ID: 39883
User updated by: youza at post dot cz
Reported By: youza at post dot cz
-Status: Feedback
+Status: Open
Bug Type: FTP related
Operating System: Fedora Core 4
PHP Version: 4.4.4
New Comment:
I use new apache instance and last php CVS
(php4-STABLE-200612210930.tar.gz)- the changes is config only port,
and
path to *.so php file
The result:
apache errot log does not contain the Segmentation fault
message but file is'nt copied. In the script directory (php ??) create
file "0" - the file contains:
[22-Dec-2006 10:16:11] PHP Warning: ftp_get(): Opening BINARY mode
data connection for test.dat (1106982 bytes). in
/web/docs/tester/youza/ftp/test.php on line 35
I running stace - this is result:
.......
open("/web/docs/tester/youza/ftp/test.php", O_RDONLY) = 1736
fstat64(1736, {st_mode=S_IFREG|0644, st_size=1025, ...}) = 0
fstat64(1736, {st_mode=S_IFREG|0644, st_size=1025, ...}) = 0
lseek(1736, 0, SEEK_CUR) = 0
lseek(1736, 0, SEEK_SET) = 0
read(1736, "<?\r\n#error_reporting (E_ALL);\r\n#"..., 8192) = 1025
read(1736, "", 8192) = 0
close(1736) = 0
time(NULL) = 1166779143
open("/etc/hosts", O_RDONLY) = 1736
fcntl64(1736, F_GETFD) = 0
fcntl64(1736, F_SETFD, FD_CLOEXEC) = 0
fstat64(1736, {st_mode=S_IFREG|0644, st_size=191, ...}) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1,
0) = 0xb7f1c000
read(1736, "# Do not remove the following li"..., 4096) = 191
close(1736) = 0
munmap(0xb7f1c000, 4096) = 0
socket(PF_INET, SOCK_STREAM, IPPROTO_IP) = 1736
connect(1736, {sa_family=AF_INET, sin_port=htons(21),
sin_addr=inet_addr("193.165.254.13")}, 16) = 0
getsockname(1736, {sa_family=AF_INET, sin_port=htons(45096),
sin_addr=inet_addr("193.165.254.13")}, [16]) = 0
select(1737, [1025 1027 1028 1030 1091 1092 1093 1095 1096 1098 1099
1101 1102 1103 1104 1108 1109 1110 1111 1122 1123 1127 1130 1131 1132
1135 1137 1143 1144 1147 1154 1162 1163 1164 1167 1169 1175 1176 1179
1187 1188 1189 1190 1191 1192 1197 1198 1200 1201 1202 1203 1204 1205
1207 1208 1209 1210 1211 1212 1213 1215 1221 1223 1226 1227 1228 1230
1232 1233 1234 1235 1236 1238 1239 1260 1377 1379 1380 1382 1410 1411
1415 1418 1419 1420 1423 1425 1431 1432 1435 1452 1475 1476 1477 1479
1480 1482 1483 1485 1486 1487 1488 1492 1493 1494 1495 1507 1514 1515
1516 1519 1521 1527 1528 1531 1538 1546 1547 1548 1551 1553 1559 1560
1563 1571 1572 1573 1577 1581 1582 1584 1585 1586 1587 1588 1589 1591
1592 1593 1594 1595 1596 1597 1599 1600 1606 1610 1611 1612 1613 1614
1616 1617 1618 1619 1620 1622 1623 1635 1638 1639 1641 1642 1667 1674
1675 1676 1679 1681 1687 1688 1691 1699 1701 1705 1709 1710 1712 1713
1714 1715 1716 1717 1719 1720 1721 1722 1723 1724 1725 1727 1733 1736],
NULL, NULL, {90, 0}) = 192 (in [1025 1027 1028 1030 1091 1092 1093 1095
1096 1098 1099 1101 1102 1103 1104 1108 1109 1110 1111 1122 1123 1127
1130 1131 1132 1135 1137 1143 1144 1147 1154 1162 1163 1164 1167 1169
1175 1176 1179 1187 1188 1189 1190 1191 1192 1197 1198 1200 1201 1202
1203 1204 1205 1207 1208 1209 1210 1211 1212 1213 1215 1221 1223 1226
1227 1228 1230 1232 1233 1234 1235 1236 1238 1239 1260 1377 1379 1380
1382 1410 1411 1415 1418 1419 1420 1423 1425 1431 1432 1435 1452 1475
1476 1477 1479 1480 1482 1483 1485 1486 1487 1488 1492 1493 1494 1495
1507 1514 1515 1516 1519 1521 1527 1528 1531 1538 1546 1547 1548 1551
1553 1559 1560 1563 1571 1572 1573 1577 1581 1582 1584 1585 1586 1587
1588 1589 1591 1592 1593 1594 1595 1596 1597 1599 1600 1606 1610 1611
