From: svoboda at tojeono dot cz Operating system: Debian lenny PHP version: 5.3.1 PHP Bug Type: Reproducible crash Bug description: Segmentation fault during tidy->parseString
Description: ------------ Hi, If I compile PHP --with-tidy version from debian lenny libtidy-dev 20081224cvs-1, I get segementation fault on method parseString(). My configure command is: ./configure --with-gmp --with-iconv=/usr/local/libiconv-1.11/ --with-imap --with-imap-ssl --with-interbase --with-tidy --enable-debug --with-kerberos What I found and may be useful: - If I don't compile it --with-gmp , the segfault doesn't ocur - If I use libtidy-dev version from debian squeeze, it segfault too - If I use php version 5.2.8, it segfault too - If I use libtidy-dev from oldstable debian , the segfault doesn't ocur - It segfault both in command line and apache (if it's compiled) - It crash on whatever string - could be empty '', or some longer text If more info needed, please let me know. Ondrej Reproduce code: --------------- <?php $text = 'test'; $tidy = new tidy(); $tidy->parseString($text, array( 'output-xhtml' => true, 'show-body-only' => true, ), 'utf8'); Expected result: ---------------- some parsed string Actual result: -------------- Segmentation fault stat64("/dev/urandom", {st_mode=S_IFCHR|0666, st_rdev=makedev(1, 9), ...}) = 0 brk(0x85e3000) = 0x85e3000 munmap(0xb7464000, 266240) = 0 brk(0x8626000) = 0x8626000 open("/tmp/file.php", O_RDONLY) = 3 fstat64(3, {st_mode=S_IFREG|0644, st_size=138, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7f17000 read(3, "<?php\n\n$text = 'test';\n$tidy = new tidy();\n$tidy->parseString($text, array(\n'output-xhtml' => true,\n'show-body-only' => true,\n), 'utf8');\n"..., 4096) = 138 _llseek(3, 0, [0], SEEK_SET) = 0 time(NULL) = 1258735735 fstat64(0, {st_mode=S_IFCHR|0600, st_rdev=makedev(136, 0), ...}) = 0 fstat64(0, {st_mode=S_IFCHR|0600, st_rdev=makedev(136, 0), ...}) = 0 fstat64(0, {st_mode=S_IFCHR|0600, st_rdev=makedev(136, 0), ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7f16000 _llseek(0, 0, 0xbfa5240c, SEEK_CUR) = -1 ESPIPE (Illegal seek) fstat64(1, {st_mode=S_IFCHR|0600, st_rdev=makedev(136, 0), ...}) = 0 fstat64(1, {st_mode=S_IFCHR|0600, st_rdev=makedev(136, 0), ...}) = 0 fstat64(1, {st_mode=S_IFCHR|0600, st_rdev=makedev(136, 0), ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7f15000 _llseek(1, 0, 0xbfa5240c, SEEK_CUR) = -1 ESPIPE (Illegal seek) fstat64(2, {st_mode=S_IFCHR|0600, st_rdev=makedev(136, 0), ...}) = 0 fstat64(2, {st_mode=S_IFCHR|0600, st_rdev=makedev(136, 0), ...}) = 0 _llseek(2, 0, 0xbfa5240c, SEEK_CUR) = -1 ESPIPE (Illegal seek) time(NULL) = 1258735735 lstat64("/tmp", {st_mode=S_IFDIR|S_ISVTX|0777, st_size=380, ...}) = 0 lstat64("/tmp/file.php", {st_mode=S_IFREG|0644, st_size=138, ...}) = 0 ioctl(3, SNDCTL_TMR_TIMEBASE or TCGETS, 0xbfa504a8) = -1 ENOTTY (Inappropriate ioctl for device) read(3, "<?php\n\n$text = 'test';\n$tidy = new tidy();\n$tidy->parseString($text, array(\n'output-xhtml' => true,\n'show-body-only' => true,\n), 'utf8');\n"..., 8192) = 138 read(3, ""..., 4096) = 0 read(3, ""..., 8192) = 0 close(3) = 0 munmap(0xb7f17000, 4096) = 0 --- SIGSEGV (Segmentation fault) @ 0 (0) --- +++ killed by SIGSEGV +++ -- Edit bug report at http://bugs.php.net/?id=50248&edit=1 -- Try a snapshot (PHP 5.2): http://bugs.php.net/fix.php?id=50248&r=trysnapshot52 Try a snapshot (PHP 5.3): http://bugs.php.net/fix.php?id=50248&r=trysnapshot53 Try a snapshot (PHP 6.0): http://bugs.php.net/fix.php?id=50248&r=trysnapshot60 Fixed in SVN: http://bugs.php.net/fix.php?id=50248&r=fixed Fixed in SVN and need be documented: http://bugs.php.net/fix.php?id=50248&r=needdocs Fixed in release: http://bugs.php.net/fix.php?id=50248&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=50248&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=50248&r=needscript Try newer version: http://bugs.php.net/fix.php?id=50248&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=50248&r=support Expected behavior: http://bugs.php.net/fix.php?id=50248&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=50248&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=50248&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=50248&r=globals PHP 4 support discontinued: http://bugs.php.net/fix.php?id=50248&r=php4 Daylight Savings: http://bugs.php.net/fix.php?id=50248&r=dst IIS Stability: http://bugs.php.net/fix.php?id=50248&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=50248&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=50248&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=50248&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=50248&r=mysqlcfg