PHP :: Bug #33209 :: PHP crashes creating SWF with Ming

Bug #33209	PHP crashes creating SWF with Ming
Submitted:	2005-06-01 07:32 UTC	Modified:	2005-06-25 01:00 UTC
From:	jcruff at gmail dot com	Assigned:
Status:	No Feedback	Package:	Ming related
PHP Version:	5.0.3	OS:	Mac OS X 10.4.1 (Darwin 8.1.0)
Private report:	No	CVE-ID:	None

View Developer Edit

[2005-06-01 07:32 UTC] jcruff at gmail dot com

Description:
------------
PHP will crash if run as a DSO module or from CLI against the 
simple script below that uses the Ming library to create an SWF 
file.

Reproduce code:
---------------
<?php

// create new SWFMovie object
$myMovie = new SWFMovie();

// set size & background color attributes of movie object
$myMovie->setDimension(400,400);
$myMovie->setBackground(255,0,0);

$myMovie->save("mysquare.swf");

?>

Expected result:
----------------
When run under Apache the apache error log will say, "child pid 
##### exit signal Bus error (10)".  When from from CLI it just 
gives "bus error".  In either case a MAC OS X crash report is 
generated (shown below)

Actual result:
--------------
(gdb) run -X
Starting program: /usr/local/apache2/bin/httpd -X
Reading symbols for shared libraries . done
Reading symbols for shared libraries ... done
Reading symbols for shared libraries ....... done


Program received signal EXC_BAD_ACCESS, Could not access 
memory.
Reason: KERN_PROTECTION_FAILURE at address: 0x00000026
zend_hash_apply_with_argument (ht=0x12837d4, apply_func=0, 
argument=0x57b460) at /Users/fullstack/dlweskx/php-5.0.3/
Zend/zend_hash.c:680
680     /Users/fullstack/dlweskx/php-5.0.3/Zend/zend_hash.c: 
No such file or directory.
        in /Users/fullstack/dlweskx/php-5.0.3/Zend/
zend_hash.c
(gdb) 
(gdb) bt
#0  zend_hash_apply_with_argument (ht=0x12837d4, 
apply_func=0, argument=0x57b460) at /Users/fullstack/
dlweskx/php-5.0.3/Zend/zend_hash.c:680
#1  0x01123854 in _object_and_properties_init (arg=0x57b460, 
class_type=0x2ae2c0, properties=0x0) at /Users/fullstack/
dlweskx/php-5.0.3/Zend/zend_API.c:706
#2  0x0024e5fc in zif_swfmovie_init ()
#3  0x01146034 in zend_do_fcall_common_helper 
(execute_data=0xbfffddc0, opline=0x18bff40, 
op_array=0x57b500) at /Users/fullstack/dlweskx/php-5.0.3/
Zend/zend_execute.c:2711
#4  0x01142b90 in execute (op_array=0x57b500) at /Users/
fullstack/dlweskx/php-5.0.3/Zend/zend_execute.c:1400
#5  0x01121f50 in zend_execute_scripts (type=8, retval=0x0, 
file_count=3) at /Users/fullstack/dlweskx/php-5.0.3/Zend/
zend.c:1069
#6  0x010e8fa8 in php_execute_script 
(primary_file=0xbfffeb20) at /Users/fullstack/dlweskx/
php-5.0.3/main/main.c:1628
#7  0x0114e324 in php_handler (r=0x18b9c50) at /Users/
fullstack/dlweskx/php-5.0.3/sapi/apache2handler/
sapi_apache2.c:537
#8  0x00035f50 in ap_run_handler (r=0x18b9c50) at config.c:
152
#9  0x000366e0 in ap_invoke_handler (r=0x18b9c50) at 
config.c:363
#10 0x00011244 in ap_process_request (r=0x18b9c50) at 
http_request.c:246
#11 0x0000bf70 in ap_process_http_connection (c=0x18b5d28) 
at http_core.c:250
#12 0x0003cc88 in ap_run_process_connection (c=0x18b5d28) at 
connection.c:42
#13 0x00022860 in child_main (child_num_arg=0) at prefork.c:
609
#14 0x00022944 in make_child (s=0x180ab40, slot=0) at 
prefork.c:649
#15 0x00022a90 in startup_children (number_to_start=2) at 
prefork.c:721
#16 0x00022ee0 in ap_mpm_run (_pconf=0x0, plog=0x11161ec, 
s=0x180ab40) at prefork.c:940
#17 0x00024830 in main (argc=2, argv=0xbffff474) at main.c:
617
(gdb)

