php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #6558 corrupted/wrong pointer with --trans-sid
Submitted: 2000-09-05 14:18 UTC Modified: 2000-10-12 08:15 UTC
From: Andreas dot Schultz at eastlink dot de Assigned:
Status: Closed Package: Reproducible Crash
PHP Version: 4.0 Latest CVS (05/09/2000) OS: Linux / SuSE 6.4
Private report: No CVE-ID: None
View Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
If you reported this bug, you can edit this bug over here.
(description)
Block user comment
Status: Assign to:
Package:
Bug Type:
Summary:
From: Andreas dot Schultz at eastlink dot de
New email:
PHP Version: OS:

 

 [2000-09-05 14:18 UTC] Andreas dot Schultz at eastlink dot de 
Hi,

The rewritting of URL's contained in a large (about 5k) echo ".." statement causes the engine to SegFault in free(). The problem can be forced by setting MALLOC_CHECK_=2 in the environment. 

Apache error_log shows multiple with MALLOC_CHECK:
free(): invalid pointer xxxxx!

System used:
SuSE 6.4, Linux 2.4.0-test7, glibc-2.1.2, gcc 2.95.2

gdb backtrace with MALLOC_CHECK:
(gdb) bt
#0  0x400d2a71 in __kill () from /lib/libc.so.6
#1  0x400d2745 in raise () at ../sysdeps/posix/raise.c:28
#2  0x400d3e0f in abort () at ../sysdeps/generic/abort.c:139
#3  0x40107606 in free_check (mem=0x8541498, caller=0x4027e4ee) at malloc.c:4520
#4  0x401056df in free () at malloc.c:2952
#5  0x4027e4ee in php_ub_body_write_no_header (
    str=0x853702c "\n<HTML> \n  <HEAD>\n        <LINK REL=\"stylesheet\" HREF=\"/css/standard.css\" TITLE=\"standardcss\"> \n    <TITLE>Freie Presse Online - Support Server</TITLE>\n    <META NAME=\"author\" CONTENT=\"EastLink WEB Se"..., str_length=5599) at output.c:350
#6  0x4027de18 in php_body_write () at output.c:53
#7  0x401f7ee3 in php_body_write_wrapper (
    str=0x853702c "\n<HTML> \n  <HEAD>\n        <LINK REL=\"stylesheet\" HREF=\"/css/standard.css\" TITLE=\"standardcss\"> \n    <TITLE>Freie Presse Online - Support Server</TITLE>\n    <META NAME=\"author\" CONTENT=\"EastLink WEB Se"..., str_length=5599) at main.c:691
#8  0x401e658c in zend_print_zval_ex () at zend.c:115
#9  0x401e650c in zend_print_zval () at zend.c:115
#10 0x401e6001 in zend_print_variable () at zend_variables.c:157
#11 0x401d170b in execute () at ./zend_execute.c:876
#12 0x401d672a in execute () at ./zend_execute.c:876
#13 0x401d672a in execute () at ./zend_execute.c:876
#14 0x401e7486 in zend_execute_scripts () at zend.c:246
#15 0x401f8c44 in php_execute_script () at main.c:1096
#16 0x401f4f93 in apache_php_module_main () at sapi_apache.c:95
#17 0x401f59e9 in send_php () at mod_php4.c:430
#18 0x401f5a33 in send_parsed_php () at mod_php4.c:430                                                                                   


without MALLOC_CHECK:

#0  0x401058b0 in chunk_free (ar_ptr=0x401901a0, p=0x8504d20) at malloc.c:3111
#1  0x4010573f in free () at malloc.c:2952
#2  0x4027e4ee in php_ub_body_write_no_header (
    str=0x82310ac "\n<HTML> \n  <HEAD>\n        <LINK REL=\"stylesheet\" HREF=\"/css/standard.css\" TITLE=\"standardcss\"> \n    <TITLE>F
reie Presse Online - Support Server</TITLE>\n    <META NAME=\"author\" CONTENT=\"EastLink WEB Se"..., str_length=5602) at output.c:350
#3  0x4027de18 in php_body_write () at output.c:53
#4  0x401f7ee3 in php_body_write_wrapper (
    str=0x82310ac "\n<HTML> \n  <HEAD>\n        <LINK REL=\"stylesheet\" HREF=\"/css/standard.css\" TITLE=\"standardcss\"> \n    <TITLE>F

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2000-09-20 10:11 UTC] sas@php.net 
Let us know whether the latest checkout works for you, we have a new scanner now.
 [2000-10-12 08:15 UTC] sniper@php.net 
This should be fixed in PHP 4.0.3

--Jani
 
PHP Copyright © 2001-2026 The PHP Group
All rights reserved. 		Last updated: Tue Oct 13 12:00:02 2026 UTC