PHP :: Bug #45567 :: php5ts.dll crashes apache 2

Bug #45567

php5ts.dll crashes apache 2

Submitted:

2008-07-19 21:53 UTC

Modified:

2008-07-21 17:31 UTC

Votes:	1
Avg. Score:	4.0 ± 0.0
Reproduced:	1 of 1 (100.0%)
Same Version:	1 (100.0%)
Same OS:	0 (0.0%)

From:

jan at ecotech dot se

Assigned:

Status:

Not a bug

Package:

Reproducible crash

PHP Version:

5.2.6 && 5.3.0-20080720-0030

OS:

Vista SP1

Private report:

CVE-ID:

None

View Developer Edit

[2008-07-19 21:53 UTC] jan at ecotech dot se

Description:
------------
I constantly can reproduce a crash of Apache due to php5ts.dll in some pages. 

I use:
 * Apache 2.2.9
 * PHP 5.2.6
 * Windows Vista SP1

Apache restarts with following problem signature:
  
  Problem signature:
  Problem Event Name:	APPCRASH
  Application Name:	httpd.exe
  Application Version:	2.2.9.0
  Application Timestamp:	4852383f
  Fault Module Name:	php5ts.dll
  Fault Module Version:	5.2.6.6
  Fault Module Timestamp:	481b8f4b
  Exception Code:	c0000005
  Exception Offset:	0000af6f
  OS Version:	6.0.6001.2.1.0.256.1
  Locale ID:	1053
  Additional Information 1:	6353
  Additional Information 2:	8a82b40956bba3220ef12e86f3167b20
  Additional Information 3:	e918
  Additional Information 4:	cfc3e5129a8641c7e1f390d0ea7f83d4

Read our privacy statement:
  http://go.microsoft.com/fwlink/?linkid=50163&clcid=0x0409
 

Reproduce code:
---------------
It doesn't really matter what code I use. Sometimes it crashes on phpinfo(), sometimes on a var_dump( $_POST ). etc.

Actual result:
--------------
The stack trace can be found:

http://www.madwax.se/php-crash-info/

Analysis Summary  
  Type Description Recommendation 
  Error In httpd__PID__4120__Date__07_19_2008__Time_11_40_07PM__394__First chance exception 0XC0000005.dmp the assembly instruction at php5ts!_zend_mm_free_int+35f in C:\Ecoweb\apps\PHP\php5ts.dll from The PHP Group has caused an access violation exception (0xC0000005) when trying to read from memory location 0x00000000 on thread 8
 Please follow up with the vendor The PHP Group for C:\Ecoweb\apps\PHP\php5ts.dll
 
  Error In httpd__PID__4120__Date__07_19_2008__Time_11_40_14PM__79__Second_Chance_Exception_C0000005.dmp the assembly instruction at php5ts!_zend_mm_free_int+35f in C:\Ecoweb\apps\PHP\php5ts.dll from The PHP Group has caused an access violation exception (0xC0000005) when trying to read from memory location 0x00000000 on thread 8
 Please follow up with the vendor The PHP Group for C:\Ecoweb\apps\PHP\php5ts.dll
 
  Information DebugDiag determined that this dump file (httpd__PID__4120__Date__07_19_2008__Time_11_40_07PM__394__First chance exception 0XC0000005.dmp) is a crash dump and did not perform any hang analysis. If you wish to enable combined crash and hang analysis for crash dumps, edit the CrashHangAnalysis.asp script (located in the DebugDiag\Scripts folder) and set the g_DoCombinedAnalysis constant to True.   
  Information DebugDiag determined that this dump file (httpd__PID__4120__Date__07_19_2008__Time_11_40_14PM__79__Second_Chance_Exception_C0000005.dmp) is a crash dump and did not perform any hang analysis. If you wish to enable combined crash and hang analysis for crash dumps, edit the CrashHangAnalysis.asp script (located in the DebugDiag\Scripts folder) and set the g_DoCombinedAnalysis constant to True.   
 
 
Table Of Contents
httpd__PID__4120__Date__07_19_2008__Time_11_40_14PM__79__Second_Chance_Exception_C0000005.dmp

   Faulting Thread

   Faulting Module Information



httpd__PID__4120__Date__07_19_2008__Time_11_40_07PM__394__First chance exception 0XC0000005.dmp

   Faulting Thread

   Faulting Module Information



 Report for httpd__PID__4120__Date__07_19_2008__Time_11_40_14PM__79__Second_Chance_Exception_C0000005.dmp




