|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #47768 httpd ( Apache 2.2 ) crashes of abort() in signal handler
Submitted: 2009-03-24 22:58 UTC Modified: 2018-01-13 11:34 UTC
From: hossy421 at yahoo dot co dot jp Assigned: nikic (profile)
Status: Closed Package: Apache2 related
PHP Version: 5.2.9 OS: FreeBSD 6.3-RELEASE-p9
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If this is not your bug, you can add a comment by following this link.
If this is your bug, but you forgot your password, you can retrieve your password here.
Bug Type:
From: hossy421 at yahoo dot co dot jp
New email:
PHP Version: OS:


 [2009-03-24 22:58 UTC] hossy421 at yahoo dot co dot jp
httpd ( Apache 2.2 ) crashes below messages.

> httpd in free(): error: recursive call
> [notice] child pid XXXXX exit signal Abort trap (6)

XXXXX is process id of a httpd child process.

Reproduce code:
sorry, I could't repro this bug in another environment.

Actual result:
this is backtrace.

Program received signal SIGABRT, Aborted.
0x2836b56f in kill () from /lib/
(gdb) bt
#0  0x2836b56f in kill () from /lib/
#1  0x2828d27b in raise () from /usr/lib/
#2  0x2836a2ab in abort () from /lib/
#6  0x2830662c in free () from /lib/
#7  0x28617828 in php_error_cb (type=1,
    error_filename=0x86b1e38 "/usr/home/hossy/public_html/test.php", error_lineno=391,
    format=0x2874febc "Maximum execution time of %d second%s exceeded", args=0xbfbf7898 "\n")
    at /usr/ports/lang/php5/work/php-5.2.9/main/main.c:824
#10 0x282920d3 in sigaction () from /usr/lib/
#11 <signal handler called>
#15 0x2830662c in free () from /lib/
#16 0x28644cb5 in zend_mm_mem_malloc_free (storage=0x80a1690, ptr=0xa81c000)
    at /usr/ports/lang/php5/work/php-5.2.9/Zend/zend_alloc.c:276

1. httpd cought SIGPROF in free() because of `max_execution_time' parameter.
2. php_error_cb() called free()
3. free() detected as `recursive call.'

in zend_mm_mem_malloc_free(), signal is blocked from HANDLE_BLOCK_INTERRUPTIONS macro.
but, apache2handler does't have the function for it.

(gdb) p zend_block_interruptions
$1 = (void (*)(void)) 0
(gdb) p sapi_module
$2 = {name = 0x28759d5d "apache2handler", pretty_name = 0x28759d6c "Apache 2.0 Handler",
  block_interruptions = 0, unblock_interruptions = 0,
(gdb) p apache2_sapi_module
$3 = {name = 0x28759d5d "apache2handler", pretty_name = 0x28759d6c "Apache 2.0 Handler",
  block_interruptions = 0, unblock_interruptions = 0,

in japanese mailing list, I got a patch for this problem.


Add a Patch

Pull Requests

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2009-03-31 07:49 UTC]
Not enough information was provided for us to be able
to handle this bug. Please re-read the instructions at

If you can provide more information, feel free to add it
to this bug and change the status back to "Open".

Thank you for your interest in PHP.

 [2009-04-08 01:00 UTC] php-bugs at lists dot php dot net
No feedback was provided for this bug for over a week, so it is
being suspended automatically. If you are able to provide the
information that was originally requested, please do so and change
the status of the bug back to "Open".
 [2012-06-11 14:14 UTC]
-Status: No Feedback +Status: Open
 [2012-06-11 14:14 UTC]
I believe this isn't fixed yet...
 [2018-01-13 11:34 UTC]
-Status: Open +Status: Closed -Assigned To: +Assigned To: nikic
 [2018-01-13 11:34 UTC]
This has been fixed in PHP 7.1. PHP will no longer interrupt internal function calls on timeout.
PHP Copyright © 2001-2023 The PHP Group
All rights reserved.
Last updated: Fri Sep 29 17:01:25 2023 UTC