PHP :: Bug #38134 :: segfault while calling xslt

Bug #38134

segfault while calling xslt_process

Submitted:

2006-07-18 13:52 UTC

Modified:

2006-08-29 01:00 UTC

Votes:	1
Avg. Score:	5.0 ± 0.0
Reproduced:	1 of 1 (100.0%)
Same Version:	1 (100.0%)
Same OS:	1 (100.0%)

From:

gerome dot fournier at infomaniak dot ch

Assigned:

Status:

No Feedback

Package:

XSLT related

PHP Version:

4.4.2

OS:

Debian Sarge

Private report:

CVE-ID:

None

View Developer Edit

[2006-07-18 13:52 UTC] gerome dot fournier at infomaniak dot ch

Description:
------------
Making a simple xml transformation using xslt_process
gives from time to time a segfault. The  php code looks like this:

        $xmlFile = "file.xml";
        $xsl_url = "file.xsl";
        $result = xslt_process($xh, $xmlFile, $xsl_url);
        if ($result) {
                echo $result;
        } else {
                echo "Error";
        }
        xslt_free($xh);

I provide hereafter a backtrace after the segfault occured:

Program received signal SIGPIPE, Broken pipe.
[Switching to Thread -1209740000 (LWP 4068)]
0xb7f1f5e8 in writev () from /lib/tls/libc.so.6
(gdb) bt
#0  0xb7f1f5e8 in writev () from /lib/tls/libc.so.6
#1  0xb6db9cbf in ssl_io_hook_writev () from /opt/apache/libexec/libssl.so
#2  0xbf886f40 in ?? ()
#3  0x00000002 in ?? ()
#4  0x081228c4 in ?? ()
#5  0x00000000 in ?? ()
#6  0x00000017 in ?? ()
#7  0x00000000 in ?? ()
#8  0x00003908 in ?? ()
#9  0x081228c4 in ?? ()
#10 0x00000000 in ?? ()
#11 0x080cbd04 in ?? ()
#12 0x0807f4a7 in ap_hook_call_func ()
#13 0xb7979494 in sapi_send_headers () at /root/SOURCES/php4-debug/php-4.4.2/main/SAPI.c:813
#14 0xb7987c6e in php_ub_body_write_no_header (
    str=0x84413b4 "<html xmlns=\"http://www.w3.org/1999/xhtml\" lang=\"fr\" xml:lang=\"fr\">\n  <head>\n    <title>Protilab - gestion</title>\n    <style>\n\t\t\t\tbody {\n\t\t\t\t\tfont-family: tahoma;\n\t\t\t\t\tfont-size: 8pt;\n\t\t\t\t\tmargin-top"..., str_length=91404)
    at /root/SOURCES/php4-debug/php-4.4.2/main/output.c:692
#15 0xb7987d2f in php_ub_body_write (
    str=0x84413b4 "<html xmlns=\"http://www.w3.org/1999/xhtml\" lang=\"fr\" xml:lang=\"fr\">\n  <head>\n    <title>Protilab - gestion</title>\n    <style>\n\t\t\t\tbody {\n\t\t\t\t\tfont-family: tahoma;\n\t\t\t\t\tfont-size: 8pt;\n\t\t\t\t\tmargin-top"..., str_length=91404)
    at /root/SOURCES/php4-debug/php-4.4.2/main/output.c:725
#16 0xb798702d in php_end_ob_buffer (send_buffer=1 '\001', just_flush=1 '\001') at /root/SOURCES/php4-debug/php-4.4.2/main/output.c:302
#17 0xb7988979 in php_ob_append (
    text=0x83c6f24 "<html xmlns=\"http://www.w3.org/1999/xhtml\" lang=\"fr\" xml:lang=\"fr\">\n  <head>\n    <title>Protilab - gestion</title>\n    <style>\n\t\t\t\tbody {\n\t\t\t\t\tfont-family: tahoma;\n\t\t\t\t\tfont-size: 8pt;\n\t\t\t\t\tmargin-top"..., text_length=91404)
    at /root/SOURCES/php4-debug/php-4.4.2/main/output.c:619
#18 0xb7987c3d in php_b_body_write (
    str=0x83c6f24 "<html xmlns=\"http://www.w3.org/1999/xhtml\" lang=\"fr\" xml:lang=\"fr\">\n  <head>\n    <title>Protilab - gestion</title>\n    <style>\n\t\t\t\tbody {\n\t\t\t\t\tfont-family: tahoma;\n\t\t\t\t\tfont-size: 8pt;\n\t\t\t\t\tmargin-top"..., str_length=91404)
