php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #6558 corrupted/wrong pointer with --trans-sid
Submitted: 2000-09-05 14:18 UTC Modified: 2000-10-12 08:15 UTC
From: Andreas dot Schultz at eastlink dot de Assigned:
Status: Closed Package: Reproducible Crash
PHP Version: 4.0 Latest CVS (05/09/2000) OS: Linux / SuSE 6.4
Private report: No CVE-ID: None
View Developer Edit
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: Andreas dot Schultz at eastlink dot de
New email:
PHP Version: OS:

 

 [2000-09-05 14:18 UTC] Andreas dot Schultz at eastlink dot de 
Hi,

The rewritting of URL's contained in a large (about 5k) echo ".." statement causes the engine to SegFault in free(). The problem can be forced by setting MALLOC_CHECK_=2 in the environment. 

Apache error_log shows multiple with MALLOC_CHECK:
free(): invalid pointer xxxxx!

System used:
SuSE 6.4, Linux 2.4.0-test7, glibc-2.1.2, gcc 2.95.2

gdb backtrace with MALLOC_CHECK:
(gdb) bt
#0  0x400d2a71 in __kill () from /lib/libc.so.6
#1  0x400d2745 in raise () at ../sysdeps/posix/raise.c:28
#2  0x400d3e0f in abort () at ../sysdeps/generic/abort.c:139
#3  0x40107606 in free_check (mem=0x8541498, caller=0x4027e4ee) at malloc.c:4520
#4  0x401056df in free () at malloc.c:2952
#5  0x4027e4ee in php_ub_body_write_no_header (
    str=0x853702c "\n<HTML> \n  <HEAD>\n        <LINK REL=\"stylesheet\" HREF=\"/css/standard.css\" TITLE=\"standardcss\"> \n    <TITLE>Freie Presse Online - Support Server</TITLE>\n    <META NAME=\"author\" CONTENT=\"EastLink WEB Se"..., str_length=5599) at output.c:350
#6  0x4027de18 in php_body_write () at output.c:53
#7  0x401f7ee3 in php_body_write_wrapper (
    str=0x853702c "\n<HTML> \n  <HEAD>\n        <LINK REL=\"stylesheet\" HREF=\"/css/standard.css\" TITLE=\"standardcss\"> \n    <TITLE>Freie Presse Online - Support Server</TITLE>\n    <META NAME=\"author\" CONTENT=\"EastLink WEB Se"..., str_length=5599) at main.c:691
#8  0x401e658c in zend_print_zval_ex () at zend.c:115
#9  0x401e650c in zend_print_zval () at zend.c:115
#10 0x401e6001 in zend_print_variable () at zend_variables.c:157
#11 0x401d170b in execute () at ./zend_execute.c:876
#12 0x401d672a in execute () at ./zend_execute.c:876
#13 0x401d672a in execute () at ./zend_execute.c:876
#14 0x401e7486 in zend_execute_scripts () at zend.c:246
#15 0x401f8c44 in php_execute_script () at main.c:1096
#16 0x401f4f93 in apache_php_module_main () at sapi_apache.c:95
#17 0x401f59e9 in send_php () at mod_php4.c:430
#18 0x401f5a33 in send_parsed_php () at mod_php4.c:430                                                                                   


without MALLOC_CHECK:

#0  0x401058b0 in chunk_free (ar_ptr=0x401901a0, p=0x8504d20) at malloc.c:3111
#1  0x4010573f in free () at malloc.c:2952
#2  0x4027e4ee in php_ub_body_write_no_header (
    str=0x82310ac "\n<HTML> \n  <HEAD>\n        <LINK REL=\"stylesheet\" HREF=\"/css/standard.css\" TITLE=\"standardcss\"> \n    <TITLE>F
reie Presse Online - Support Server</TITLE>\n    <META NAME=\"author\" CONTENT=\"EastLink WEB Se"..., str_length=5602) at output.c:350
#3  0x4027de18 in php_body_write () at output.c:53
#4  0x401f7ee3 in php_body_write_wrapper (
    str=0x82310ac "\n<HTML> \n  <HEAD>\n        <LINK REL=\"stylesheet\" HREF=\"/css/standard.css\" TITLE=\"standardcss\"> \n    <TITLE>F

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2000-09-20 10:11 UTC] sas@php.net 
Let us know whether the latest checkout works for you, we have a new scanner now.
 [2000-10-12 08:15 UTC] sniper@php.net 
This should be fixed in PHP 4.0.3

--Jani
 
PHP Copyright © 2001-2026 The PHP Group
All rights reserved. 		Last updated: Tue Oct 13 10:00:02 2026 UTC