[PHP-BUG] Bug #60197 [NEW]: PHP cause a segmentation fault when the zval* isn't freed.

imcnan at gmail dot com Tue, 01 Nov 2011 21:29:27 -0700

From:             
Operating system: linux
PHP version:      5.3.8
Package:          Scripting Engine problem
Bug Type:         Bug
Bug description:PHP cause a segmentation fault when the zval* isn't freed.


Description:
------------
phpä»¥debugæ¨¡å¼ç¼è¯ãå¦ææ²¡æéæ¾zval*ï¼dlå è½½æ¨¡åçæ¶åä¼å¼èµ·æ®µéè¯¯ã

I compiled php in debug mode.If the zval* isn't freed,the php will cause a

Segmentation fault when load the module using dl();



Test script:
---------------
In PHP:
<?php
test_call();
echo "The Programe is over~\n";
?>


Expected result:
----------------
printf the detail info abount Memory leak

Actual result:
--------------
There is the same error with php 5.3.8.

walu@walu-ThinkPad:/cnan/php/bin-5.3.6/bin$ ./php test.php 
The Programe is over~
[Wed Nov  2 11:57:28 2011]  Script:  'test.php'
Segmentation fault

backtrace when Segmentation fault:


(gdb) run test.php
Starting program: /cnan/php/bin-5.3.6/bin/php test.php
The Programe is over~
[Wed Nov  2 11:25:49 2011]  Script:  'test.php'

Program received signal SIGSEGV, Segmentation fault.
0x0838bd33 in format_converter (odp=0xbfffdbf4, fmt=0x875bcc9 "s(%d) : 
Freeing 
0x%.8lX (%zu bytes), script=%s\n", ap=0xbfffdc60 "(")
    at /cnan/php/source-5.3.6/main/snprintf.c:964
964                                                     s_len = strlen(s);
(gdb) bt
#0  0x0838bd33 in format_converter (odp=0xbfffdbf4, fmt=0x875bcc9 "s(%d) : 

Freeing 0x%.8lX (%zu bytes), script=%s\n", ap=0xbfffdc60 "(")
    at /cnan/php/source-5.3.6/main/snprintf.c:964
#1  0x0838c578 in strx_printv (ccp=0xbfffdc38, buf=0xbfffdccc "[Wed Nov  2

11:25:49 2011]  Script:  'test.php'\n", len=512, 
    format=0x875bcc8 "%s(%d) :  Freeing 0x%.8lX (%zu bytes), script=%s\n",

ap=0xbfffdc5c "PYE") at /cnan/php/source-5.3.6/main/snprintf.c:1211
#2  0x0838c676 in ap_php_snprintf (buf=0xbfffdccc "[Wed Nov  2 11:25:49
2011]  
Script:  'test.php'\n", len=512, 
    format=0x875bcc8 "%s(%d) :  Freeing 0x%.8lX (%zu bytes), script=%s\n")
at 
/cnan/php/source-5.3.6/main/snprintf.c:1256
#3  0x083887b4 in php_message_handler_for_zend (message=4, data=0xbfffef24)
at 
/cnan/php/source-5.3.6/main/main.c:1273
#4  0x083f5ec2 in zend_message_dispatcher (message=4, data=0xbfffef24) at 
/cnan/php/source-5.3.6/Zend/zend.c:944
#5  0x083d3084 in zend_mm_check_leaks (heap=0x87fc1b8) at
/cnan/php/source-
5.3.6/Zend/zend_alloc.c:1280
#6  0x083d3ba7 in zend_mm_shutdown (heap=0x87fc1b8, full_shutdown=0,
silent=0) 
at /cnan/php/source-5.3.6/Zend/zend_alloc.c:1638
#7  0x083d5bb8 in shutdown_memory_manager (silent=0, full_shutdown=0) at 
/cnan/php/source-5.3.6/Zend/zend_alloc.c:2562
#8  0x083891df in php_request_shutdown (dummy=0x0) at /cnan/php/source-
5.3.6/main/main.c:1654
#9  0x084b9812 in main (argc=2, argv=0xbffff364) at /cnan/php/source-
5.3.6/sapi/cli/php_cli.c:1374


-- 
Edit bug report at https://bugs.php.net/bug.php?id=60197&edit=1
-- 
Try a snapshot (PHP 5.4):            
https://bugs.php.net/fix.php?id=60197&r=trysnapshot54
Try a snapshot (PHP 5.3):            
https://bugs.php.net/fix.php?id=60197&r=trysnapshot53
Try a snapshot (trunk):              
https://bugs.php.net/fix.php?id=60197&r=trysnapshottrunk
Fixed in SVN:                        
https://bugs.php.net/fix.php?id=60197&r=fixed
Fixed in SVN and need be documented: 
https://bugs.php.net/fix.php?id=60197&r=needdocs
Fixed in release:                    
https://bugs.php.net/fix.php?id=60197&r=alreadyfixed
Need backtrace:                      
https://bugs.php.net/fix.php?id=60197&r=needtrace
Need Reproduce Script:               
https://bugs.php.net/fix.php?id=60197&r=needscript
Try newer version:                   
https://bugs.php.net/fix.php?id=60197&r=oldversion
Not developer issue:                 
https://bugs.php.net/fix.php?id=60197&r=support
Expected behavior:                   
https://bugs.php.net/fix.php?id=60197&r=notwrong
Not enough info:                     
https://bugs.php.net/fix.php?id=60197&r=notenoughinfo
Submitted twice:                     
https://bugs.php.net/fix.php?id=60197&r=submittedtwice
register_globals:                    
https://bugs.php.net/fix.php?id=60197&r=globals
PHP 4 support discontinued:          
https://bugs.php.net/fix.php?id=60197&r=php4
Daylight Savings:                    https://bugs.php.net/fix.php?id=60197&r=dst
IIS Stability:                       
https://bugs.php.net/fix.php?id=60197&r=isapi
Install GNU Sed:                     
https://bugs.php.net/fix.php?id=60197&r=gnused
Floating point limitations:          
https://bugs.php.net/fix.php?id=60197&r=float
No Zend Extensions:                  
https://bugs.php.net/fix.php?id=60197&r=nozend
MySQL Configuration Error:           
https://bugs.php.net/fix.php?id=60197&r=mysqlcfg

[PHP-BUG] Bug #60197 [NEW]: PHP cause a segmentation fault when the zval* isn't freed.

Reply via email to