    at /root/SOURCES/php4-debug/php-4.4.2/main/output.c:678
#19 0xb79868ad in php_body_write (
    str=0x83c6f24 "<html xmlns=\"http://www.w3.org/1999/xhtml\" lang=\"fr\" xml:lang=\"fr\">\n  <head>\n    <title>Protilab - gestion</title>\n    <style>\n\t\t\t\tbody {\n\t\t\t\t\tfont-family: tahoma;\n\t\t\t\t\tfont-size: 8pt;\n\t\t\t\t\tmargin-top"..., str_length=91404)
    at /root/SOURCES/php4-debug/php-4.4.2/main/output.c:121
#20 0xb797090b in php_body_write_wrapper (
    str=0x83c6f24 "<html xmlns=\"http://www.w3.org/1999/xhtml\" lang=\"fr\" xml:lang=\"fr\">\n  <head>\n    <title>Protilab - gestion</title>\n    <style>\n\t\t\t\tbody {\n\t\t\t\t\tfont-family: tahoma;\n\t\t\t\t\tfont-size: 8pt;\n\t\t\t\t\tmargin-top"..., str_length=91404)
    at /root/SOURCES/php4-debug/php-4.4.2/main/main.c:1029
#21 0xb79a8b7f in zend_print_zval_ex (write_func=0xb79708f3 <php_body_write_wrapper>, expr=0x85139a4, indent=0)
    at /root/SOURCES/php4-debug/php-4.4.2/Zend/zend.c:211
#22 0xb79a8b08 in zend_print_zval (expr=0x85139a4, indent=0) at /root/SOURCES/php4-debug/php-4.4.2/Zend/zend.c:192
#23 0xb79a8612 in zend_print_variable (var=0x85139a4) at /root/SOURCES/php4-debug/php-4.4.2/Zend/zend_variables.c:151
#24 0xb79bbd1a in execute (op_array=0x8440adc) at /root/SOURCES/php4-debug/php-4.4.2/Zend/zend_execute.c:1270
#25 0xb79a9e68 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /root/SOURCES/php4-debug/php-4.4.2/Zend/zend.c:934
#26 0xb79722a6 in php_execute_script (primary_file=0xbf889830) at /root/SOURCES/php4-debug/php-4.4.2/main/main.c:1753
#27 0xb79c34df in apache_php_module_main (r=0x81228c4, display_source_mode=0) at /root/SOURCES/php4-debug/php-4.4.2/sapi/apache/sapi_apache.c:54
#28 0xb79c427c in send_php (r=0x81228c4, display_source_mode=0, filename=0x8124634 "/home/www/5be1dded2c48ff4fd001cc540b87e6f9/web/test/xsltprocess.php")
    at /root/SOURCES/php4-debug/php-4.4.2/sapi/apache/mod_php4.c:627
#29 0xb79c42f2 in send_parsed_php (r=0x81228c4) at /root/SOURCES/php4-debug/php-4.4.2/sapi/apache/mod_php4.c:642
---Type <return> to continue, or q <return> to quit---     
#30 0x08055dff in ap_invoke_handler ()
#31 0x081228c4 in ?? ()
#32 0xb7bd85a2 in tinytens () from /opt/apache/libexec/libphp4.so
#33 0x00000017 in ?? ()
#34 0xffffffff in ?? ()
#35 0xffffffff in ?? ()
#36 0xffffffff in ?? ()
#37 0x080c19bc in ?? ()
#38 0x080c19ac in ?? ()
#39 0x08122bcc in ?? ()
#40 0xbf889ba0 in ?? ()
#41 0x00000002 in ?? ()
#42 0x0805592c in run_method ()
#43 0x00000017 in ?? ()
#44 0x08398b90 in ?? ()
#45 0x081228c4 in ?? ()
#46 0x080c46a4 in ?? ()
#47 0x081228c4 in ?? ()
#48 0xb7e4bd32 in add_env_module_vars_unset () from /opt/apache/libexec/mod_env.so
#49 0x00000017 in ?? ()
#50 0x00000000 in ?? ()
#51 0x080c46a4 in ?? ()
#52 0x08398b90 in ?? ()
#53 0x0806f3c1 in process_request_internal ()
#54 0x081228c4 in ?? ()
#55 0x080af210 in status_lines ()
#56 0xbf889d28 in ?? ()
#57 0x080515ff in ap_table_get ()
#58 0x08124264 in ?? ()
#59 0x080acece in priorities ()
#60 0xb7e63974 in __libc_start_main () from /lib/tls/libc.so.6
#61 0xb7e63974 in __libc_start_main () from /lib/tls/libc.so.6
#62 0x08050051 in _start () at ../sysdeps/i386/elf/start.S:102

