|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #48034 Crash when script is 8192 (8KB) bytes long
Submitted: 2009-04-21 10:22 UTC Modified: 2017-01-11 16:38 UTC
Avg. Score:3.9 ± 1.4
Reproduced:15 of 17 (88.2%)
Same Version:14 (93.3%)
Same OS:4 (26.7%)
From: ninzya at inbox dot lv Assigned: dmitry (profile)
Status: Closed Package: Reproducible crash
PHP Version: 5.*, 6CVS (2009-04-21) OS: *
Private report: No CVE-ID: None
 [2009-04-21 10:22 UTC] ninzya at inbox dot lv
Configuration: Apache HTTPd
PHP: 5.3.0RC1
OS: Windows XP SP3

PHP crashes apache when php file including php tags + data between them is 8192 bytes (8KB) long.

Reproduce code:
Create file with the following content:

<?php(any 8185 byte long data)?>


<?(any 8188 byte long data)?>

and request it through the browser.

Expected result:
No crashes

Actual result:


mmap.diff.txt (last revision 2012-01-16 14:43 UTC by dmitry at zend dot com)

Add a Patch

Pull Requests

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2009-04-21 11:14 UTC]
Also: Exactly how does it crash? Are you sure it crashes? How did you configure PHP in Apache? (READ: Not enough information, 99% bogus..)
 [2009-04-21 11:27 UTC] ninzya at inbox dot lv <-- php file contents
PHP as module.
It crashes by displaying "Apache.exe - Application error" window, saying "The instruction at 0x0085779c referenced memory at 0x061e2000 (this actually varies). The memory could not be read. Click OK to terminate the program."

(BTW, what is your formula for bogusness percentage?)
 [2009-04-21 11:40 UTC]
Which apache module? Do you have some fancy filtering going on? Does this happen with PHP 5.2.9 ? Do you have any shared extensions loaded? Any Zend extensions like debugger or cache? (disable those and retry)
 [2009-04-21 11:50 UTC] ninzya at inbox dot lv
PHP is installed as apache module.
No fancy filtering, default php/apache installation.
All php modules disabled.

Bug hits only if file size is 8KB exactly (8192 bytes). PHP 5.2.9 also is affected.

By the way, Apache 2.2 is not affected. Seems this is apache 2.0 specific problem. Don't know where to post this issue, here, or in Apache bugtracker.
 [2009-04-21 15:31 UTC]
It seems related to . Not exactly the same problem, though.
It seems php_stream_open_for_zend() does not mmap() enough for ZEND_MMAP_AHEAD (PHP_STREAM_OPTION_MMAP_API in plain_wrapper adjusts the mmap length to the filesize, so ignoring ZEND_MMAP_AHEAD), and this may crash when the parser reads ahead of the mmap()ed region. 
 [2009-04-21 17:20 UTC] ninzya at inbox dot lv
I did everything mentioned in

and got these results:

Thread 250 - System ID 5552
Entry point   msvcrt!_endthreadex+3a 
Create time   21.04.2009 15:20:51 
Time spent in user mode   0 Days 0:0:0.656 
Time spent in kernel mode   0 Days 0:0:0.921 

Function     Arg 1     Arg 2     Arg 3   Source 
php5ts!lex_scan+447c     0550fa34     010f54a0     0000002f    
php5ts!zend_register_auto_global+11f     00000000     00000000     00000000
 [2009-04-22 11:09 UTC]
See also bug#48043
 [2009-04-28 07:16 UTC]
This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
Thank you for the report, and for helping us make PHP better.

 [2009-05-04 16:06 UTC]
Not fixed. Only a temp hack.
 [2012-01-11 09:12 UTC] bugzilla33 at gmail dot com
1. use Test script to generate crash.php, size 8192 bytes
2. now let crash php engine crash.php
3. Any php file of size 8192 bytes crashes Apache and PHP!
4. Tested with Apache 2.2.21 V9 apache longue, PHP 5.4.0 RC5 or RC6 dev on three other machines, Win 7 x86 or Win 7 x64.

Test script:
testcase php file generator:




 print('1. testcase file generated: crash.php, size '.strlen($out).' bytes<br/>');
 print('2. now let crash php engine <a href="crash.php">crash.php</a><br/>');
 print('<b style="color:red">3. Any php file of size 8192 bytes crashes Apache and PHP!</b><br/>');
 print('4. Tested with Apache 2.2.21 V9 apache longue, PHP 5.4.0 RC5 or RC6 dev on three other machines, Win 7 x86 or Win 7 x64.<br/>');

Expected result:
NO crash

Actual result:
 [2012-01-11 09:35 UTC] bugzilla33 at gmail dot com
The shortest working example:

 file_put_contents('8192_testcase.php',str_repeat(' ',8192));
<a href="8192_testcase.php">run testcase</a>

Use Apache 2.2.21, PHP 5.*, Win 7 x86/x64
 [2012-01-16 11:56 UTC] pvasilevich at parallels dot com
This problem reproduced in 5.3.9 released in public/

It looks like temporary workaround commmited by dmitry in 
Revision: 279490
(Date: 2:13:30 PM, Tuesday, April 28, 2009)
Fixed bug #48034 (PHP crashes when script is 8192 (8KB) bytes long)

has been replaced by 

Revision: 316812
Author: dmitry
Date: 6:30:17 PM, Thursday, September 15, 2011
Fixed bug #50982 (incorrect assumption of PAGE_SIZE size)

And bug appeared again.

Please fix this problem ASAP.
 [2012-01-16 14:46 UTC] dmitry at zend dot com
Can anyone check if the attached patch fixes the problem?
 [2012-01-16 17:09 UTC] pvasilevich at parallels dot com
I have applied similar patch and problem solved. ( I have removed #ifdef HAVE_MMAP at all)
 [2012-01-16 23:09 UTC]
From Matt (our tester/QA team):
"I've tested the patch from 48034 on php_5_4 r322075 on Win7 x64 sp1 and it 
fixes the bug from 60771.

I tested the repro script PID1080 from 60771 that produces a >8k text file and 
tries to require it.

I also produced another >8k file myself and added some php code to it (inside <?
php tags) and required it from another script. With 48034 patch, that also 

phpt for that is coming too
 [2012-01-17 08:15 UTC]

I think you can apply it already :)
 [2012-01-17 09:30 UTC]
Automatic comment from SVN on behalf of dmitry
Log: Fixed workaround for bug #48034 on Windows (Crash when script is 8192 (8KB) bytes long)
 [2012-03-23 17:46 UTC] ninzya at inbox dot lv
Just ran into this problem again, almost exactly two years later :) But this time 
with 4KB (4096 bytes) long script:

<?php(any 4089 bytes long data)?>
 [2012-03-23 17:49 UTC]
@ninzya at inbox dot lv

It was not in 5.3.10, so please try with 5.3 snapshots.
 [2012-03-23 20:47 UTC] ninzya at inbox dot lv
Few hours ago tried PHP 5.4. Bug is still there.
 [2012-03-23 21:50 UTC]
Dmitry, was it ported to 5.4 already?
 [2017-01-11 16:38 UTC]
-Status: Assigned +Status: Closed
 [2017-01-11 16:38 UTC]
Cannot reproduce on 5.6, 7.0, 7.1 or master. Assuming fixed.
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Fri Feb 23 18:01:28 2024 UTC