php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #7686 Segmentation fault in complex pages when using sessions
Submitted: 2000-11-07 22:53 UTC Modified: 2000-12-16 21:11 UTC
From: paul at rydell dot com Assigned:
Status: Closed Package: Unknown/Other Function
PHP Version: 4.0.3pl1 OS: Red Hat Linux release 6.2
Private report: No CVE-ID: None
 [2000-11-07 22:53 UTC] paul at rydell dot com
Complex script that uses 2 include files and does many MySQL selects. Once I added in some session support and started storing some user preferences in an array I put into the session I started getting segmentation faults. 

Compile info:

#PHP
./configure --with-mysql=/usr/local/mysql \
   --with-apache=../apache_1.3.14 \
   --enable-track-vars --enable-debug

#Apache
./configure \
   --activate-module=src/modules/php4/libphp4.a \
   --enable-module=php4 \
   --prefix=/usr/local/apache


Backtrace:

(gdb) run -X 
Starting program: /usr/local/apache/bin/httpd -X
(no debugging symbols found)...
Program received signal SIGSEGV, Segmentation fault.
0x401370b9 in chunk_free (ar_ptr=0x401cbd60, p=0x882322e0) at malloc.c:3094
3094    malloc.c: No such file or directory.
(gdb) bt
#0  0x401370b9 in chunk_free (ar_ptr=0x401cbd60, p=0x882322e0) at malloc.c:3094
#1  0x40136fba in __libc_free (mem=0x82322e8) at malloc.c:3023
#2  0x80cdaec in _efree ()
#3  0x80d80e4 in _zval_dtor ()
#4  0x80d3c4f in destroy_op_array ()
#5  0x80d3b69 in destroy_zend_function ()
#6  0x80dba77 in zend_hash_clean ()
#7  0x80dbbbf in zend_hash_apply ()
#8  0x80d2618 in shutdown_executor ()
#9  0x80d8a87 in zend_deactivate ()
#10 0x807b59d in php_request_shutdown ()
#11 0x80797ea in sapi_apache_send_headers ()
#12 0x81029ae in ap_run_cleanup ()
#13 0x81011dd in ap_clear_pool ()
#14 0x8101251 in ap_destroy_pool ()
#15 0x81011cc in ap_clear_pool ()
#16 0x811099f in ap_child_terminate ()
#17 0x8110f3c in ap_child_terminate ()
#18 0x8111099 in ap_child_terminate ()
#19 0x81116c6 in ap_child_terminate ()
#20 0x8111e53 in main ()
#21 0x400f59cb in __libc_start_main (main=0x8111b0c <main>, argc=2, argv=0xbffffb14, init=0x80606dc <_init>, 
    fini=0x813f79c <_fini>, rtld_fini=0x4000ae60 <_dl_fini>, stack_end=0xbffffb0c) at ../sysdeps/generic/libc-start.c:92


I can provide script but it is very lengthy. Hopefully the backtrace can give some information. Thanks much.

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2000-11-13 04:06 UTC] paul at rydell dot com
I started taking code out of my script to reduce its complexity while maintaining the occasional segmentation faults. The session code is gone and the segmentation faults still happen every now and then.

I am posting a sample script that will generate the segmentation fault but as far as I can tell it only happens intermittently



<?

$debug=0;

#Connect to the database
mysql_connect("localhost", "xxxx", "xxxx") or $errors = $errors . "Could not connect to database.\n"; 
@mysql_select_db("xxxx") or $errors = $errors . "Unable to select database\n";
print "$errors";

$foundsearch=0;
$nosites = 0;


$singleword = addslashes($searchwords);
	
if ($singleword != "")
{
	if ($debug==1){
		print "We are looking for the ID of this word: $singleword<br>\n";
	}

	$selectwordids = mysql_query("select wordid from wordidx where word='$singleword'");
	if ($selectwordids)
	{
		if (!mysql_numrows($selectwordids))
		{
			$nosites=1;
		}
		else
		{
			$foundsearch=1;

			while ($r = mysql_fetch_array($selectwordids))
			{
				$wordidsarray[]=$r["wordid"];
				if ($debug==1){
					print "We found that word: $singleword has id: " . $r["wordid"] . "<BR>\n";
				}
			}