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports

[2006-07-18 14:14 UTC] tony2001@php.net

Thank you for this bug report. To properly diagnose the problem, we
need a short but complete example script to be able to reproduce
this bug ourselves. 

A proper reproducing script starts with <?php and ends with ?>,
is max. 10-20 lines long and does not require any external 
resources such as databases, etc.

If possible, make the script source available online and provide
an URL to it here. Try to avoid embedding huge scripts into the report.

[2006-07-18 14:49 UTC] gabriel dot zerbib at protilab dot com

The same test data (XML & XSL) in same context (same PHP application, same version) work and do not fail on Windows XP & IIS, whereas I experience the same problem on submitter's platform.

[2006-07-26 01:00 UTC] php-bugs at lists dot php dot net

No feedback was provided for this bug for over a week, so it is
being suspended automatically. If you are able to provide the
information that was originally requested, please do so and change
the status of the bug back to "Open".

[2006-08-17 09:22 UTC] gabriel dot zerbib at protilab dot com

TEST DATA:

The files can be found at:
http://www.protilab.com/test/sample.xml
http://www.protilab.com/test/sample.xsl

And the PHP script can be run online at:
http://www.protilab.com/test/sample.php


SCENARIO:
An XSLT processor is instanciated using the XML and XSL files specified in the arguments, in a loop of 100 iterations.
Among these 100 iterations, a seg-fault is likely to happen.



XML file to process (sample.xml):
---------------------------------------------------
<?xml version="1.0" encoding="iso-8859-1"?>
<?xml-stylesheet type="text/xsl" href="sample.xsl"?>

<root>
	<node1 id="foo">
		<subnodeA>Some Data A</subnodeA>
		<subnodeA attr="123">Some Mode Data A</subnodeA>
	</node1>
	<node1 id="bar">
		<subnodeA>Some Data A in another node</subnodeA>
		<subnodeA attr="345">Some Mode Data in second node</subnodeA>
	</node1>
</root>
---------------------------------------------------


XSL file to apply (sample.xsl):
---------------------------------------------------
<?xml version="1.0" encoding="iso-8859-1"?>
<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">

	<xsl:template match="/">
		<html>
			<head>
				<title>Title here</title>
			</head>

			<body>
				<xsl:for-each select="/root/node1">
					<xsl:value-of select="@id"/>
					<ul>
						<xsl:for-each select="subnodeA">
							<li><xsl:value-of select="text()"/> <xsl:if test="@attr"> ( <xsl:value-of select="@attr"/> ) </xsl:if> </li> 
						</xsl:for-each>
					</ul>
				</xsl:for-each>
			</body>	
		</html>
	</xsl:template>

</xsl:stylesheet>
---------------------------------------------------


PHP script (sample.php)
---------------------------------------------------
<?
$xmlFile = 'sample.xml';
$xsl_url = 'sample.xsl';


for($i = 0; $i < 100; ++$i)
{

	$xh = xslt_create();
	xslt_set_encoding($xh, 'iso-8859-1');
	xslt_process($xh, $xmlFile, $xsl_url, 'result.html');
	xslt_free($xh);
	
	echo("iteration: $i = OK <br/>\n");

}
?>
---------------------------------------------------

[2006-08-17 09:42 UTC] gerome dot fournier at infomaniak dot ch

Re-opened as the owner of the web site provided new feedbacks.