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports

[2005-06-04 01:08 UTC] sniper@php.net

Please try using this CVS snapshot:

  http://snaps.php.net/php5-latest.tar.gz
 
For Windows:
 
  http://snaps.php.net/win32/php5-win32-latest.zip

[2005-06-12 00:03 UTC] jcruff at gmail dot com

Cannot compile the latest version from CVS (200506112030).  
Compiling on Mac OS X 10.4.1 (Darwin 8.1.0); gcc 4.0.0 
(powerpc-apple-darwin8-gcc-4.0.0); Xcode 2.0.  Build error 
below:

/bin/sh /Users/techniq/Software/BUILD/php5-200506112030/
libtool --silent --preserve-dup-deps --mode=compile gcc  -
Iext/standard/ -I/Users/techniq/Software/BUILD/
php5-200506112030/ext/standard/ -DPHP_ATOM_INC -I/Users/
techniq/Software/BUILD/php5-200506112030/include -I/Users/
techniq/Software/BUILD/php5-200506112030/main -I/Users/
techniq/Software/BUILD/php5-200506112030 -I/usr/include/
libxml2 -I/Users/techniq/Software/BUILD/php5-200506112030/
TSRM -I/Users/techniq/Software/BUILD/php5-200506112030/Zend  
-no-cpp-precomp  -g -O2  -c /Users/techniq/Software/BUILD/
php5-200506112030/ext/standard/url_scanner_ex.c -o ext/
standard/url_scanner_ex.lo 
/Users/techniq/Software/BUILD/php5-200506112030/ext/
standard/url_scanner_ex.c: In function 
'append_modified_url':
/Users/techniq/Software/BUILD/php5-200506112030/ext/
standard/url_scanner_ex.c:110: error: parse error before 
"static"
/Users/techniq/Software/BUILD/php5-200506112030/ext/
standard/url_scanner_ex.c:152: error: 'yybm' undeclared 
(first use in this function)
/Users/techniq/Software/BUILD/php5-200506112030/ext/
standard/url_scanner_ex.c:152: error: (Each undeclared 
identifier is reported only once
/Users/techniq/Software/BUILD/php5-200506112030/ext/
standard/url_scanner_ex.c:152: error: for each function it 
appears in.)
/Users/techniq/Software/BUILD/php5-200506112030/ext/
standard/url_scanner_ex.c: In function 'xx_mainloop':
/Users/techniq/Software/BUILD/php5-200506112030/ext/
standard/url_scanner_ex.c:413: error: redefinition of 'yybm'
/Users/techniq/Software/BUILD/php5-200506112030/ext/
standard/url_scanner_ex.c:348: error: previous definition of 
'yybm' was here
/Users/techniq/Software/BUILD/php5-200506112030/ext/
standard/url_scanner_ex.c:485: error: redefinition of 'yybm'
/Users/techniq/Software/BUILD/php5-200506112030/ext/
standard/url_scanner_ex.c:413: error: previous definition of 
'yybm' was here
/Users/techniq/Software/BUILD/php5-200506112030/ext/
standard/url_scanner_ex.c:576: error: redefinition of 'yybm'
/Users/techniq/Software/BUILD/php5-200506112030/ext/
standard/url_scanner_ex.c:485: error: previous definition of 
'yybm' was here
/Users/techniq/Software/BUILD/php5-200506112030/ext/
standard/url_scanner_ex.c:645: error: redefinition of 'yybm'
/Users/techniq/Software/BUILD/php5-200506112030/ext/
standard/url_scanner_ex.c:576: error: previous definition of 
'yybm' was here
/Users/techniq/Software/BUILD/php5-200506112030/ext/
standard/url_scanner_ex.c:730: error: redefinition of 'yybm'
/Users/techniq/Software/BUILD/php5-200506112030/ext/
standard/url_scanner_ex.c:645: error: previous definition of 
'yybm' was here
make: *** [ext/standard/url_scanner_ex.lo] Error 1

[2005-06-12 00:06 UTC] jcruff at gmail dot com

The configure for the above build was simply:

./configure --prefix=/usr/local/php5-200506112030

[2005-06-12 01:52 UTC] jcruff at gmail dot com

Tried to compile php-5.1.0b1 and received the following 
build error:

gcc -bundle -bundle_loader /usr/local/apache2/bin/httpd -L/
usr/local/apache2/lib -L/usr/local/apache2/lib -laprutil-0 -
lexpat -liconv -L/usr/local/apache2/lib -lapr-0 -lresolv -
lpthread -g -O2   -L/usr/local/mysql/lib ext/libxml/libxml.o 
ext/zlib/zlib.o ext/zlib/zlib_fopen_wrapper.o ext/zlib/
zlib_filter.o ext/ctype/ctype.o ext/dom/php_dom.o ext/dom/
attr.o ext/dom/document.o ext/dom/domerrorhandler.o ext/dom/
domstringlist.o ext/dom/domexception.o ext/dom/namelist.o 
ext/dom/processinginstruction.o ext/dom/cdatasection.o ext/
dom/documentfragment.o ext/dom/domimplementation.o ext/dom/
element.o ext/dom/node.o ext/dom/string_extend.o ext/dom/
characterdata.o ext/dom/documenttype.o ext/dom/
domimplementationlist.o ext/dom/entity.o ext/dom/nodelist.o 
ext/dom/text.o ext/dom/comment.o ext/dom/domconfiguration.o 
ext/dom/domimplementationsource.o ext/dom/entityreference.o 
ext/dom/notation.o ext/dom/xpath.o ext/dom/dom_iterators.o 
ext/dom/typeinfo.o ext/dom/domerror.o ext/dom/domlocator.o 
ext/dom/namednodemap.o ext/dom/userdatahandler.o ext/iconv/
iconv.o ext/mysql/php_mysql.o ext/pcre/pcrelib/maketables.o 
ext/pcre/pcrelib/get.o ext/pcre/pcrelib/study.o ext/pcre/
pcrelib/pcre.o ext/pcre/php_pcre.o ext/pdo/pdo.o ext/pdo/
pdo_dbh.o ext/pdo/pdo_stmt.o ext/pdo/pdo_sql_parser.o ext/
pdo/pdo_sqlstate.o ext/pdo_sqlite/pdo_sqlite.o ext/
pdo_sqlite/sqlite_driver.o ext/pdo_sqlite/sqlite_statement.o 
ext/pdo_sqlite/sqlite/src/attach.o ext/pdo_sqlite/sqlite/
src/auth.o ext/pdo_sqlite/sqlite/src/btree.o ext/pdo_sqlite/
sqlite/src/build.o ext/pdo_sqlite/sqlite/src/date.o ext/
pdo_sqlite/sqlite/src/delete.o ext/pdo_sqlite/sqlite/src/
expr.o ext/pdo_sqlite/sqlite/src/func.o ext/pdo_sqlite/
sqlite/src/hash.o ext/pdo_sqlite/sqlite/src/insert.o ext/
pdo_sqlite/sqlite/src/legacy.o ext/pdo_sqlite/sqlite/src/
main.o ext/pdo_sqlite/sqlite/src/os_mac.o ext/pdo_sqlite/
sqlite/src/os_unix.o ext/pdo_sqlite/sqlite/src/os_win.o ext/
pdo_sqlite/sqlite/src/pager.o ext/pdo_sqlite/sqlite/src/
pragma.o ext/pdo_sqlite/sqlite/src/printf.o ext/pdo_sqlite/
sqlite/src/random.o ext/pdo_sqlite/sqlite/src/select.o ext/
pdo_sqlite/sqlite/src/table.o ext/pdo_sqlite/sqlite/src/
tokenize.o ext/pdo_sqlite/sqlite/src/trigger.o ext/
pdo_sqlite/sqlite/src/update.o ext/pdo_sqlite/sqlite/src/
utf.o ext/pdo_sqlite/sqlite/src/util.o ext/pdo_sqlite/
sqlite/src/vacuum.o ext/pdo_sqlite/sqlite/src/vdbeapi.o ext/
pdo_sqlite/sqlite/src/vdbeaux.o ext/pdo_sqlite/sqlite/src/
vdbe.o ext/pdo_sqlite/sqlite/src/vdbemem.o ext/pdo_sqlite/
sqlite/src/where.o ext/pdo_sqlite/sqlite/src/parse.o ext/
pdo_sqlite/sqlite/src/opcodes.o ext/pdo_sqlite/sqlite/src/
alter.o ext/pdo_sqlite/sqlite/src/experimental.o ext/posix/
posix.o ext/session/session.o ext/session/mod_files.o ext/
session/mod_mm.o ext/session/mod_user.o ext/simplexml/
simplexml.o ext/spl/php_spl.o ext/spl/spl_functions.o ext/
spl/spl_engine.o ext/spl/spl_iterators.o ext/spl/spl_array.o 
ext/spl/spl_directory.o ext/spl/spl_sxe.o ext/spl/
spl_exceptions.o ext/spl/spl_observer.o ext/sqlite/sqlite.o 
ext/sqlite/sess_sqlite.o ext/sqlite/pdo_sqlite2.o ext/
sqlite/libsqlite/src/opcodes.o ext/sqlite/libsqlite/src/
parse.o ext/sqlite/libsqlite/src/encode.o ext/sqlite/