Report for httpd__PID__4120__Date__07_19_2008__Time_11_40_14PM__79__Second_Chance_Exception_C0000005.dmp
Type of Analysis Performed   Crash Analysis 
Machine Name   TJOCKIS 
Operating System   Windows Vista Service Pack 1 
Number Of Processors   2 
Process ID   4120 
Process Image   C:\Ecoweb\apps\Apache2.2\bin\httpd.exe 
System Up-Time   02:10:02 
Process Up-Time   00:02:08 


Thread 8 - System ID 4612
Entry point   msvcrt!_endthreadex+6f 
Create time   2008-07-19 23:38:07 
Time spent in user mode   0 Days 0:0:1.171 
Time spent in kernel mode   0 Days 0:0:0.500 






Function     Arg 1     Arg 2     Arg 3   Source 
php5ts!_zend_mm_free_int+35f     04110f30     00000b10     01c0311c    
php5ts!_efree+39     06934190     01c9c537     068cea94    
php5ts!free_estring+c     068cea94     769d9d32     040e97d8    
php5ts!zend_hash_destroy+27     040cf168     040cf130     040cf0e8    
php5ts!shutdown_compiler+b0     040e97d8     040e97d8     040e97d8    
php5ts!zend_deactivate+cf     040e97d8     009b4a10     040e97d8    
php5ts!php_request_shutdown+2c9     00000000     00283573     009fe820    
php5apache2_2!php_apache_request_dtor+8     009fe820     040e97d8     00000004    
php5apache2_2!php_handler+643     009fe820     009b4a10     009fe820    
libhttpd!ap_run_handler+21     009fe820     009fe820     009fe820    
libhttpd!ap_invoke_handler+ae     00000000     025fe9f0     02c1ff00    
libhttpd!ap_die+24e     009fe820     00000000     009e36a0    
libhttpd!ap_get_request_note+1c9c     025fe9f0     025fe9f0     025fe9f0    
libhttpd!ap_run_process_connection+21     025fe9f0     00924ea0     02c1ff48    
libhttpd!ap_process_connection+33     025fe9f0     009ee7f0     00000000    
libhttpd!ap_regkey_value_remove+c7c     025fe9e8     dc9fc8a4     00000000    
msvcrt!_endthreadex+44     02c1ff94     76b64911     025ee208    
msvcrt!_endthreadex+ce     025ee208     02c1ffd4     76eee4b6    
kernel32!BaseThreadInitThunk+e     025ee208     7443b351     00000000    
ntdll!__RtlUserThreadStart+23     769e2da8     025ee208     00000000    
ntdll!_RtlUserThreadStart+1b     769e2da8     025ee208     00000000    




PHP5TS!_ZEND_MM_FREE_INT+35FIn httpd__PID__4120__Date__07_19_2008__Time_11_40_14PM__79__Second_Chance_Exception_C0000005.dmp the assembly instruction at php5ts!_zend_mm_free_int+35f in C:\Ecoweb\apps\PHP\php5ts.dll from The PHP Group has caused an access violation exception (0xC0000005) when trying to read from memory location 0x00000000 on thread 8

Module Information 
Image Name: C:\Ecoweb\apps\PHP\php5ts.dll   Symbol Type:  PDB 
Base address: 0x01c00000   Time Stamp:  Sat May 03 00:01:47 2008  
Checksum: 0x00000000   Comments:   
COM DLL: False   Company Name:  The PHP Group 
ISAPIExtension: False   File Description:  PHP Script Interpreter 
ISAPIFilter: False   File Version:  5.2.6.6 
Managed DLL: False   Internal Name:  php5ts.dll 
VB DLL: False   Legal Copyright:  Copyright ? 1997-2007 The PHP Group 
Loaded Image Name:  php5ts.dll   Legal Trademarks:  PHP 
Mapped Image Name:  C:\Ecoweb\apps\PHP\php5ts.dll   Original filename:  php5ts.dll 
Module name:  php5ts   Private Build:   
Single Threaded:  False   Product Name:  PHP Script Interpreter 
Module Size:  4,93 MBytes   Product Version:  5.2.6 
Symbol File Name:  C:\Ecoweb\apps\php-dbgpack\php5ts.pdb   Special Build:  & 





 Report for httpd__PID__4120__Date__07_19_2008__Time_11_40_07PM__394__First chance exception 0XC0000005.dmp




Report for httpd__PID__4120__Date__07_19_2008__Time_11_40_07PM__394__First chance exception 0XC0000005.dmp
Type of Analysis Performed   Crash Analysis 
Machine Name   TJOCKIS 
Operating System   Windows Vista Service Pack 1 
Number Of Processors   2 
Process ID   4120 
Process Image   C:\Ecoweb\apps\Apache2.2\bin\httpd.exe 
System Up-Time   02:09:58 
Process Up-Time   00:02:01 