1612 1613 1614 1616 1617 1618 1619 1620 1622 1623 1635 1638 1639 1641
1642 1667 1674 1675 1676 1679 1681 1687 1688 1691 1699 1701 1705 1709
1710 1712 1713 1714 1715 1716 1717 1719 1720 1721 1722 1723 1724 1725
1727 1733], left {90, 0})
recv(1736, "220 FTP\r\n", 4096, 0) = 9
select(1737, NULL, [1025 1027 1028 1030 1091 1092 1093 1095 1096 1098
1099 1101 1102 1103 1104 1108 1109 1110 1111 1120 1122 1123 1154 1156
1159 1162 1163 1165 1167 1169 1175 1176 1179 1187 1188 1189 1190 1191
1192 1197 1198 1200 1201 1202 1203 1204 1205 1207 1208 1209 1210 1211
1212 1213 1215 1218 1219 1220 1221 1224 1226 1228 1230 1232 1233 1234
1235 1236 1238 1239 1248 1250 1251 1284 1285 1288 1289 1290 1293 1295
1296 1298 1299 1301 1302 1303 1315 1316 1321 1322 1323 1325 1326 1329
1330 1331 1333 1334 1335 1346 1347 1348 1349 1352 1354 1355 1357 1358
1359 1361 1367 1368 1371 1379 1380 1381 1383 1384 1386 1387 1389 1390
1391 1392 1396 1397 1398 1399 1411 1412 1417 1418 1419 1421 1422 1425
1426 1427 1429 1430 1431 1442 1450 1451 1452 1455 1457 1463 1464 1467
1475 1476 1477 1479 1480 1482 1483 1485 1486 1487 1488 1492 1493 1494
1495 1506 1514 1515 1516 1519 1521 1527 1528 1531 1571 1573 1577 1581
1582 1584 1585 1586 1587 1588 1589 1591 1592 1593 1594 1595 1596 1597
1599 1601 1602 1607 1611 1612 1613 1614 1616 1617 1618 1619 1620 1622
1623 1635 1637 1638 1641 1645 1646 1648 1649 1650 1651 1652 1653 1655
1656 1657 1658 1659 1660 1661 1663 1666 1667 1669 1672 1673 1677 1681
1687 1688 1691 1698 1706 1707 1708 1711 1713 1719 1720 1723 1729 1730
1733 1735 1736], NULL, {90, 0}) = 251 (out [1025 1027 1028 1030 1091
1092 1093 1095 1096 1098 1099 1101 1102 1103 1104 1108 1109 1110 1111
1120 1122 1123 1154 1156 1159 1162 1163 1165 1167 1169 1175 1176 1179
1187 1188 1189 1190 1191 1192 1197 1198 1200 1201 1202 1203 1204 1205
1207 1208 1209 1210 1211 1212 1213 1215 1218 1219 1220 1221 1224 1226
1228 1230 1232 1233 1234 1235 1236 1238 1239 1248 1250 1251 1284 1285
1288 1289 1290 1293 1295 1296 1298 1299 1301 1302 1303 1315 1316 1321
1322 1323 1325 1326 1329 1330 1331 1333 1334 1335 1346 1347 1348 1349
1352 1354 1355 1357 1358 1359 1361 1367 1368 1371 1379 1380 1381 1383
1384 1386 1387 1389 1390 1391 1392 1396 1397 1398 1399 1411 1412 1417
1418 1419 1421 1422 1425 1426 1427 1429 1430 1431 1442 1450 1451 1452
1455 1457 1463 1464 1467 1475 1476 1477 1479 1480 1482 1483 1485 1486
1487 1488 1492 1493 1494 1495 1506 1514 1515 1516 1519 1521 1527 1528
1531 1571 1573 1577 1581 1582 1584 1585 1586 1587 1588 1589 1591 1592
1593 1594 1595 1596 1597 1599 1601 1602 1607 1611 1612 1613 1614 1616
1617 1618])
send(1736, "USER tester\r\n", 13, 0) = 13
select(1737, [1025 1027 1028 1030 1091 1092 1093 1095 1096 1098 1099
1101 1102 1103 1104 1108 1109 1110 1111 1122 1123 1127 1130 1131 1132
1135 1137 1143 1144 1147 1154 1162 1163 1164 1167 1169 1175 1176 1179
1187 1188 1189 1190 1191 1192 1197 1198 1200 1201 1202 1203 1204 1205
1207 1208 1209 1210 1211 1212 1213 1215 1221 1223 1226 1227 1228 1230
1232 1233 1234 1235 1236 1238 1239 1260 1284 1285 1288 1289 1290 1293
1295 1296 1298 1299 1301 1302 1303 1315 1316 1321 1322 1323 1325 1326
1329 1330 1331 1333 1334 1335 1346 1347 1348 1349 1352 1354 1355 1357
1358 1359 1361 1367 1368 1371 1379 1380 1381 1383 1384 1386 1387 1389
1390 1391 1392 1396 1397 1398 1399 1410 1411 1415 1418 1419 1420 1423
1425 1431 1432 1435 1452 1475 1476 1477 1479 1480 1482 1483 1485 1486
1487 1488 1492 1493 1494 1495 1506 1514 1515 1516 1519 1521 1527 1528
