php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #6836 PHP crashes on specific use of arrays (example script)
Submitted: 2000-09-21 18:25 UTC Modified: 2000-11-01 02:50 UTC
From: mail at andreas-schmitz dot de Assigned:
Status: Closed Package: Reproducible Crash
PHP Version: 4.0.2 OS: linux 2.2.13
Private report: No CVE-ID: None
View Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
If you reported this bug, you can edit this bug over here.
(description)
Block user comment
Status: Assign to:
Package:
Bug Type:
Summary:
From: mail at andreas-schmitz dot de
New email:
PHP Version: OS:

 

 [2000-09-21 18:25 UTC] mail at andreas-schmitz dot de
If I use the script below and push the
refreshbutton of my browser several times
Apache generate a segfault.
I think this is a problem with arrays in PHP.

<gdb> run -DSSL -X
Starting program: /usr/local/apache/bin/httpd -X -DSSL
(no debugging symbols found)
((now, I am pushing the refreshbutton in my netscape several times))
Program received signal SIGSEGV, Segmentation fault.
0x4048598c in chunk_free (ar_ptr=0x4051dba0, p=0x835edb0) at malloc.c:3055
3055    malloc.c: No such file or directory.
<gdb> bt
#0  0x4048598c in chunk_free (ar_ptr=0x4051dba0, p=0x835edb0) at malloc.c:3055
#1  0x40485807 in __libc_free (mem=0x835edb8) at malloc.c:2967
#2  0x80e0b80 in php_ob_get_length ()
#3  0x80e06fe in php_body_write ()
#4  0x8081182 in php_request_shutdown ()
#5  0x81000d5 in zend_print_zval_ex ()
#6  0x8100050 in zend_print_zval ()
#7  0x80ffa98 in zend_print_variable ()
#8  0x8135a29 in execute ()
#9  0x8100d84 in zend_execute_scripts ()
#10 0x8081def in php_execute_script ()
#11 0x810f2ec in apache_php_module_main ()
#12 0x807ed46 in send_php ()
#13 0x807ed7e in send_parsed_php ()
#14 0x81844c9 in ap_invoke_handler ()
#15 0x8198d3f in ap_some_auth_required ()
#16 0x8198daa in ap_process_request ()
#17 0x818fef6 in ap_child_terminate ()
#18 0x81900d1 in ap_child_terminate ()
#19 0x819024c in ap_child_terminate ()
#20 0x81908ad in ap_child_terminate ()
#21 0x81910fc in main ()
#22 0x40441313 in __libc_start_main (main=0x8190d44 <main>, argc=3,
    argv=0xbffff834, init=0x807cf30 <_init>, fini=0x822cfb4 <_fini>,
    rtld_fini=0x4000ac70 <_dl_fini>, stack_end=0xbffff82c)
    at ../sysdeps/generic/libc-start.c:90


Here ist die php script, which produce the crash:

<?PHP
function test($arResult)
{

  // In this function, we build an array.

  $arResult=array("DOMAIN_ID"=>array(1,2,3,4,5,6,7,8,9,10,
			11,12,13,14,15,16,17,18,19,20,
			21,22,23,24,25,26,27,28,29,30,
			31,32,33,34,35,36,37,38,39,30,
			41,42,43,44,45,46,47,48,49,50),
		 "FQDN"=>array("andreas.de","schmitz.de","test.de","2","3",
		  	"1andreas.de","1schmitz.de","1test.de","12","13",
			"2andreas.de","2schmitz.de","2test.de","22","23",
			"3andreas.de","3schmitz.de","3test.de","32","33",
			"4andreas.de","4schmitz.de","4test.de","42","43",
			"5andreas.de","5schmitz.de","5test.de","52","53",
			"6andreas.de","6schmitz.de","6test.de","62","63",
			"7andreas.de","7schmitz.de","7test.de","72","73",
			"8andreas.de","8schmitz.de","8test.de","82","83",
			"8andreas.de","8schmitz.de","8test.de","82","83"));
	return true;
}

?>
<HTML>
<!-- CREATION DATE: 11.09.2000 -->
<HEAD>
<TITLE>test</TITLE>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
</HEAD>
<BODY>
<?PHP
	
  echo "<CENTER>
    <FORM ACTION=\"test.php?".SID."\" METHOD=POST>
      <INPUT TYPE=\"hidden\" NAME=\"cSearch\" VALUE=$cSearch>
       <table>";
			  
	  // Get the arry in $arResult
	  $ret=test(&$arResult);
	  if ($ret)
	  {
	     $arFqdn = $arResult[FQDN];
	     $arDomain_id = $arResult[DOMAIN_ID];
	     $iMaxFqdn = sizeof($arFqdn);
					
	     echo "<TR>
	       <TH>&nbsp;</TH>
	       <TH ALIGN=LEFT>Domain:</TH>
	       </TR>\n";
					
	       for ($i=0;$i < $iMaxFqdn;$i++)
	       {
		echo "<TR>";
		echo "<TD> <INPUT TYPE=\"checkbox\" 								   NAME=\"bDelete_$i\" 
		                  VALUE=$arDomain_id[$i]>
                      </TD>";
		if (1 == $i%2)
		{
		 echo "<TD bgcolor=\"#EEEEEE\">";
		}
		else
		{
		 echo "<TD bgcolor=\"#FFFFFF\">";
		}
		
		// If you replace the following echo funktion with:
		//
		//    echo "</TD></TR>\n";
		//
		// there isn't any problem. If you leave this
		// echo function, there is a notice in te error_log
		// of the apache:
		//    [notice] child pid x exit signal segmentation fault
		//             (11)
		//
		// The below echo function access the array
		
		echo "<font face=\"Arial, Helvetica\" color=\"#ff0000\">
		      <A HREF=\"dom_zone.php?iDomain_id=$arDomain_id[$i]\">$arFqdn[$i]</A>
		      <BR></font></TD></TR>\n";
	      }  
	}
		
			
	echo "</table>
	      <INPUT TYPE=\"submit\" 
	   	     VALUE=\"Ausgew&auml;hlte Domains l&ouml;schen\">";
    echo "</FORM>
    </CENTER>";
	
	
?>
</BODY>
</HTML>



-- PHPinfo (short)

PHP Version 4.0.2

System Linux andy 2.2.13 #1 Mon Nov 8 15:51:29 CET 1999 i686 unknown 
Build Date Sep 20 2000 
Configure Command './configure' '--with-oci8' 
		   '--with-apache=/usr/downloads/apache_1.3.12' 
		   '--enable-track-vars' '--enable-sigchild' 
		   '--enable-debug' '--with-mm=/usr/local/mm' 
		   '--enable-sysvsem' '--enable-sysvshm' 
		   '--disable-magic-quotes' '--enable-trans-sid' 
		   '--with-mysql=no' 
Server API Apache 
Virtual Directory Support disabled 
Configuration File (php.ini) Path /usr/local/lib 
ZEND_DEBUG enabled 
Thread Safety disabled

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2000-11-01 02:50 UTC] andi@php.net
This doesn't crash for me. Please try 4.0.3pl1 (or the latest snapshot from snaps.php.net). If it still happens then reopen a bug report with a shorter reproducing script.
Thanks
 
PHP Copyright © 2001-2026 The PHP Group
All rights reserved.
Last updated: Tue Oct 13 02:00:01 2026 UTC