		}
	}

}


if ($foundsearch==0){
	?>Nothing found.<?
}
else{

	#Get sites that have the words in wordidsarray
	$wordidcounter=0;
	foreach ($wordidsarray as $wordid) {
		if ($debug==1){
			print "We are looking for sites that contain this wordid: $wordid<br>\n";
		}
		$selectsiteswithwordid = mysql_query("select distinct(siteid) from iindex where wordid=$wordid limit 750");
		if ($selectsiteswithwordid)
		{
			if (!mysql_numrows($selectsiteswithwordid))
			{
				#There were no sites that matched the word
				if ($debug==1){
					print "There were no words that matched<BR>\n";
				}
			}
				
			else
			{
				while ($s = mysql_fetch_array($selectsiteswithwordid))
				{
					$siteswithwordsarray[]=$s["siteid"];
					if ($debug==1){
						print "Found siteid: " . $s["siteid"] . "<br>\n";
					}
				}
				$wordidcounter++;
			}
		}
	}		

	$title = array();
	$url = array();
	$description = array();
	$oldpicid = array();
	$id = array();
	$picdone = array();

	$y=0;

	foreach ($siteswithwordsarray as $csiteid)
	{

		#Get the info about the sites that match
		$selectsites = mysql_query("select url,title,description,oldpicid,picdone,id from content where id=$csiteid");
		if ($selectsites)
		{
			if(!mysql_numrows($selectsites))
			{
			
				#This should not happen

			}
			else
			{
			
				while ($q = mysql_fetch_array($selectsites))
				{

					$title[] =  wordwrap($q["title"],21," ",1);
					$url[] = $q["url"];
					$description[] = wordwrap($q["description"], 30, " ", 1);
					$oldpicid[] = $q["oldpicid"];
					$picdone[]=$q["picdone"];
					$id[]=$q["id"];
					$y++;
				
				}
			}
		}

	}

}

?>
<BR>
Done
 [2000-11-14 05:21 UTC] paul at rydell dot com
Well after spending several more hours with this segmentation fault problem I *NOW* think that the problem is in the wordwrap function. If I take out the wordwrap on the results from the DB I can't generate the seg fault. If it is in there I get the seg fault pretty often but not always.

Start
<?
mysql_connect("xxx", "xxx", "xxx") or $errors = $errors . "Could not connect to database.\n"; 
@mysql_select_db("xxx") or $errors = $errors . "Unable to select database\n";

$title = array();
$url = array();
$description = array();
$oldpicid = array();
$id = array();
$picdone = array();
$y=0;

for ($x=15000;$x<15100;$x++)
{
	$selectsites = mysql_query("select url,title,description,oldpicid,picdone,id from content where id=$x");
	if ($selectsites)
	{
		if(!mysql_numrows($selectsites))
		{
			#This should not happen
		}
		else
		{
			while ($q = mysql_fetch_array($selectsites))
			{
				$title[] =  wordwrap($q["title"],21," ",1);
				$description[] = wordwrap($q["description"], 30, " ", 1);
				print "<P>";
				print $x;
				print "<BR>";
				print $q["title"];
				print "<BR>";
				print $q["description"];
				print "</P>\n";
			}
		}
	}
}
?>

<br>Done
 [2000-12-16 15:35 UTC] waldschrott@php.net
Please provide a reduced code fragment (<15 lines) producing
this behaviour.
Put no database queries etc. in it to ensure that we can
reproduce it easily.

in your case, save the selected field to a file and apply
word_wrap() in another simple script and see if it still
crashes, if yes reduce it so far that you know what causes
php to crash and post it here
 [2000-12-16 19:57 UTC] paul at rydell dot com
Okay. Here is a non-database script that can still cause the seg fault. It will not happen every time... you might have to reload a bunch of times to get it to happen or better yet use ./ab -n 5000 -c 10 http://localhost/crash.php3 to get some seg. faults.

------

<?

header("Content-type: text/plain"); 

print "start.\n";

$x=array();

