "\210ùÿ¿¥ùÿ¿¨ùÿ¿", handle = {fd = 4096, fp = 0x1000}, free_filename = 0 '\000'} append_file = {type = 0 '\000', filename = 0x0, opened_path = 0x0, handle = {fd = 3, fp = 0x3}, free_filename = 240 'ð'} old_cwd = 0xbfffe5e0 "" #4 0x0807a8cc in main (argc=3, argv=0xbffff864) at cgi_main.c:738 orig_bailout = {{__jmpbuf = {0, 0, 0, 0, 0, 0}, __mask_was_saved = 0, __saved_mask = {__val = { 0 <repeats 32 times>}}}} orig_bailout_set = 0 '\000' exit_status = 0 cgi = 0 c = 60 i = 3 len = 0 file_handle = {type = 2 '\002', filename = 0x83ba5d4 "t.php", opened_path = 0x83c1e1c 'Z' <repeats 29 times>, "\204Ì\217*", handle = {fd = 138157296, fp = 0x83c1cf0}, free_filename = 0 '\000'} retval = 0 s = 0x83ba5e8 "t.php" behavior = 1 no_headers = 1 orig_optind = 1 orig_optarg = 0x0 ---Type <return> to continue, or q <return> to quit--- argv0 = 0x0 script_file = 0x83ba5d4 "t.php" global_vars = {head = 0x0, tail = 0x0, size = 4, count = 0, dtor = 0, persistent = 0 '\000', traverse_ptr = 0x40013f30} interactive = 0 #5 0x404f19cb in __libc_start_main (main=0x8079f34 <main>, argc=3, argv=0xbffff864, init=0x8076e1c <_init>, fini=0x82310b0 <_fini>, rtld_fini=0x4000aea0 <_dl_fini>, stack_end=0xbffff85c) at ../sysdeps/generic/libc-start.c:92 argv = (char **) 0xbffff864 rtld_fini = (void (*)()) 0x4000aea0 <_dl_fini> stack_end = (void *) 0x83c609c Previous Comments: ------------------------------------------------------------------------ [2001-12-25 12:03:28] derick@php.net Can you make a backtrace for me, (with bt full)? Derick ------------------------------------------------------------------------ [2001-12-25 12:00:40] sitnikov@infonet.ee I change form lib_dir_s = Z_STRVAL_PP(lib_dir);\ if (zend_get_parameters_ex(2, &arg1, &lib_dir) == FAILURE)\ {\ WRONG_PARAM_COUNT;\ }\ convert_to_string_ex (lib_dir);\ break;\ To: if (zend_get_parameters_ex(2, &arg1, &lib_dir) == FAILURE)\ {\ WRONG_PARAM_COUNT;\ }\ convert_to_string_ex (lib_dir);\ lib_dir_s = Z_STRVAL_PP(lib_dir);\ break;\ ------------------------------------------------------------------------ [2001-12-25 11:58:17] derick@php.net I can not reproduce this with 4.0.6, 4.1.0, 4.1.1dev or 4.2.0dev, and libmcrypt 2.4.18. Can you make a backtrace for me with the script you posted? And what do you want to reach with the patch you attached? regards, Derick ------------------------------------------------------------------------ [2001-12-25 11:49:39] sitnikov@infonet.ee mcrypt_module_self_test('test','test'); ------------------------------------------------------------------------ [2001-12-25 11:45:39] derick@php.net Do you have a reproducing script for me? regards, Derick ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at http://bugs.php.net/?id=14690 Edit this bug report at http://bugs.php.net/?id=14690&edit=1