libsqlite/src/auth.o ext/sqlite/libsqlite/src/btree.o ext/
sqlite/libsqlite/src/build.o ext/sqlite/libsqlite/src/
delete.o ext/sqlite/libsqlite/src/expr.o ext/sqlite/
libsqlite/src/func.o ext/sqlite/libsqlite/src/hash.o ext/
sqlite/libsqlite/src/insert.o ext/sqlite/libsqlite/src/
main.o ext/sqlite/libsqlite/src/os.o ext/sqlite/libsqlite/
src/pager.o ext/sqlite/libsqlite/src/printf.o ext/sqlite/
libsqlite/src/random.o ext/sqlite/libsqlite/src/select.o 
ext/sqlite/libsqlite/src/table.o ext/sqlite/libsqlite/src/
tokenize.o ext/sqlite/libsqlite/src/update.o ext/sqlite/
libsqlite/src/util.o ext/sqlite/libsqlite/src/vdbe.o ext/
sqlite/libsqlite/src/attach.o ext/sqlite/libsqlite/src/
btree_rb.o ext/sqlite/libsqlite/src/pragma.o ext/sqlite/
libsqlite/src/vacuum.o ext/sqlite/libsqlite/src/copy.o ext/
sqlite/libsqlite/src/vdbeaux.o ext/sqlite/libsqlite/src/
date.o ext/sqlite/libsqlite/src/where.o ext/sqlite/
libsqlite/src/trigger.o regex/regcomp.o regex/regexec.o 
regex/regerror.o regex/regfree.o ext/standard/array.o ext/
standard/base64.o ext/standard/basic_functions.o ext/
standard/browscap.o ext/standard/crc32.o ext/standard/
crypt.o ext/standard/cyr_convert.o ext/standard/datetime.o 
ext/standard/dir.o ext/standard/dl.o ext/standard/dns.o ext/
standard/exec.o ext/standard/file.o ext/standard/filestat.o 
ext/standard/flock_compat.o ext/standard/formatted_print.o 
ext/standard/fsock.o ext/standard/head.o ext/standard/html.o 
ext/standard/image.o ext/standard/info.o ext/standard/iptc.o 
ext/standard/lcg.o ext/standard/link.o ext/standard/mail.o 
ext/standard/math.o ext/standard/md5.o ext/standard/
metaphone.o ext/standard/microtime.o ext/standard/pack.o 
ext/standard/pageinfo.o ext/standard/parsedate.o ext/
standard/quot_print.o ext/standard/rand.o ext/standard/reg.o 
ext/standard/soundex.o ext/standard/string.o ext/standard/
scanf.o ext/standard/syslog.o ext/standard/type.o ext/
standard/uniqid.o ext/standard/url.o ext/standard/
url_scanner.o ext/standard/var.o ext/standard/versioning.o 
ext/standard/assert.o ext/standard/strnatcmp.o ext/standard/
levenshtein.o ext/standard/incomplete_class.o ext/standard/
url_scanner_ex.o ext/standard/ftp_fopen_wrapper.o ext/
standard/http_fopen_wrapper.o ext/standard/
php_fopen_wrapper.o ext/standard/credits.o ext/standard/
css.o ext/standard/var_unserializer.o ext/standard/ftok.o 
ext/standard/sha1.o ext/standard/user_filters.o ext/
standard/uuencode.o ext/standard/filters.o ext/standard/
proc_open.o ext/standard/sunfuncs.o ext/standard/
streamsfuncs.o ext/standard/http.o ext/tokenizer/tokenizer.o 
ext/xml/xml.o ext/xml/compat.o TSRM/TSRM.o TSRM/
tsrm_strtok_r.o TSRM/tsrm_virtual_cwd.o main/main.o main/
snprintf.o main/spprintf.o main/php_sprintf.o main/
safe_mode.o main/fopen_wrappers.o main/alloca.o main/
php_scandir.o main/php_ini.o main/SAPI.o main/rfc1867.o 
main/php_content_types.o main/strlcpy.o main/strlcat.o main/
mergesort.o main/reentrancy.o main/php_variables.o main/
php_ticks.o main/network.o main/php_open_temporary_file.o 
main/php_logos.o main/output.o main/streams/streams.o main/
streams/cast.o main/streams/memory.o main/streams/filter.o 
main/streams/plain_wrapper.o main/streams/userspace.o main/
streams/transports.o main/streams/xp_socket.o main/streams/
mmap.o Zend/zend_language_parser.o Zend/
zend_language_scanner.o Zend/zend_ini_parser.o Zend/
zend_ini_scanner.o Zend/zend_alloc.o Zend/zend_compile.o 
