php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #4297 segfault under Apache when using bad cleanup function
Submitted: 2000-05-02 19:37 UTC Modified: 2000-08-15 07:21 UTC
From: vorlon at netexpress dot net Assigned:
Status: Closed Package: Reproducible Crash
PHP Version: 4.0 Latest CVS (02/05/2000) OS: Linux 2.2, glibc 2.1.2, Apache 1
Private report: No CVE-ID: None
View Add Comment Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
You can add a comment by following this link or if you reported this bug, you can edit this bug over here.
(description)
Block user comment
Status: Assign to:
Package:
Bug Type:
Summary:
From: vorlon at netexpress dot net
New email:
PHP Version: OS:

 

 [2000-05-02 19:37 UTC] vorlon at netexpress dot net
Under PHP4, registering a shutdown function that contains invalid PHP code (such as a call to a non-existent function) causes the server process to segfault.
Here is a scriptlet which reproduces the problem:

<?
   function close_socket() {
      close($fd);
   }
   register_shutdown_function(close_socket);

?>

I stumbled on this quite accidentally--of course, I meant to use fclose() instead of close().  Still, it seems that PHP should handle this better than by causing a segfault. :)

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2000-07-24 17:09 UTC] derick@php.net
I can reproduces this with 4.0.1pl2.

Backtrace follows:

GNU gdb 4.17.0.11 with Linux support
Copyright 1998 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-redhat-linux"...
(gdb) run -X
Starting program: /dat/APACHE-PHP4/apache_1.3.12/src/./httpd -X

Program received signal SIGSEGV, Segmentation fault.
0x80f8c85 in _zval_ptr_dtor (zval_ptr=0xbffffaac) at zend_execute_API.c:270
270		(*zval_ptr)->refcount--;
(gdb) bt
#0  0x80f8c85 in _zval_ptr_dtor (zval_ptr=0xbffffaac) at zend_execute_API.c:270
#1  0x80f8ab2 in shutdown_executor () at zend_execute_API.c:161
#2  0x80fe34d in zend_deactivate () at zend.c:515
#3  0x8088644 in php_request_shutdown (dummy=0x0) at main.c:672
#4  0x8086ba5 in php_apache_request_shutdown (dummy=0x0) at mod_php4.c:291
#5  0x812929e in run_cleanups ()
#6  0x8127acd in ap_clear_pool ()
#7  0x8127b41 in ap_destroy_pool ()
#8  0x8127abc in ap_clear_pool ()
#9  0x8136f8f in child_main ()
#10 0x813752c in make_child ()
#11 0x8137689 in startup_children ()
#12 0x8137cb6 in standalone_main ()
#13 0x8138443 in main ()
#14 0x401f9cb3 in __libc_start_main (main=0x81380fc <main>, argc=2, 
    argv=0xbffffd24, init=0x806d970 <_init>, fini=0x81b720c <_fini>, 
    rtld_fini=0x4000a350 <_dl_fini>, stack_end=0xbffffd1c)
    at ../sysdeps/generic/libc-start.c:78
(gdb) print zval_ptr
$1 = (zval **) 0xbffffaac
(gdb) print (*zval_ptr)->refcount
Cannot access memory at address 0xa.
(gdb) print *zval_ptr
$2 = (zval *) 0x0
(gdb) quit

 [2000-08-15 07:11 UTC] stas@php.net
Failed to reproduce this with latest CVS. Does it still happen with the script you provided?
 [2000-08-15 07:21 UTC] derick@php.net
No, it doesn't for me with the CVS version of 14/08/3000.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Fri May 17 06:01:34 2024 UTC