[2006-08-17 09:43 UTC] tony2001@php.net

Can't reproduce.

[2006-08-17 09:48 UTC] gabriel dot zerbib at protilab dot com

I'm sorry Tony, you were a little bit quick in closing with "can't reproduce".

You can just try the online demo. You'll manage to achieve the 100 iterations for some time, but if you hit Refresh a few times, you sure will run into the problem: the page will not come to you, your browser will report some proxy error or some "Host not found" error, which is in fact caused by a violent crash of the PHP script and PHP interpreter, never returning a response to your browser.

Please do not close this bug report too fast, as sample data were properly provided, and the target platform and system and version.

Thanks.

[2006-08-17 10:01 UTC] tony2001@php.net

What is the version of Sablotron used?
Are you able to get a decent GDB backtrace (using PHP configured with --enable-debug)?
What was your full configure line?

It works just fine here with 1.0.1 & Linux i386.

[2006-08-17 11:17 UTC] gerome dot fournier at infomaniak dot ch

You can get the details about this server using the following URL:

http://imu60.infomaniak.ch/phpinfo.php

We're using sablotron version 1.0 as provided by Debian sarge, and the configure command line is the following:

'./configure' '--disable-all' '--prefix=/opt/php' '--with-apxs=/opt/apache/bin/apxs' '--disable-ipv6' '--with-pear' '--enable-xml' '--with-expat-dir=/usr' '--with-pcre-regex' '--enable-memory-limit' '--enable-ftp' '--with-mysql=/opt/misc/mysql' '--with-zlib-dir=/usr' '--with-openssl=/usr' '--with-zlib=/usr' '--enable-bcmath' '--enable-calendar' '--enable-ctype' '--with-curl=/usr' '--with-dom' '--with-dom-xslt' '--with-dom-exslt' '--enable-exif' '--with-gd' '--with-jpeg-dir' '--with-png-dir' '--with-xpm-dir' '--with-ttf' '--with-freetype-dir' '--enable-gd-native-ttf' '--with-gettext' '--with-iconv' '--with-imap' '--with-kerberos' '--with-imap-ssl' '--enable-mbstring' '--enable-mbregex' '--with-mcal=/usr' '--with-mcrypt' '--with-mhash' '--enable-overload' '--enable-posix' '--enable-session' '--enable-tokenizer' '--enable-wddx' '--enable-xml' '--enable-xslt' '--with-xslt-sablot=/usr' '--with-zip' '--with-pdflib=/opt/misc/pdflib' '--with-tiff-dir=/usr' '--with-ming=/opt/misc/ming'

I don't have a more detailed GDB backtrace to provide for the moment.

[2006-08-17 11:56 UTC] tony2001@php.net

Please upgrade sablotron to the latest available version and see if it helps.

[2006-08-18 09:08 UTC] gabriel dot zerbib at protilab dot com

Tony, my apologies: I admit that the test data I provided were not enough likely to trigger the crash. I was trying to reduce the sise of the sample's source.

Here is a more realistic example:
http://www.protilab.com/test/sample2.php

The XML used is http://www.protilab.com/test/sample2.xml

and the XSL is http://www.protilab.com/test/xslt/home.xsl

(plus some incldues that you can read by yourself in the XSL).

Regards,
Gabriel.

[2006-08-21 08:20 UTC] tony2001@php.net

Did you upgrade sablotron?

>Here is a more realistic example:
>http://www.protilab.com/test/sample2.php
It works fine even on YOUR server (I can see 99 all the time), also I can't use it as a reproduce script, since I can't see the sources.

[2006-08-29 01:00 UTC] php-bugs at lists dot php dot net

No feedback was provided for this bug for over a week, so it is
being suspended automatically. If you are able to provide the
information that was originally requested, please do so and change
the status of the bug back to "Open".

	php.net \| support \| documentation \| report a bug \| advanced search \| search howto \| statistics \| random bug \| login
go to bug id or search bugs for


Copyright © 2001-2024 The PHP Group All rights reserved.	Last updated: Thu Dec 26 17:01:31 2024 UTC