[PHP-DEV] PHP 4.0 Bug #8529 Updated: crash in curl_exec From: tom.anheyer <email protected>
Date: 01/04/01

ID: 8529
User Update by: tom.anheyer <email protected>
Status: Open
Bug Type: Reproduceable crash
Description: crash in curl_exec

Ok, I found the problem. It's not a PHP problem.
A apache module ZMOD, an extended log module for the german IVW ad counting system, defines also a global symbol add_buffer and if curl_easy_exec is called zmod's add_buffer is used.

Now I have to patch curl and/or zmod.

Previous Comments:
---------------------------------------------------------------------------

[2001-01-04 08:14:12] tom.anheyer <email protected>
<?
$ch = curl_init ('http://localhost/.img/trans.gif');
curl_exec ($ch);
?>

For me this script is enough to reproduce the very strange error.

---------------------------------------------------------------------------

[2001-01-04 07:56:59] sniper <email protected>
Could you please add the shortest possible script
which can be used to reproduce this into this bug report?

--Jani

---------------------------------------------------------------------------

[2001-01-04 03:38:18] tom.anheyer <email protected>
Apache is Apache/1.3.14
CURL version is 7.5.1

---------------------------------------------------------------------------

[2001-01-03 05:31:19] tom.anheyer <email protected>
server crashs with sigsegf while executing the curl_exec function. the crash occurs only if running php as apache module on our production system. It works fine as standalone php program and also as php module on my SuSE 7.0 test system.

I think it's not realy a php problem. But maybe it is a compiler/dl problem.

(gdb) attach 14656
Attaching to program `/usr/sbin/httpd', Pid 14656
Reading symbols from /usr/lib/libmysqlclient.so.6...done.
Reading symbols from /lib/libm.so.6...done.
Reading symbols from /lib/libcrypt.so.1...done.
Reading symbols from /lib/libdb.so.2...done.
Reading symbols from /usr/lib/libmm.so.10...done.
Reading symbols from /lib/libdl.so.2...done.
Reading symbols from /lib/libc.so.6...done.
Reading symbols from /lib/libnsl.so.1...done.
Reading symbols from /usr/lib/libz.so.1...done.
Reading symbols from /lib/ld-linux.so.2...done.
Reading symbols from /lib/libnss_files.so.1...done.
Reading symbols from /home/httpd/modules/mod_fastcgi.so...done.
Reading symbols from /home/httpd/modules/libphp4.so...done.
Reading symbols from /lib/libpam.so.0...done.
Reading symbols from /usr/lib/libttf.so.2...done.
Reading symbols from /usr/lib/libpng.so.2...done.
Reading symbols from /usr/lib/libgd.so.1.8...done.
Reading symbols from /usr/lib/libcurl.so.1...done.
Reading symbols from /lib/libresolv.so.2...done.
Reading symbols from /usr/lib/libjpeg.so.62...done.
Reading symbols from /home/httpd/modules/mod_auth_digest_mysql.so...done.
Reading symbols from /home/httpd/modules/mod_pb_serv.so...done.
0x400e8a34 in __libc_fcntl ()
(gdb) break sendf.c:265
Breakpoint 1 at 0x40423f26: file sendf.c, line 265.
(gdb) cont
Continuing.
 
Breakpoint 1, add_bufferf (in=0x813c7b0,
    fmt=0x4049b05e "%s %s HTTP/1.0rn%s%s%s%s%s%s%s%s%s") at sendf.c:265

(gdb) print in
$1 = (send_buffer *) 0x813c7b0
(gdb) print *in
$2 = {buffer = 0x0, size_max = 0, size_used = 0}
(gdb) print s
$3 = 0x8131f60 "GET /wissen/wissenschaft/.html/vermischt1.html HTTP/1.0rnHost: www.BerlinOnline.dernPragma: no-cachernAccept: image/gif, image/x-xbitmap,
image/jpeg, image/pjpeg, */*rn"
(gdb) step
266 result = add_buffer(in, s, strlen(s));
(gdb) step
 
Program received signal SIGSEGV, Segmentation fault.
0x2f6e6573 in ?? ()
(gdb) bt
#0 0x2f6e6573 in ?? ()
#1 0x40423f49 in add_bufferf (in=0x813c7b0,
    fmt=0x4049b05e "%s %s HTTP/1.0rn%s%s%s%s%s%s%s%s%s") at sendf.c:266
#2 0x40423647 in http (conn=0x812f948) at http.c:362
#3 0x40428f92 in curl_do (in_conn=0x812f948) at url.c:1601
#4 0x4042fc92 in curl_transfer (curl=0x814bec0) at highlevel.c:618
#5 0x40430039 in curl_easy_perform (curl=0x814bec0) at easy.c:157
#6 0x402cec7c in php_if_curl_exec (ht=1, return_value=0x813cf34,
    this_ptr=0x0, return_value_used=1) at curl.c:610
#7 0x40296688 in execute (op_array=0x8149138) at ./zend_execute.c:1519
#8 0x40296855 in execute (op_array=0x812f62c) at ./zend_execute.c:1559
#9 0x402aa0c3 in zend_execute_scripts (type=8, file_count=3) at zend.c:729
#10 0x402be0c1 in php_execute_script (primary_file=0xbffffb30) at main.c:1221
#11 0x402baaf7 in apache_php_module_main (r=0x8127630, display_source_mode=0)
    at sapi_apache.c:89
#12 0x402baf40 in send_php (r=0x8127630, display_source_mode=0, filename=0x0)
    at mod_php4.c:506
#13 0x402bb360 in send_parsed_php (r=0x8127630) at mod_php4.c:517
#14 0x8077ce5 in ap_invoke_handler ()
#15 0x80886cf in ap_die ()
#16 0x8088a50 in ap_process_request ()
#17 0x80808d8 in ap_update_child_status ()
#18 0x8080bb6 in ap_update_child_status ()
#19 0x8081352 in ap_update_child_status ()
#20 0x8081da9 in main ()
(gdb)

PHP configuration:
./configure --with-apxs=/usr/sbin/apxs --with-mysql=/usr --with-config-file-path=/home/httpd/conf --with-curl --with-openssl --with-gd=/usr --with-zlib=/usr
--enable-track-vars --enable-memory-limit --disable-xml --disable-debug --enable-inline-optimization --enable-calendar --enable-sysvsem --enable-sysvshm --enable-debug

---------------------------------------------------------------------------

Full Bug description available at: http://bugs.php.net/?id=8529 

-- 
PHP Development Mailing List <http://www.php.net/>
To unsubscribe, e-mail: php-dev-unsubscribe <email protected>
For additional commands, e-mail: php-dev-help <email protected>
To contact the list administrators, e-mail: php-list-admin <email protected>