Thread 8 - System ID 4612
Entry point   msvcrt!_endthreadex+6f 
Create time   2008-07-19 23:38:07 
Time spent in user mode   0 Days 0:0:1.171 
Time spent in kernel mode   0 Days 0:0:0.500 






Function     Arg 1     Arg 2     Arg 3   Source 
php5ts!_zend_mm_free_int+35f     04110f30     00000b10     01c0311c    
php5ts!_efree+39     06934190     01c9c537     068cea94    
php5ts!free_estring+c     068cea94     769d9d32     040e97d8    
php5ts!zend_hash_destroy+27     040cf168     040cf130     040cf0e8    
php5ts!shutdown_compiler+b0     040e97d8     040e97d8     040e97d8    
php5ts!zend_deactivate+cf     040e97d8     009b4a10     040e97d8    
php5ts!php_request_shutdown+2c9     00000000     00283573     009fe820    
php5apache2_2!php_apache_request_dtor+8     009fe820     040e97d8     00000004    
php5apache2_2!php_handler+643     009fe820     009b4a10     009fe820    
libhttpd!ap_run_handler+21     009fe820     009fe820     009fe820    
libhttpd!ap_invoke_handler+ae     00000000     025fe9f0     02c1ff00    
libhttpd!ap_die+24e     009fe820     00000000     009e36a0    
libhttpd!ap_get_request_note+1c9c     025fe9f0     025fe9f0     025fe9f0    
libhttpd!ap_run_process_connection+21     025fe9f0     00924ea0     02c1ff48    
libhttpd!ap_process_connection+33     025fe9f0     009ee7f0     00000000    
libhttpd!ap_regkey_value_remove+c7c     025fe9e8     dc9fc8a4     00000000    
msvcrt!_endthreadex+44     02c1ff94     76b64911     025ee208    
msvcrt!_endthreadex+ce     025ee208     02c1ffd4     76eee4b6    
kernel32!BaseThreadInitThunk+e     025ee208     7443b351     00000000    
ntdll!__RtlUserThreadStart+23     769e2da8     025ee208     00000000    
ntdll!_RtlUserThreadStart+1b     769e2da8     025ee208     00000000    




PHP5TS!_ZEND_MM_FREE_INT+35FIn httpd__PID__4120__Date__07_19_2008__Time_11_40_07PM__394__First chance exception 0XC0000005.dmp the assembly instruction at php5ts!_zend_mm_free_int+35f in C:\Ecoweb\apps\PHP\php5ts.dll from The PHP Group has caused an access violation exception (0xC0000005) when trying to read from memory location 0x00000000 on thread 8

Module Information 
Image Name: C:\Ecoweb\apps\PHP\php5ts.dll   Symbol Type:  PDB 
Base address: 0x01c00000   Time Stamp:  Sat May 03 00:01:47 2008  
Checksum: 0x00000000   Comments:   
COM DLL: False   Company Name:  The PHP Group 
ISAPIExtension: False   File Description:  PHP Script Interpreter 
ISAPIFilter: False   File Version:  5.2.6.6 
Managed DLL: False   Internal Name:  php5ts.dll 
VB DLL: False   Legal Copyright:  Copyright ? 1997-2007 The PHP Group 
Loaded Image Name:  php5ts.dll   Legal Trademarks:  PHP 
Mapped Image Name:  C:\Ecoweb\apps\PHP\php5ts.dll   Original filename:  php5ts.dll 
Module name:  php5ts   Private Build:   
Single Threaded:  False   Product Name:  PHP Script Interpreter 
Module Size:  4,93 MBytes   Product Version:  5.2.6 
Symbol File Name:  C:\Ecoweb\apps\php-dbgpack\php5ts.pdb   Special Build:  &

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports

[2008-07-19 23:42 UTC] jan at ecotech dot se

FYI: I installed todays snap of 5.3 and I couldn't seem to reproduce the error.

[2008-07-19 23:48 UTC] jan at ecotech dot se

Why didn't I keep my mouth shut. Same error with 5.3.0-200807200030 - different script. 


Backtrace:

In httpd__PID__5520__Date__07_20_2008__Time_01_45_30AM__408__Second_Chance_Exception_C0000005.dmp the assembly instruction at php5ts!gc_zval_possible_root+67 in C:\Ecoweb\apps\php53\php5ts.dll from The PHP Group has caused an access violation exception (0xC0000005) when trying to read from memory location 0x00000000 on thread 2


Type of Analysis Performed   Crash Analysis 
Machine Name   TJOCKIS 
Operating System   Windows Vista Service Pack 1 
Number Of Processors   2 
Process ID   5520 
Process Image   C:\Ecoweb\apps\Apache2.2\bin\httpd.exe 
System Up-Time   04:15:19 
Process Up-Time   00:00:09 