Zend/zend_constants.o Zend/zend_dynamic_array.o Zend/
zend_execute_API.o Zend/zend_highlight.o Zend/zend_llist.o 
Zend/zend_opcode.o Zend/zend_operators.o Zend/
zend_ptr_stack.o Zend/zend_stack.o Zend/zend_variables.o 
Zend/zend.o Zend/zend_API.o Zend/zend_extensions.o Zend/
zend_hash.o Zend/zend_list.o Zend/zend_indent.o Zend/
zend_builtin_functions.o Zend/zend_sprintf.o Zend/zend_ini.o 
Zend/zend_qsort.o Zend/zend_multibyte.o Zend/zend_ts_hash.o 
Zend/zend_stream.o Zend/zend_iterators.o Zend/
zend_interfaces.o Zend/zend_exceptions.o Zend/zend_strtod.o 
Zend/zend_objects.o Zend/zend_object_handlers.o Zend/
zend_objects_API.o Zend/zend_mm.o Zend/
zend_default_classes.o Zend/zend_reflection_api.o Zend/
zend_execute.o sapi/apache2handler/mod_php5.o sapi/
apache2handler/sapi_apache2.o sapi/apache2handler/
apache_config.o sapi/apache2handler/php_functions.o main/
internal_functions.o  -lmysqlclient -lz -lm -lxml2 -lz -
liconv -lm -lxml2 -lz -liconv -lm -lxml2 -lz -liconv -lm -
lxml2 -lz -liconv -lm  -o libs/libphp5.bundle && cp libs/
libphp5.bundle libs/libphp5.so
/usr/bin/ld: table of contents for archive: /usr/local/
apache2/lib/libaprutil-0.a is out of date; rerun ranlib(1) 
(can't load from it)
/usr/bin/ld: table of contents for archive: /usr/local/
apache2/lib/libexpat.a is out of date; rerun ranlib(1) 
(can't load from it)
/usr/bin/ld: table of contents for archive: /usr/local/
apache2/lib/libapr-0.a is out of date; rerun ranlib(1) 
(can't load from it)
/usr/bin/ld: warning multiple definitions of symbol 
_pcre_free
ext/pcre/pcrelib/pcre.o definition of _pcre_free in section 
(__DATA,__data)
/usr/local/apache2/bin/httpd definition of _pcre_free
/usr/bin/ld: warning multiple definitions of symbol 
_pcre_malloc
ext/pcre/pcrelib/pcre.o definition of _pcre_malloc in 
section (__DATA,__data)
/usr/local/apache2/bin/httpd definition of _pcre_malloc
/usr/bin/ld: warning multiple definitions of symbol _regcomp
/usr/local/apache2/bin/httpd definition of _regcomp
/usr/lib/gcc/powerpc-apple-darwin8/4.0.0/../../../
libpthread.dylib(regcomp.So) definition of _regcomp
/usr/bin/ld: warning multiple definitions of symbol _regexec
/usr/local/apache2/bin/httpd definition of _regexec
/usr/lib/gcc/powerpc-apple-darwin8/4.0.0/../../../
libpthread.dylib(regexec.So) definition of _regexec
/usr/bin/ld: warning multiple definitions of symbol _regfree
/usr/local/apache2/bin/httpd definition of _regfree
/usr/lib/gcc/powerpc-apple-darwin8/4.0.0/../../../
libpthread.dylib(regfree.So) definition of _regfree
collect2: ld returned 1 exit status
make: *** [libs/libphp5.bundle] Error 1

[2005-06-18 00:58 UTC] iliaa@php.net

Please try using this CVS snapshot:

  http://snaps.php.net/php5-latest.tar.gz
 
For Windows:
 
  http://snaps.php.net/win32/php5-win32-latest.zip

I see no errors on 5.1 with your code and valgrind also shows things as being "clean".

[2005-06-25 01:00 UTC] php-bugs at lists dot php dot net

No feedback was provided for this bug for over a week, so it is
being suspended automatically. If you are able to provide the
information that was originally requested, please do so and change
the status of the bug back to "Open".

	php.net \| support \| documentation \| report a bug \| advanced search \| search howto \| statistics \| random bug \| login
go to bug id or search bugs for


Copyright © 2001-2025 The PHP Group All rights reserved.	Last updated: Wed Jan 15 14:01:30 2025 UTC