1531 1571 1573 1577 1581 1582 1584 1585 1586 1587 1588 1589 1591 1592
1593 1594 1595 1596 1597 1599 1600 1601 1603 1604 1607 1611 1612 1613
1614 1616 1617 1618 1619 1620 1622 1623 1635 1637 1638 1641 1645 1646
1648 1649 1650 1651 1652 1653 1655 1656 1657 1658 1659 1660 1661 1663
1666 1667 1669 1672 1673 1677 1681 1687 1688 1691 1698 1706 1707 1708
1711 1713 1719 1720 1723 1729 1730 1733 1735 1736], NULL, NULL, {90,
0}*** buffer overflow detected ***: strace terminated
======= Backtrace: =========
/lib/libc.so.6(__chk_fail+0x41)[0xc23bc5]
/lib/libc.so.6(__strcpy_chk+0x0)[0xc23218]
strace[0x804fbd7]
strace[0x804c7bb]
strace[0x804b8f9]
/lib/libc.so.6(__libc_start_main+0xdf)[0xb5ad7f]
strace[0x80495f1]
======= Memory map: ========
00b27000-00b28000 r-xp 00b27000 00:00 0 [vdso]
00b28000-00b42000 r-xp 00000000 09:01 7070985 /lib/ld-2.3.6.so
00b42000-00b43000 r-xp 00019000 09:01 7070985 /lib/ld-2.3.6.so
00b43000-00b44000 rwxp 0001a000 09:01 7070985 /lib/ld-2.3.6.so
00b46000-00c69000 r-xp 00000000 09:01 7070987 /lib/libc-2.3.6.so
00c69000-00c6b000 r-xp 00122000 09:01 7070987 /lib/libc-2.3.6.so
00c6b000-00c6d000 rwxp 00124000 09:01 7070987 /lib/libc-2.3.6.so
00c6d000-00c6f000 rwxp 00c6d000 00:00 0
00cd7000-00ce0000 r-xp 00000000 09:01 7071004
/lib/libgcc_s-4.0.2-20051126.so.1
00ce0000-00ce1000 rwxp 00009000 09:01 7071004
/lib/libgcc_s-4.0.2-20051126.so.1
08048000-08076000 r-xp 00000000 09:01 2163745 /usr/bin/strace
08076000-08077000 rw-p 0002e000 09:01 2163745 /usr/bin/strace
08077000-0807e000 rw-p 08077000 00:00 0
08357000-08378000 rw-p 08357000 00:00 0 [heap]
b7f1b000-b7f1c000 rw-p b7f1b000 00:00 0
b7f27000-b7f28000 rw-p b7f27000 00:00 0
bf906000-bf91b000 rw-p bf906000 00:00 0 [stack]
Aborted
Previous Comments:
------------------------------------------------------------------------
[2006-12-20 14:01:34] [EMAIL PROTECTED]
Please set up different Apache instance listening to different port and
using the latest snapshot.
------------------------------------------------------------------------
[2006-12-20 13:49:43] youza at post dot cz
Hmm I run this command with my version PHP 4.4.4 (no CVS)and this
command is ok -file transferred.
/usr/bin/php -c ./etc/php.ini test.php
But access this page over www http:/my.server/test.php
is buggy and produce coredump.
cli version is ok byt apache module is bad ?
------------------------------------------------------------------------
[2006-12-20 10:30:28] [EMAIL PROTECTED]
>Use the last CVS is problematic - the server is a production server.
You don't have to run `make install`. In fact, you don't have to run it
through Apache at all, just build a CLI binary in your home directory
and run `sapi/cli/php /path/to/script.php`.
------------------------------------------------------------------------
[2006-12-20 08:56:44] youza at post dot cz
Use the last CVS is problematic - the server is a production server.
I test command ftp_nb_get and this is right.
I don't get it why ftp_get is bad and ftp_ng_get is right ?
------------------------------------------------------------------------
[2006-12-19 12:46:22] [EMAIL PROTECTED]
Please try using this CVS snapshot:
http://snaps.php.net/php4-STABLE-latest.tar.gz
For Windows:
http://snaps.php.net/win32/php4-win32-STABLE-latest.zip
------------------------------------------------------------------------
The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
http://bugs.php.net/39883
--
Edit this bug report at http://bugs.php.net/?id=39883&edit=1
