ID: 45188 User updated by: thomas dot jarosch at intra2net dot com Reported By: thomas dot jarosch at intra2net dot com -Status: Feedback +Status: Open Bug Type: IMAP related Operating System: linux PHP Version: 5.2.6 New Comment:
Is the latest snapshot compilable? I get this: /usr/src/redhat/BUILD/php5.2-200904291230/main/streams/cast.c:129: error: expected '=', ',', ';', 'asm' or '__attribute__' before 'stream_cookie_functions' /usr/src/redhat/BUILD/php5.2-200904291230/main/streams/cast.c: In function '_php_stream_cast': /usr/src/redhat/BUILD/php5.2-200904291230/main/streams/cast.c:181: error: 'stream_cookie_functions' undeclared (first use in this function) /usr/src/redhat/BUILD/php5.2-200904291230/main/streams/cast.c:181: error: (Each undeclared identifier is reported only once /usr/src/redhat/BUILD/php5.2-200904291230/main/streams/cast.c:181: error: for each function it appears in.) /usr/src/redhat/BUILD/php5.2-200904291230/main/streams/cast.c:181: warning: assignment makes pointer from integer without a cast /usr/src/redhat/BUILD/php5.2-200904291230/main/streams/cast.c:221: warning: passing argument 3 of '_php_stream_cast' makes pointer from integer without a cast Previous Comments: ------------------------------------------------------------------------ [2009-04-27 19:14:40] j...@php.net Please try using this CVS snapshot: http://snaps.php.net/php5.2-latest.tar.gz For Windows: http://windows.php.net/snapshots/ ------------------------------------------------------------------------ [2008-06-05 15:41:29] thomas dot jarosch at intra2net dot com Description: ------------ Hello together, if you use a webmail applications like Horde's IMP and restart the server while an IMAP command is processing, PHP segfaults on request shutdown. Here's a backtrace of the crash: (gdb) bt #0 0x632f6564 in ?? () #1 0x01a6b575 in mail_close_full (stream=0x87b8ad8, options=0) at mail.c:1361 #2 0x01a494e3 in mail_close_it (rsrc=0xb7977840) at /usr/src/redhat/BUILD/php-5.2.6/ext/imap/php_imap.c:229 #3 0x006dacc7 in list_entry_destructor (ptr=0xb7977840) at /usr/src/redhat/BUILD/php-5.2.6/Zend/zend_list.c:184 #4 0x006d8a3a in zend_hash_del_key_or_index (ht=0x7cb480, arKey=0x0, nKeyLength=0, h=81, flag=1) at /usr/src/redhat/BUILD/php-5.2.6/Zend/zend_hash.c:497 #5 0x006da915 in _zend_list_delete (id=81) at /usr/src/redhat/BUILD/php-5.2.6/Zend/zend_list.c:58 #6 0x006cb9ed in _zval_dtor_func (zvalue=0xb79d7a74) at /usr/src/redhat/BUILD/php-5.2.6/Zend/zend_variables.c:60 #7 0x006be95e in _zval_dtor (zvalue=0xb79d7a74) at /usr/src/redhat/BUILD/php-5.2.6/Zend/zend_variables.h:35 #8 0x006bebac in _zval_ptr_dtor (zval_ptr=0xb79a9610) at /usr/src/redhat/BUILD/php-5.2.6/Zend/zend_execute_API.c:414 #9 0x006d8b33 in zend_hash_destroy (ht=0xb7a1a71c) at /usr/src/redhat/BUILD/php-5.2.6/Zend/zend_hash.c:526 #10 0x006eae64 in zend_object_std_dtor (object=0xb7b9bf08) at /usr/src/redhat/BUILD/php-5.2.6/Zend/zend_objects.c:45 #11 0x006eb287 in zend_objects_free_object_storage (object=0xb7b9bf08) at /usr/src/redhat/BUILD/php-5.2.6/Zend/zend_objects.c:122 #12 0x006eec3f in zend_objects_store_free_object_storage (objects=0x7cb528) at /usr/src/redhat/BUILD/php-5.2.6/Zend/zend_objects_API.c:89 #13 0x006be7c7 in shutdown_executor () at /usr/src/redhat/BUILD/php-5.2.6/Zend/zend_execute_API.c:299 #14 0x006cd48d in zend_deactivate () at /usr/src/redhat/BUILD/php-5.2.6/Zend/zend.c:860 #15 0x0067d8d2 in php_request_shutdown (dummy=0x0) at /usr/src/redhat/BUILD/php-5.2.6/main/main.c:1486 #16 0x00742f2f in php_apache_request_dtor (r=0x8776f70) at /usr/src/redhat/BUILD/php-5.2.6/sapi/apache2handler/sapi_apache2.c:469 #17 0x007438ce in php_handler (r=0x8776f70) at /usr/src/redhat/BUILD/php-5.2.6/sapi/apache2handler/sapi_apache2.c:641 #18 0x08065f19 in ap_run_handler () #19 0x08068f61 in ap_invoke_handler () #20 0x080639d8 in ap_process_request () #21 0x0805e6b8 in _start () I took a look at the structures in #1 mail_close_full (stream=0x87b8ad8, options=0), the memory was totally bogus and already reused. To me this looks like a use-after-free issue. While debugging I've found another crash in c-client's IMAP extension and I will submit a patch upstream. I was unable to find the source of this crash, but I suspect the connection already gets closed and then PHP tries to close it twice or something like that. Reproduce code: --------------- Move mails via IMAP to another folder and restart your IMAP server. Expected result: ---------------- Error message "Connection to server died". Actual result: -------------- Segfault. ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=45188&edit=1
