php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #5898 php crashes trying to estrdup nonexistant environment variables
Submitted: 2000-08-01 14:25 UTC Modified: 2000-08-04 12:11 UTC
From: Mario dot Lorenz at geyer dot kabeljournal dot de Assigned:
Status: Closed Package: Reproducible Crash
PHP Version: 4.0.1pl2 OS: Linux, RedHat 6.1
Private report: No CVE-ID: None
 [2000-08-01 14:25 UTC] Mario dot Lorenz at geyer dot kabeljournal dot de
This is plain 4.0.1pl2 in CGI mode on a RedHat 6.1 (patched up) sytem, however with Apache 1.3.3 (admitted, its oldish).
Setup is plain ./configure without any further options.

Whenever trying run a php4 script on that machine, php crashes (and httpd displays the preliminary end of script
error message).

Researching the problem showed:

It crashes in zend_alloc.c:289 (_estrdup)
called by cgi_main Line 632 trying to estrdup the PATH_TRANSLATED environment variable. Since that environment
variable is not set (this part I blame to my old apache)
it tries to strlen(0) (as thats what was returned by getenv)
and therefore segfaults.

Verified that by putting a wrapper around the scrip that would set the PATH_TRANSLATED variable, and voila, all went OK.

While I admit that in part this problem is caused by
the old apache, I also hold that no program should ever segfault, in particularly no attack-exposed program like
PHP.


Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2000-08-04 12:11 UTC] stas@php.net
CGI specs explicitly state PATH_TRANSLATED should be present in CGI. That means your apache is broken. Please upgrade.
 
PHP Copyright © 2001-2026 The PHP Group
All rights reserved.
Last updated: Sat Oct 10 22:00:02 2026 UTC