From: gregor_macdougall at yahoo dot com
Operating system: Linux
PHP version: 4CVS-2004-02-26 (stable)
PHP Bug Type: XMLRPC-EPI related
Bug description: xmlrpc_decode segfaults on opteron
Description:
------------
The xmlrpc_decode function causes PHP to segfault on each of our 3 dual
opteron servers. These servers are running various versions of linux and
all segfault in a similar way.
Our 32-bit x86 servers have no problem with the same code.
This segfault occurs when running the following program via the command
line.
Reproduce code:
---------------
<?php
$response = '<?xml version="1.0"?>
<methodResponse><params><param><value><string>Test</string></value></param></params></methodResponse>';
print xmlrpc_decode($response);
?>
Expected result:
----------------
The program should print "Test".
Actual result:
--------------
#0 0x0000002a9626ccdf in _int_free () from /lib/libc.so.6
#1 0x0000002a9626bb5a in free () from /lib/libc.so.6
#2 0x00000000005c7c2e in convert (
src=0xa12a84
"Test</string></value></param></params></methodResponse>",
src_len=4, new_len=0xbfffc78c, from_enc=0x79d11e "UTF-8",
to_enc=0x79ca28 "iso-8859-1")
at
/home/gregor/php4-STABLE-200402262030/ext/xmlrpc/libxmlrpc/encodings.c:87
#3 0x00000000005c7cfa in utf8_decode (
s=0xa12a84
"Test</string></value></param></params></methodResponse>",
len=4, newlen=0xbfffc78c, encoding=0x79ca28 "iso-8859-1")
at
/home/gregor/php4-STABLE-200402262030/ext/xmlrpc/libxmlrpc/encodings.c:117
#4 0x00000000005caa23 in charHandler (userData=0xbfffcbc0,
s=0xa12a84
"Test</string></value></param></params></methodResponse>",
len=4)
at
/home/gregor/php4-STABLE-200402262030/ext/xmlrpc/libxmlrpc/xml_element.c:621
#5 0x00000000005a3b42 in doContent (parser=0xa11f30, startTagLevel=0,
enc=0x912400,
s=0xa12a84
"Test</string></value></param></params></methodResponse>",
end=0xa12abb "", nextPtr=0x0)
at
/home/gregor/php4-STABLE-200402262030/ext/xml/expat/xmlparse.c:2299
#6 0x00000000005a23d8 in contentProcessor (parser=0xa11f30,
start=0xa12a56
"<methodResponse><params><param><value><string>Test</string></value></param></params></methodResponse>",
end=0xa12abb "", endPtr=0x0)
at
/home/gregor/php4-STABLE-200402262030/ext/xml/expat/xmlparse.c:1765
#7 0x00000000005a67a5 in doProlog (parser=0xa11f30, enc=0x912400,
s=0xa12a56
"<methodResponse><params><param><value><string>Test</string></value></param></params></methodResponse>",
end=0xa12abb "", tok=29,
next=0xa12a56
"<methodResponse><params><param><value><string>Test</string></value></param></params></methodResponse>",
nextPtr=0x0)
at
/home/gregor/php4-STABLE-200402262030/ext/xml/expat/xmlparse.c:3415
#8 0x00000000005a5eb6 in prologProcessor (parser=0xa11f30,
s=0xa12a40 "<?xml
version=\"1.0\"?>\n<methodResponse><params><param><value><string>Test</string></value></param></params></methodResponse>",
end=0xa12abb "", nextPtr=0x0)
at
/home/gregor/php4-STABLE-200402262030/ext/xml/expat/xmlparse.c:3178
#9 0x00000000005a599d in prologInitProcessor (parser=0xa11f30,
s=0xa12a40 "<?xml
version=\"1.0\"?>\n<methodResponse><params><param><value><string>Test</string></value></param></params></methodResponse>",
end=0xa12abb "", nextPtr=0x0)
at
