|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #47768 httpd ( Apache 2.2 ) crashes of abort() in signal handler
Submitted: 2009-03-24 22:58 UTC Modified: 2018-01-13 11:34 UTC
From: hossy421 at yahoo dot co dot jp Assigned: nikic (profile)
Status: Closed Package: Apache2 related
PHP Version: 5.2.9 OS: FreeBSD 6.3-RELEASE-p9
Private report: No CVE-ID: None
View Add Comment Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
You can add a comment by following this link or if you reported this bug, you can edit this bug over here.
Block user comment
Status: Assign to:
Bug Type:
From: hossy421 at yahoo dot co dot jp
New email:
PHP Version: OS:


 [2009-03-24 22:58 UTC] hossy421 at yahoo dot co dot jp
httpd ( Apache 2.2 ) crashes below messages.

> httpd in free(): error: recursive call
> [notice] child pid XXXXX exit signal Abort trap (6)

XXXXX is process id of a httpd child process.

Reproduce code:
sorry, I could't repro this bug in another environment.

Actual result:
this is backtrace.

Program received signal SIGABRT, Aborted.
0x2836b56f in kill () from /lib/
(gdb) bt
#0  0x2836b56f in kill () from /lib/
#1  0x2828d27b in raise () from /usr/lib/
#2  0x2836a2ab in abort () from /lib/
#6  0x2830662c in free () from /lib/
#7  0x28617828 in php_error_cb (type=1,
    error_filename=0x86b1e38 "/usr/home/hossy/public_html/test.php", error_lineno=391,
    format=0x2874febc "Maximum execution time of %d second%s exceeded", args=0xbfbf7898 "\n")
    at /usr/ports/lang/php5/work/php-5.2.9/main/main.c:824
#10 0x282920d3 in sigaction () from /usr/lib/
#11 <signal handler called>
#15 0x2830662c in free () from /lib/
#16 0x28644cb5 in zend_mm_mem_malloc_free (storage=0x80a1690, ptr=0xa81c000)
    at /usr/ports/lang/php5/work/php-5.2.9/Zend/zend_alloc.c:276

1. httpd cought SIGPROF in free() because of `max_execution_time' parameter.
2. php_error_cb() called free()
3. free() detected as `recursive call.'

in zend_mm_mem_malloc_free(), signal is blocked from HANDLE_BLOCK_INTERRUPTIONS macro.
but, apache2handler does't have the function for it.

(gdb) p zend_block_interruptions
$1 = (void (*)(void)) 0
(gdb) p sapi_module
$2 = {name = 0x28759d5d "apache2handler", pretty_name = 0x28759d6c "Apache 2.0 Handler",
  block_interruptions = 0, unblock_interruptions = 0,
(gdb) p apache2_sapi_module
$3 = {name = 0x28759d5d "apache2handler", pretty_name = 0x28759d6c "Apache 2.0 Handler",
  block_interruptions = 0, unblock_interruptions = 0,

in japanese mailing list, I got a patch for this problem.


Add a Patch

Pull Requests

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2009-03-31 07:49 UTC]
Not enough information was provided for us to be able
to handle this bug. Please re-read the instructions at

If you can provide more information, feel free to add it
to this bug and change the status back to "Open".

Thank you for your interest in PHP.

 [2009-04-08 01:00 UTC] php-bugs at lists dot php dot net
No feedback was provided for this bug for over a week, so it is
being suspended automatically. If you are able to provide the
information that was originally requested, please do so and change
the status of the bug back to "Open".
 [2012-06-11 14:14 UTC]
-Status: No Feedback +Status: Open
 [2012-06-11 14:14 UTC]
I believe this isn't fixed yet...
 [2018-01-13 11:34 UTC]
-Status: Open +Status: Closed -Assigned To: +Assigned To: nikic
 [2018-01-13 11:34 UTC]
This has been fixed in PHP 7.1. PHP will no longer interrupt internal function calls on timeout.
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Tue Jun 25 22:01:29 2024 UTC