From: shawn at mbuzzy dot com
Operating system: RedHat Enterprise 3
PHP version: 5.2.3
PHP Bug Type: Reproducible crash
Bug description: Got seg fault, core dump in php 5.2.3 code in
_zend_hash_add_or_update
Description:
------------
I am running:
Apache 1.3.31
Php 5.2.3 -- built with following switches:
'./configure' '--prefix=/local/service/php'
'--with-apxs=/local/service/apache/bin/apxs' '--with-mysql'
'--with-mysqli=/usr/bin/mysql_config'
'--with-config-file-path=/local/service/php' '--with-mcrypt' '--with-curl'
'--with-pdo-mysql'
APC 3.0.14
We are getting a SEGV/core dump from apache httpd. The
dump is reproducible in the sense that it happens regularly
at about 2-3 hour intervals and the core back-trace is landing in exactly
the same spot every time. However, it is not always processing
the same php, so it's difficult to give you a reproducible php script to
try yourself.
However I do have a back-trace that might help.
It appears to always be in a state where it is trying to setup the php
global hash environment. Specificaly, processing the query args to populate
the $_REQUESTS values.
#0 _zend_hash_add_or_update (ht=0x64696f, arKey=0x80eb220 "returnURL",
nKeyLength=10, pData=0xbfffd4c4, nDataSize=4, pDest=0xbfffd4c8, flag=1)
at
/local/palermo/redhat.es.3.0.i386/src/php-5.2.3/Zend/zend_hash.c:216
#1 0xb6ee61f0 in zend_symtable_update (ht=0x64696f, arKey=0x80eb220
"returnURL", nKeyLength=10, pData=0xbfffd4c4, nDataSize=4,
pDest=0xbfffd4c8) at zend_hash.h:340
#2 0xb6ee4cf8 in php_register_variable_ex (var=0x80eb094 "returnURL",
val=0xbfffd500, track_vars_array=0x458ff178) at
/local/palermo/redhat.es.3.0.i386/src/php-5.2.3/main/php_variables.c:213
#3 0xb6dabc59 in php_sapi_filter (arg=1, var=0x80eb094 "returnURL",
val=0xbfffd580, val_len=21, new_val_len=0xbfffd584) at
/local/palermo/redhat.es.3.0.i386/src/php-5.2.3/ext/filter/filter.c:396
#4 0xb6ee50d6 in php_default_treat_data (arg=1, str=0x0,
destArray=0x458ff178) at
/local/palermo/redhat.es.3.0.i386/src/php-5.2.3/main/php_variables.c:369
#5 0xb6ee5cd7 in php_hash_environment () at
/local/palermo/redhat.es.3.0.i386/src/php-5.2.3/main/php_variables.c:677
#6 0xb6edb970 in php_request_startup () at
/local/palermo/redhat.es.3.0.i386/src/php-5.2.3/main/main.c:1143
#7 0xb6f67e93 in apache_php_module_main (r=0x809cf70,
display_source_mode=0) at
/local/palermo/redhat.es.3.0.i386/src/php-5.2.3/sapi/apache/sapi_apache.c:33
#8 0xb6f688ea in send_php (r=0x809cf70, display_source_mode=0,
filename=0x0) at
/local/palermo/redhat.es.3.0.i386/src/php-5.2.3/sapi/apache/mod_php5.c:663
#9 0xb6f689f7 in send_parsed_php (r=0x809cf70) at
/local/palermo/redhat.es.3.0.i386/src/php-5.2.3/sapi/apache/mod_php5.c:678
#10 0x080552bb in ap_invoke_handler ()
#11 0x0806a619 in process_request_internal ()
#12 0x0806a678 in ap_process_request ()
#13 0x08061737 in child_main ()
#14 0x080619bd in make_child ()
#15 0x08061cfb in perform_idle_server_maintenance ()
#16 0x08062332 in standalone_main ()
#17 0x08062952 in main ()
Note that the ht parameter _zend_hash_add_or_update()
is pointing to bad (invalid) memory.
Thanks.
-Shawn
--
Edit bug report at http://bugs.php.net/?id=42475&edit=1
--
Try a CVS snapshot (PHP 4.4):
http://bugs.php.net/fix.php?id=42475&r=trysnapshot44
Try a CVS snapshot (PHP 5.2):
http://bugs.php.net/fix.php?id=42475&r=trysnapshot52
Try a CVS snapshot (PHP 6.0):
http://bugs.php.net/fix.php?id=42475&r=trysnapshot60
Fixed in CVS: http://bugs.php.net/fix.php?id=42475&r=fixedcvs
Fixed in release:
http://bugs.php.net/fix.php?id=42475&r=alreadyfixed
Need backtrace: http://bugs.php.net/fix.php?id=42475&r=needtrace
Need Reproduce Script: http://bugs.php.net/fix.php?id=42475&r=needscript
Try newer version: http://bugs.php.net/fix.php?id=42475&r=oldversion
Not developer issue: http://bugs.php.net/fix.php?id=42475&r=support
Expected behavior: http://bugs.php.net/fix.php?id=42475&r=notwrong
Not enough info:
http://bugs.php.net/fix.php?id=42475&r=notenoughinfo
Submitted twice:
http://bugs.php.net/fix.php?id=42475&r=submittedtwice
register_globals: http://bugs.php.net/fix.php?id=42475&r=globals
PHP 3 support discontinued: http://bugs.php.net/fix.php?id=42475&r=php3
Daylight Savings: http://bugs.php.net/fix.php?id=42475&r=dst
IIS Stability: http://bugs.php.net/fix.php?id=42475&r=isapi
Install GNU Sed: http://bugs.php.net/fix.php?id=42475&r=gnused
Floating point limitations: http://bugs.php.net/fix.php?id=42475&r=float
No Zend Extensions: http://bugs.php.net/fix.php?id=42475&r=nozend
MySQL Configuration Error: http://bugs.php.net/fix.php?id=42475&r=mysqlcfg
