php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #6836 PHP crashes on specific use of arrays (example script)
Submitted: 2000-09-21 18:25 UTC Modified: 2000-11-01 02:50 UTC
From: mail at andreas-schmitz dot de Assigned:
Status: Closed Package: Reproducible Crash
PHP Version: 4.0.2 OS: linux 2.2.13
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: mail at andreas-schmitz dot de
New email:
PHP Version: OS:

 

 [2000-09-21 18:25 UTC] mail at andreas-schmitz dot de
If I use the script below and push the
refreshbutton of my browser several times
Apache generate a segfault.
I think this is a problem with arrays in PHP.

<gdb> run -DSSL -X
Starting program: /usr/local/apache/bin/httpd -X -DSSL
(no debugging symbols found)
((now, I am pushing the refreshbutton in my netscape several times))
Program received signal SIGSEGV, Segmentation fault.
0x4048598c in chunk_free (ar_ptr=0x4051dba0, p=0x835edb0) at malloc.c:3055
3055    malloc.c: No such file or directory.
<gdb> bt
#0  0x4048598c in chunk_free (ar_ptr=0x4051dba0, p=0x835edb0) at malloc.c:3055
#1  0x40485807 in __libc_free (mem=0x835edb8) at malloc.c:2967
#2  0x80e0b80 in php_ob_get_length ()
#3  0x80e06fe in php_body_write ()
#4  0x8081182 in php_request_shutdown ()
#5  0x81000d5 in zend_print_zval_ex ()
#6  0x8100050 in zend_print_zval ()
#7  0x80ffa98 in zend_print_variable ()
#8  0x8135a29 in execute ()
#9  0x8100d84 in zend_execute_scripts ()
#10 0x8081def in php_execute_script ()
#11 0x810f2ec in apache_php_module_main ()
#12 0x807ed46 in send_php ()
#13 0x807ed7e in send_parsed_php ()
#14 0x81844c9 in ap_invoke_handler ()
#15 0x8198d3f in ap_some_auth_required ()
#16 0x8198daa in ap_process_request ()
#17 0x818fef6 in ap_child_terminate ()
#18 0x81900d1 in ap_child_terminate ()
#19 0x819024c in ap_child_terminate ()
#20 0x81908ad in ap_child_terminate ()
#21 0x81910fc in main ()
#22 0x40441313 in __libc_start_main (main=0x8190d44 <main>, argc=3,
    argv=0xbffff834, init=0x807cf30 <_init>, fini=0x822cfb4 <_fini>,
    rtld_fini=0x4000ac70 <_dl_fini>, stack_end=0xbffff82c)
    at ../sysdeps/generic/libc-start.c:90


Here ist die php script, which produce the crash:

<?PHP
function test($arResult)
{

  // In this function, we build an array.

  $arResult=array("DOMAIN_ID"=>array(1,2,3,4,5,6,7,8,9,10,
			11,12,13,14,15,16,17,18,19,20,
			21,22,23,24,25,26,27,28,29,30,
			31,32,33,34,35,36,37,38,39,30,
			41,42,43,44,45,46,47,48,49,50),
		 "FQDN"=>array("andreas.de","schmitz.de","test.de","2","3",
		  	"1andreas.de","1schmitz.de","1test.de","12","13",
			"2andreas.de","2schmitz.de","2test.de","22","23",
			"3andreas.de","3schmitz.de","3test.de","32","33",
			"4andreas.de","4schmitz.de","4test.de","42","43",
			"5andreas.de","5schmitz.de","5test.de","52","53",
			"6andreas.de","6schmitz.de","6test.de","62","63",
			"7andreas.de","7schmitz.de","7test.de","72","73",
			"8andreas.de","8schmitz.de","8test.de","82","83",
			"8andreas.de","8schmitz.de","8test.de","82","83"));
	return true;
}

?>
<HTML>
<!-- CREATION DATE: 11.09.2000 -->
<HEAD>
<TITLE>test</TITLE>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
</HEAD>
<BODY>
<?PHP
	
  echo "<CENTER>
    <FORM ACTION=\"test.php?".SID."\" METHOD=POST>
      <INPUT TYPE=\"hidden\" NAME=\"cSearch\" VALUE=$cSearch>
       <table>";
			  
	  // Get the arry in $arResult
	  $ret=test(&$arResult);
	  if ($ret)
	  {
	     $arFqdn = $arResult[FQDN];
	     $arDomain_id = $arResult[DOMAIN_ID];
	     $iMaxFqdn = sizeof($arFqdn);
					
	     echo "<TR>
	       <TH>&nbsp;</TH>
	       <TH ALIGN=LEFT>Domain:</TH>
	       </TR>\n";
					
	       for ($i=0;$i < $iMaxFqdn;$i++)
	       {
		echo "<TR>";
		echo "<TD> <INPUT TYPE=\"checkbox\" 								   NAME=\"bDelete_$i\" 
		                  VALUE=$arDomain_id[$i]>
                      </TD>";
		if (1 == $i%2)
		{
		 echo "<TD bgcolor=\"#EEEEEE\">";
		}
		else
		{
		 echo "<TD bgcolor=\"#FFFFFF\">";
		}
		
		// If you replace the following echo funktion with:
		//
		//    echo "</TD></TR>\n";
		//
		// there isn't any problem. If you leave this
		// echo function, there is a notice in te error_log
		// of the apache:
		//    [notice] child pid x exit signal segmentation fault
		//             (11)
		//
		// The below echo function access the array
		
		echo "<font face=\"Arial, Helvetica\" color=\"#ff0000\">
		      <A HREF=\"dom_zone.php?iDomain_id=$arDomain_id[$i]\">$arFqdn[$i]</A>
		      <BR></font></TD></TR>\n";
	      }  
	}
		
			
	echo "</table>
	      <INPUT TYPE=\"submit\" 
	   	     VALUE=\"Ausgew&auml;hlte Domains l&ouml;schen\">";
    echo "</FORM>
    </CENTER>";
	
	
?>
</BODY>
</HTML>



-- PHPinfo (short)

PHP Version 4.0.2

System Linux andy 2.2.13 #1 Mon Nov 8 15:51:29 CET 1999 i686 unknown 
Build Date Sep 20 2000 
Configure Command './configure' '--with-oci8' 
		   '--with-apache=/usr/downloads/apache_1.3.12' 
		   '--enable-track-vars' '--enable-sigchild' 
		   '--enable-debug' '--with-mm=/usr/local/mm' 
		   '--enable-sysvsem' '--enable-sysvshm' 
		   '--disable-magic-quotes' '--enable-trans-sid' 
		   '--with-mysql=no' 
Server API Apache 
Virtual Directory Support disabled 
Configuration File (php.ini) Path /usr/local/lib 
ZEND_DEBUG enabled 
Thread Safety disabled

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2000-11-01 02:50 UTC] andi@php.net
This doesn't crash for me. Please try 4.0.3pl1 (or the latest snapshot from snaps.php.net). If it still happens then reopen a bug report with a shorter reproducing script.
Thanks
 
PHP Copyright © 2001-2026 The PHP Group
All rights reserved.
Last updated: Tue Oct 13 02:00:01 2026 UTC