php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #13238 Reproducible segfault on large page using objects and expat
Submitted: 2001-09-10 17:04 UTC Modified: 2002-06-18 18:50 UTC
From: jeichorn at joshuaeichorn dot com Assigned:
Status: Not a bug Package: Reproducible crash
PHP Version: 4.0CVS-2001-09-10 OS: Linux 2.4.5-0.4
Private report: No CVE-ID: None
 [2001-09-10 17:04 UTC] jeichorn at joshuaeichorn dot com
I have a reproducible segfault involving a large project I am working on.  I don't currently have a reduced test case, but i'm trying to get one.  I'll attach the backtrace to the bug.

I'm also seeing similar errors on other systems using the same php code library, only they are unreproducible.

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2001-09-10 17:06 UTC] jeichorn at joshuaeichorn dot com
Php was compiled with  
./configure --with-apache=../apache_1.3.20 --enable-debug

Program received signal SIGSEGV, Segmentation fault.
0x080cede0 in call_user_function_ex (function_table=0x820f968, object_pp=0x0, function_name=0x417, retval_ptr_ptr=0xbfffc6cc, 
    param_count=2, params=0xbfffc6d0, no_separation=0, symbol_table=0x0) at zend_execute_API.c:394
394		if (function_name->type==IS_ARRAY) { /* assume array($obj, $name) couple */
(gdb) bt
#0  0x080cede0 in call_user_function_ex (function_table=0x820f968, object_pp=0x0, function_name=0x417, retval_ptr_ptr=0xbfffc6cc, 
    param_count=2, params=0xbfffc6d0, no_separation=0, symbol_table=0x0) at zend_execute_API.c:394
#1  0x0810d4c6 in php_array_walk (target_hash=0x86fc474, userdata=0x0) at array.c:977
#2  0x0810d682 in zif_array_walk (ht=2, return_value=0x82e9654, this_ptr=0x0, return_value_used=0) at array.c:1023
#3  0x080be477 in execute (op_array=0x86d896c) at ./zend_execute.c:1590
#4  0x080cf3be in call_user_function_ex (function_table=0x86f0c70, object_pp=0x82e96f0, function_name=0x82e9614, 
    retval_ptr_ptr=0xbfffccbc, param_count=2, params=0xbfffccc0, no_separation=0, symbol_table=0x0) at zend_execute_API.c:511
#5  0x0810d4c6 in php_array_walk (target_hash=0x86fbd1c, userdata=0x0) at array.c:977
#6  0x0810d682 in zif_array_walk (ht=2, return_value=0x82e9594, this_ptr=0x0, return_value_used=0) at array.c:1023
#7  0x080be477 in execute (op_array=0x85bc83c) at ./zend_execute.c:1590
#8  0x080cf3be in call_user_function_ex (function_table=0x85bd000, object_pp=0x82e8ff8, function_name=0x82e9044, 
    retval_ptr_ptr=0xbfffd2ac, param_count=2, params=0xbfffd2b0, no_separation=0, symbol_table=0x0) at zend_execute_API.c:511
#9  0x0810d4c6 in php_array_walk (target_hash=0x82e7b84, userdata=0x0) at array.c:977
#10 0x0810d682 in zif_array_walk (ht=2, return_value=0x82e9104, this_ptr=0x0, return_value_used=0) at array.c:1023
#11 0x080be477 in execute (op_array=0x831d504) at ./zend_execute.c:1590
#12 0x080cf3be in call_user_function_ex (function_table=0x8321600, object_pp=0x82e86f8, function_name=0x82e855c, 
    retval_ptr_ptr=0xbfffd89c, param_count=2, params=0xbfffd8a0, no_separation=0, symbol_table=0x0) at zend_execute_API.c:511
#13 0x0810d4c6 in php_array_walk (target_hash=0x867f63c, userdata=0x0) at array.c:977
#14 0x0810d682 in zif_array_walk (ht=2, return_value=0x82e8744, this_ptr=0x0, return_value_used=0) at array.c:1023
#15 0x080be477 in execute (op_array=0x83204c4) at ./zend_execute.c:1590
#16 0x080be64b in execute (op_array=0x8320f4c) at ./zend_execute.c:1630
#17 0x080be64b in execute (op_array=0x83073ac) at ./zend_execute.c:1630
#18 0x080be64b in execute (op_array=0x824522c) at ./zend_execute.c:1630
#19 0x080b2e6a in zend_execute_scripts (type=8, retval=0x0, file_count=3) at zend.c:809
#20 0x08080dce in php_execute_script (primary_file=0xbffff570) at main.c:1310
#21 0x0807c0d6 in apache_php_module_main (r=0x823bc34, display_source_mode=0) at sapi_apache.c:90
#22 0x0807a93c in send_php () at eval.c:41
---Type <return> to continue, or q <return> to quit---
#23 0x0807a995 in send_parsed_php () at eval.c:41
#24 0x08157bc7 in ap_invoke_handler () at eval.c:41
#25 0x0816b9b3 in process_request_internal () at eval.c:41
#26 0x0816ba14 in ap_process_request () at eval.c:41
#27 0x08162e65 in child_main () at eval.c:41
#28 0x08163010 in make_child () at eval.c:41
#29 0x08163184 in startup_children () at eval.c:41
#30 0x081637d7 in standalone_main () at eval.c:41
#31 0x08163fff in main () at eval.c:41
#32 0x400cc7c7 in __libc_start_main (main=0x8163c60 <main>, argc=2, ubp_av=0xbffff9a4, init=0x8062b18 <_init>, 
    fini=0x8191d00 <_fini>, rtld_fini=0x4000db74 <_dl_fini>, stack_end=0xbffff99c) at ../sysdeps/generic/libc-start.c:129

 [2001-09-10 17:26 UTC] jeichorn at joshuaeichorn dot com
Looking at backtrace i noticed array_walk, and since my script an array walk to run macro functions on a group of objects i looked into the code.  After rewriting the code to no longer use array_walk, the segfault went away.

Below is the array_walk code, but it works most of the time, only in certain situations do segfaults happen.

I'm sorry i can't give you more helpful information.

macroTransverse is called from the base object in the stack by

reset($this->store);    array_walk($this->store,array($this,"macroTransverse"));

This is a method on a base object, that multiple other objects extend from.
function macroTransverse (&$obj,$key)
        {
                if ($this->isSlate($obj))
                {
                        if (is_object($obj))
                        {
                                $obj->macro();
                        }
                        if (!empty($obj->store))
                        {
                                if (is_array($obj->store))
                                {
                                        reset($obj->store);
                                        array_walk($obj->store,array($obj,"macroTransverse"));
                                        reset($obj->store);
                                }
                        }
                }
        }
 [2001-11-20 05:21 UTC] sniper@php.net
Does this happen with PHP 4.1.0RC3 ?

http://download.php.net/~zeev/php-4.1.0RC3.tar.gz
 [2001-12-02 04:37 UTC] sander@php.net
No feedback. It's probably a dupe of #11389.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Sun May 05 21:01:30 2024 UTC