Re: [PHP-DEV] PHP 4.0 Bug #2344: Apache SEGV on all php4 files From: Andrei Zmievski (zmievski <email protected>)
Date: 09/21/99

In fact, this happens even in cgi executable. Did some patch break Zend?

rroberts <email protected> wrote:
> From: rroberts <email protected>
> Operating system: Linux Mandrake 6.0
> PHP version: 4.0 Latest CVS (21/09/1999)
> PHP Bug Type: Reproduceable crash
> Bug description: Apache SEGV on all php4 files
>
> Program received signal SIGSEGV, Segmentation fault.
> _get_zval_ptr (node=0x80e540c, Ts=0xbfffeca8, should_free=0x403da140) at
zend_execute.c:85
> 85 PZVAL_UNLOCK(*Ts[node->u.var].var);
> (gdb) where
> #0 _get_zval_ptr (node=0x80e540c, Ts=0xbfffeca8, should_free=0x403da140)
at zend_execute.c:85
> #1 0x4039a936 in execute (op_array=0x80de9c8) at zend_execute.c:1543
> #2 0x40347880 in php_execute_script (primary_file=0xbffff2b4) at
main.c:1171
> #3 0x40347901 in apache_php_module_main (r=0x80da144, fd=19,
display_source_mode=0) at main.c:1212
> #4 0x40345968 in send_php () from /usr/lib/apache/libphp4.so
> Cannot access memory at address 0x1f4.
> (gdb) l
> 80 *should_free = 1;
> 81 return &Ts[node->u.var].tmp_var;
> 82 break;
> 83 case IS_VAR:
> 84 if (Ts[node->u.var].var) {
> 85 PZVAL_UNLOCK(*Ts[node->u.var].var);
> 86 *should_free = 0;
> 87 return *Ts[node->u.var].var;
> 88 } else {
> 89 *should_free = 1;
> (gdb) p *Ts
> $1 = {tmp_var = {value = {lval = 135129452, dval = 8.554745983835643e-314,
str = {val = 0x80de96c " |\016\b", len = 4}, chval = 108 'l',
> ht = 0x80de96c, obj = {ce = 0x80de96c, properties = 0x4}}, type = 244
'ô', EA = {locks = 19, is_ref = 1}, refcount = -14118},
> var = 0x80de96c, EA = {tmp_var = {value = {lval = 135129452, dval =
8.554745983835643e-314, str = {val = 0x80de96c " |\016\b",
> len = 4}, chval = 108 'l', ht = 0x80de96c, obj = {ce = 0x80de96c,
properties = 0x4}}, type = 244 'ô', EA = {locks = 19,
> is_ref = 1}, refcount = -14118}, str = 0x4019c8cf, offset = 13,
type = 255 'ÿ'}}
> (gdb) p * node
> $2 = {op_type = 4, u = {constant = {value = {lval = 10, dval =
4.9406564584124654e-323, str = {val = 0xa <Address 0xa out of bounds>,
> len = 0}, chval = 10 '\n', ht = 0xa, obj = {ce = 0xa, properties
= 0x0}}, type = 81 'Q', EA = {locks = 56, is_ref = 0},
> refcount = -9316}, var = 10, opline_num = 10, fetch_type = 10,
op_array = 0xa, EA = {var = 10, type = 0}}}
> (gdb) p Ts[10]
> $3 = {tmp_var = {value = {lval = 1851749235, dval =
2.0391515370628635e+180, str = {val = 0x6e5f7373 <Address 0x6e5f7373 out of
bounds>,
> len = 1700754281}, chval = 115 's', ht = 0x6e5f7373, obj = {ce =
0x6e5f7373, properties = 0x655f7369}}, type = 110 'n', EA = {
> locks = 114, is_ref = 0}, refcount = 116}, var = 0x6e5f7373, EA =
{tmp_var = {value = {lval = 1851749235,
> dval = 2.0391515370628635e+180, str = {val = 0x6e5f7373 <Address
0x6e5f7373 out of bounds>, len = 1700754281}, chval = 115 's',
> ht = 0x6e5f7373, obj = {ce = 0x6e5f7373, properties = 0x655f7369}},
type = 110 'n', EA = {locks = 114, is_ref = 0},
> refcount = 116}, str = 0x6e5f7373, offset = 1734308713, type = 101
'e'}}
>
>
>
> --
> PHP Development Mailing List <http://www.php.net/>
> To unsubscribe, e-mail: php-dev-unsubscribe <email protected>
> For additional commands, e-mail: php-dev-help <email protected>
> To contact the list administrators, e-mail: php-list-admin <email protected>
>
-- End of excerpt from rroberts <email protected>

-Andrei

"Later in this talk, I intend to define
 the universe and give three examples." -- Larry Wall 

-- 
PHP Development Mailing List <http://www.php.net/>
To unsubscribe, e-mail: php-dev-unsubscribe <email protected>
For additional commands, e-mail: php-dev-help <email protected>
To contact the list administrators, e-mail: php-list-admin <email protected>