Thread 2 - System ID 2820
Entry point   msvcrt!_endthreadex+6f 
Create time   2008-07-20 01:45:23 
Time spent in user mode   0 Days 0:0:0.671 
Time spent in kernel mode   0 Days 0:0:0.437 






Function     Arg 1     Arg 2     Arg 3   Source 
php5ts!gc_zval_possible_root+67     04b99a00     0282b838     04b9f888    
php5ts!_zval_ptr_dtor+91     04b9f83c     04b9f9d8     04b9f610    
php5ts!zend_hash_destroy+27     04b9f630     04b9f9e4     01c9af77    
php5ts!_zval_dtor_func+58     04b9f610     04b9fd18     01ca09c7    
php5ts!_zval_ptr_dtor+57     04b9f9e4     04b9f1f0     04b9ce10    
php5ts!zend_hash_destroy+27     04b9cd88     04b9f1fc     01c9af77    
php5ts!_zval_dtor_func+58     04b9ce10     04ba4b90     01ca09c7    
php5ts!_zval_ptr_dtor+57     04b9f1fc     00000f50     04b999c8    
php5ts!zend_hash_destroy+27     04b99858     04b999c8     01cbe030    
php5ts!zend_object_std_dtor+2b     04b999c8     0282b838     0282b838    
php5ts!zend_objects_free_object_storage+10     04b999c8     0282b838     fffffffc    
php5ts!zend_objects_store_free_object_storage+9f     0286ee24     0282b838     769d9d32    
php5ts!shutdown_executor+396     0282b838     0282b838     000000a8    
php5ts!zend_deactivate+90     0282b838     00d94a10     0282b838    
php5ts!php_request_shutdown+2cf     00000000     001335e6     00dd6800    
php5apache2_2!php_apache_request_dtor+8     00dd6800     0282b838     00000004    
php5apache2_2!php_handler+646     00dd6800     00d94a10     00dd6800    
libhttpd!ap_run_handler+21     00dd6800     00dd6800     00dd6800    
libhttpd!ap_invoke_handler+ae     00000000     028525f8     00eaff00    
libhttpd!ap_die+24e     00dd6800     00000000     00dc36a0    
libhttpd!ap_get_request_note+1c9c     028525f8     028525f8     028525f8    
libhttpd!ap_run_process_connection+21     028525f8     00d04c80     00eaff48    
libhttpd!ap_process_connection+33     028525f8     00dce7f0     00000000    
libhttpd!ap_regkey_value_remove+c7c     028525f0     41ffc081     00000000    
msvcrt!_endthreadex+44     00eaff94     76b64911     02845590    
msvcrt!_endthreadex+ce     02845590     00eaffd4     76eee4b6    
kernel32!BaseThreadInitThunk+e     02845590     76f431ca     00000000    
ntdll!__RtlUserThreadStart+23     769e2da8     02845590     00000000    
ntdll!_RtlUserThreadStart+1b     769e2da8     02845590     00000000    




PHP5TS!GC_ZVAL_POSSIBLE_ROOT+67In httpd__PID__5520__Date__07_20_2008__Time_01_45_30AM__408__Second_Chance_Exception_C0000005.dmp the assembly instruction at php5ts!gc_zval_possible_root+67 in C:\Ecoweb\apps\php53\php5ts.dll from The PHP Group has caused an access violation exception (0xC0000005) when trying to read from memory location 0x00000000 on thread 2

[2008-07-19 23:49 UTC] jan at ecotech dot se

Updated the version in the report to 5.2.6 && 5.3.0-20080720-0030.

[2008-07-20 00:14 UTC] jan at ecotech dot se

final info - both are clean installations. Only activated modules were: mysqli and gettext.

[2008-07-20 10:51 UTC] johannes@php.net

Thank you for this bug report. To properly diagnose the problem, we
need a short but complete example script to be able to reproduce
this bug ourselves. 

A proper reproducing script starts with <?php and ends with ?>,
is max. 10-20 lines long and does not require any external 
resources such as databases, etc. If the script requires a 
database to demonstrate the issue, please make sure it creates 
all necessary tables, stored procedures etc.

Please avoid embedding huge scripts into the report.

Your backtrace shows you're executing some code ....

[2008-07-21 09:35 UTC] jan at ecotech dot se

Unfortunately I am not able to reproduce the code... I switched back to 5.2.6 and error stopped occuring. I'll repost if as soon as I find anything :|

[2008-07-21 17:31 UTC] jani@php.net

Get back when you have a short reproducing script.

	php.net \| support \| documentation \| report a bug \| advanced search \| search howto \| statistics \| random bug \| login
go to bug id or search bugs for


Copyright © 2001-2025 The PHP Group All rights reserved.	Last updated: Sat Nov 29 17:00:01 2025 UTC