Reproduced under 4.0.6RC3. I get segfault with this.

When I generate some hex-color code the outcome is fare from expected. The best way to
explain it would be by an example:
  http://www.edimag.dk/bug/backup_index.php
and the source:
  http://www.edimag.dk/bug/backup_index.phps

My compile command:
'./configure' '--with-apxs=/usr/local/apache/bin/apxs' '--with-mysql=/usr'
'--enable-trans-sid' '--with-gd' '--with-pdflib=/usr/local' '--with-ttf'
'--with-sybase=/usr/local/freetds/' '--with-jpeg'

(Update 2001-06-14: I tried it on a Linux 2.2.5 with PHP 4.0.4pl1 installed with the same error)

/watson

Here's the GDB backtrace I got:


Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 1024 (runnable)]
0x400de1c1 in __kill () from /lib/libc.so.6
(gdb) bt
#0  0x400de1c1 in __kill () from /lib/libc.so.6
#1  0x40693cf6 in _emalloc (size=1515870813, __zend_filename=0x40a4bfc8 "zend_operators.c", __zend_lineno=1028, 
    __zend_orig_filename=0x0, __zend_orig_lineno=0) at zend_alloc.c:163
#2  0x406af10b in concat_function (result=0xbfffdfec, op1=0x80e51c4, op2=0xbfffd638) at zend_operators.c:1028
#3  0x4069e735 in execute (op_array=0x8304dec) at ./zend_execute.c:1015
#4  0x406b33b0 in zend_execute_scripts (type=8, file_count=3) at zend.c:752
#5  0x406cbdb3 in php_execute_script (primary_file=0xbffff56c) at main.c:1206
#6  0x406c713e in apache_php_module_main (r=0x830fe2c, display_source_mode=0) at sapi_apache.c:89
#7  0x406c7ee9 in send_php (r=0x830fe2c, display_source_mode=0, filename=0x83118f4 "/www/apache/htdocs/11476.php")
    at mod_php4.c:536
#8  0x406c7f32 in send_parsed_php (r=0x830fe2c) at mod_php4.c:547
#9  0x80554f9 in ap_invoke_handler () at md4.c:255
#10 0x806a44f in process_request_internal () at md4.c:255
#11 0x806a4ba in ap_process_request () at md4.c:255
#12 0x8061306 in child_main () at md4.c:255
#13 0x80614e1 in make_child () at md4.c:255
#14 0x806165c in startup_children () at md4.c:255
#15 0x8061ccc in standalone_main () at md4.c:255
#16 0x806251c in main () at md4.c:255
#17 0x400d6c03 in __libc_start_main (main=0x8062164 <main>, argc=2, argv=0xbffff81c, init=0x804f3e0 <_init>, 
    fini=0x8099f94 <_fini>, rtld_fini=0x4000bbc0 <_dl_fini>, stack_end=0xbffff814)
    at ../sysdeps/generic/libc-start.c:92

I managed to reproduce it (and cut it down to 7 lines, take that as a challenge ;)

No fix yet, though - it's a bit of a complex issue.

This should be fixed in the latest CVS of PHP (4.0.7-dev). If the problem persists please let us know. Thanks.