PHP 4.0 Bug #2007: PHP blows core on *some* files

From: georgeh@blowtorch.com Operating system: Redhat 6.0 / E-Commerce PHP version: 4.0 Latest CVS (09/08/1999) PHP Bug Type: Reproduceable crash Bug description: PHP blows core on *some* files I am getting segfaults in my server on certain pages on my site. When they happen, they are 100% reproduceable. Here's an example PHP file: <STYLE TYPE="text/css"> <!-- A.guide:active {background:#a0a0a0; color:#ff0000; font-weight:bold; text-decoration:none;} A.guide:hover {background:#000000; color:#ffffff; text-decoration:none;} A.guide:link {color:#000000; text-decoration:none;} A.guide:visited {color:#505050; text-decoration:none;} --> </STYLE> <IMG SRC="/images/news/newsguide.gif" ALT="News Guides" WIDTH="132" BORDER="0"><BR> <?php function spitlink($desc, $image, $url) { print "<A OnMouseOver=\"window.status = '$desc';\" onMouseOut=\"window.status = '';\" CLASS=\"guide\" HREF=\"$url\"><IMG SRC=\"$image\" BORDER=\"0\"></A><BR>\n"; } ($category == "top") ? $color = "y" : $color = "w"; spitlink("Top Stories", "/images/news/topstories-$color.gif", "/news/top/"); ($category == "17") ? $color = "y" : $color = "w"; spitlink("Commercial", "/images/news/commercial-$color.gif", "/news/17/"); ($category == "24") ? $color = "y" : $color = "w"; spitlink("Residential", "/images/news/residential-$color.gif", "/news/24/"); ($category == "25") ? $color = "y" : $color = "w"; spitlink("Consumer", "/images/news/consumer-$color.gif", "/news/25/"); ($category == "26") ? $color = "y" : $color = "w"; spitlink("Mortgage", "/images/news/mortgage-$color.gif", "/news/26/"); ?> <IMG SRC="/images/news/bottom-purple.gif"><BR> The server seems to dump core after spitlink("Consumer"...) because the output from that call ends up in the returned HMTL, but not for the next one. (ie, Mortgage never shows up) Interestingly, on another page using the idential spitlink function, it also coredumps, after the 5th call, not the 4th as in that script. The two files are nearly identical, except for the CSS code, and the actual calls to spitlink. Interestingly, I submitted a bug report a few minutes ago about a memory leak in Zend... in the case of the second file I'm getting coredumps in, I get the following errors: /usr/local/bps/htdocs/ris/htdocs/nrre.phtml: Freeing 0x08211CD0 (4 bytes), allocated in zend_hash.c on line 185<br> /usr/local/bps/htdocs/ris/htdocs/nrre.phtml: Last leak repeated 1 time /usr/local/bps/htdocs/ris/htdocs/nrre.phtml: Freeing 0x08211650 (44 bytes), allocated in zend_hash.c on line 175<br> /usr/local/bps/htdocs/ris/htdocs/nrre.phtml: Last leak repeated 3 times [Mon Aug 9 11:50:06 1999] [notice] child pid 12094 exit signal Segmentation fault (11) So maybe the two are actually related...