/home/gregor/php4-STABLE-200402262030/ext/xml/expat/xmlparse.c:3009
#10 0x00000000005a1af1 in php_XML_ParseBuffer (parser=0xa11f30, len=123,
isFinal=1)
at
/home/gregor/php4-STABLE-200402262030/ext/xml/expat/xmlparse.c:1447
#11 0x00000000005a1a34 in php_XML_Parse (parser=0xa11f30,
s=0xa11ea0 "<?xml
version=\"1.0\"?>\n<methodResponse><params><param><value><string>Test</string></value></param></params></methodResponse>",
len=123,
isFinal=1)
at
/home/gregor/php4-STABLE-200402262030/ext/xml/expat/xmlparse.c:1435
#12 0x00000000005cabcc in xml_elem_parse_buf (
in_buf=0xa11ea0 "<?xml
version=\"1.0\"?>\n<methodResponse><params><param><value><string>Test</string></value></param></params></methodResponse>",
len=123,
options=0xbfffcd20, error=0xbfffccb0)
at
/home/gregor/php4-STABLE-200402262030/ext/xmlrpc/libxmlrpc/xml_element.c:695
#13 0x00000000005cb6ac in XMLRPC_REQUEST_FromXML (
in_buf=0xa11ea0 "<?xml
version=\"1.0\"?>\n<methodResponse><params><param><value><string>Test</string></value></param></params></methodResponse>",
len=123,
in_options=0xbfffcd20)
at
/home/gregor/php4-STABLE-200402262030/ext/xmlrpc/libxmlrpc/xmlrpc.c:756
#14 0x00000000005c3e36 in decode_request_worker (xml_in=0x9fbf30,
encoding_in=0x0, method_name_out=0x0)
at
/home/gregor/php4-STABLE-200402262030/ext/xmlrpc/xmlrpc-epi-php.c:720
#15 0x00000000005c4083 in zif_xmlrpc_decode (ht=1, return_value=0xa0cbe0,
this_ptr=0x0, return_value_used=1)
at
/home/gregor/php4-STABLE-200402262030/ext/xmlrpc/xmlrpc-epi-php.c:788
#16 0x000000000062c8b1 in execute (op_array=0xa0d800)
#17 0x00000000006185fa in zend_execute_scripts (type=8, retval=0x0,
file_count=3) at
/home/gregor/php4-STABLE-200402262030/Zend/zend.c:886
#18 0x00000000005dab8d in php_execute_script (primary_file=0xbffff680)
at /home/gregor/php4-STABLE-200402262030/main/main.c:1731
#19 0x00000000006351e6 in main (argc=2, argv=0xbffff768)
at
/home/gregor/php4-STABLE-200402262030/sapi/cli/php_cli.c:822
--
Edit bug report at http://bugs.php.net/?id=27408&edit=1
--
Try a CVS snapshot (php4): http://bugs.php.net/fix.php?id=27408&r=trysnapshot4
Try a CVS snapshot (php5): http://bugs.php.net/fix.php?id=27408&r=trysnapshot5
Fixed in CVS: http://bugs.php.net/fix.php?id=27408&r=fixedcvs
Fixed in release: http://bugs.php.net/fix.php?id=27408&r=alreadyfixed
Need backtrace: http://bugs.php.net/fix.php?id=27408&r=needtrace
Need Reproduce Script: http://bugs.php.net/fix.php?id=27408&r=needscript
Try newer version: http://bugs.php.net/fix.php?id=27408&r=oldversion
Not developer issue: http://bugs.php.net/fix.php?id=27408&r=support
Expected behavior: http://bugs.php.net/fix.php?id=27408&r=notwrong
Not enough info: http://bugs.php.net/fix.php?id=27408&r=notenoughinfo
Submitted twice: http://bugs.php.net/fix.php?id=27408&r=submittedtwice
register_globals: http://bugs.php.net/fix.php?id=27408&r=globals
PHP 3 support discontinued: http://bugs.php.net/fix.php?id=27408&r=php3
Daylight Savings: http://bugs.php.net/fix.php?id=27408&r=dst
IIS Stability: http://bugs.php.net/fix.php?id=27408&r=isapi
Install GNU Sed: http://bugs.php.net/fix.php?id=27408&r=gnused
Floating point limitations: http://bugs.php.net/fix.php?id=27408&r=float