$x[]="Collecting Hawaiiana, antiques, toys, &amp; other collectibles in Hawaii. Home of the Hawaii All-Collectors Show";
$x[]="A Place for Serious Collectors of Antique Firearms, Swords, Knives, Civil War, Revolutionary War, Old West Collectibles, Old Photographs and Documents, Buy, Sell, Trade, Free Classifieds.";
$x[]="Soda Pops Antiques and Collectibles has a large variety of antiques and collectibles from days gone by.  Stop in and take a look at some of the memorabilia from the days of sitting at the soda fountain!";
$x[]="Provides complete restoration &amp; conservation services for arts, antiques, antiquities and collectibles. Specialty is &quot;invisible&quot; and &quot;museum quality&quot; restoration. Porcelain, paintings, dolls, glass, china, enamel, furniture, wood, metal, gilding.";
$x[]="Ancient cartography.";
$x[]="Contains a searchable auction calendar of over 9,000 auctions, a searchable fairs calendar over 4,500 fairs, an art prices index over 8,000. Buy and sell section, auction news, dealers news, fairs news, services, auction reports over 15 each week, pictures, dealers (including web sites), articles archive, an online bookstore and more.";
$x[]="Presents Antique Penny Gum Ball Machines from the 1930's and the 1940's as well as a selection of contemporary and classic collectible gumball machines. Gum, Candy, and Nuts are available. Parts and repairs. Books on vending machines and collectibles.";
$x[]="Collection of images and old holy sculptures, presented in international exibitions and art publications.";
$x[]="Bronze sculptures, collectible and historical photographs, limited  edition prints, sports and horse racing memorabilia, toys, autographs,  movie memorabilia, character collectibles, and much more.";
$x[]="Site for antique and collectible News, Information, Tips, and the Top sites on the Web. Join AntiqueWeb Ring for Free.";
$x[]="Antique, Classic and Sports Cars; Collector Guns; Miniature Guns; Antiques and Collectables; buy, sell, trade.";
$x[]="";
$x[]="1920-1950 industrial design, art deco, electrical antiques, vintage radios, televisions, world's fair, lighting, Chase chrome, and American moderne style";
$x[]="Fine antiques for the home.";
$x[]="Premier Customer Service and the finest antiques and collectibles from the attics of The Great Northwest.";
$x[]="Medieval, Renaissance, French Romantic &amp; 19th Century reproduction tapestries.";
$x[]="Article and links about the pbs.org site Antiques Roadshow.";
$x[]="Buying and selling of antiques, collectibles and curios.  Specialising in Art Deco, Art Nouveau, Ceramics, Metals, Glassware, Fishing Tackle, Toys and Dolls.";
$x[]="National organization of collectors, dealers and scholars interested in Lincoln and the material culture of the period. Quarterly journal, host Lincoln and Civil War auctions, sponsor exhibits and tours, and help buy, sell, and appraise historical Americana.";  
$x[]="Repairs antique, collectible and heirloom objects.";
$x[]="Hard to find antiques and collectibles for sale. Includes playboy collectibles, ephemera, breweriana, tobacciana, pottery, glassware, 40's, 50's and 60's, stamps for collectors and much more.";  
$x[]="An eclectic collection of fine quality antiques,  collectibles, furniture, depression glass, porcelain,  bronzes, framed oils and prints.";
$x[]="Collection of antique garden ornaments, farm antiques, garden antiques, old millstones, old stone troughs, antique flat stone, grinding stones, heritage pottery...all for your garden."; 
$x[]="Collection of antique silver bookmarks, consists of 601 unique pieces. Bookmarks are mostly silver but some are gold, brass, copper, pewter, silk.";
$x[]="Instantly identify silver pieces on-line. Learn who is the manufacturer, the year manufactured, and the history of silver items.";
$x[]="An extensive collection of pre-1930 antique fishing lures and boxes from Heddon, Shakespeare, Pflueger, and various early makers."; 
$x[]="Information, history, want-ads,the art of collecting lightning rod balls and related antiques.";
$x[]="Vintage Costume Jewelry Collection; textiles, small glass, pottery and silver items from Emerald Antiques - identification and values.";
$x[]="On line selection of antiques and collectibles including pottery, ceramics, glass, kitchen collectibles, etc.";
$x[]="Selection of Quality 19th and 20th Century Porcelain and Glass. Flow Blue, Limoges, Victorian Glass, Elegant Etched Glassware, Stunning Figurines and More.";
$x[]="Specializes in the restoration and sale of antique trunks and chests since 1972. History of antique trunks and chests.";
$x[]="Message board for discussion of any antiques topic, from furniture to glass to books to vintage Elvis paintings.";
$x[]="Describes a inherited artifact of a small wooden cross mounted with gold, and the wood from which it is made is reported to have come from George Washington's coffin.";
$x[]="Pre-1940 wood lures and their boxes. Over 500 pages of information, prices, photos, and how-to for collecting antique fishing lures.";
$x[]="Collecting, restoring and showing antique stationary gas, gasoline and steam engines. Engine show photos, Magneto page, classified dds and books.";
$x[]="A national12-month Calendar describing Shows, Sales, Fairs, Expositions, and other very Special Happenings";
$x[]="Original Currier &amp; Ives Lithographs and collector books from the collection of George Cohenour. Conservation and Restoration of antique lithographs and prints.";
$x[]="specializes in buying and selling architectural artifacts and hard to find irreplaceable pieces. Also manufactures unique gothic, renaissance art nouveau, chandeliers, bronze sconces, marble busts, columns, fireplace mantels and Tiffany stained glass.";
$x[]="art, antiques, collectable, the unusual";
$x[]="For Sale: Made by Molhracky of Paris, during the Civil War. Personal site.";
$x[]="Collectible reel to reel taperecorders from the 40's, 50's &amp; 60's - a virtual museum including brands such as Ferrograph, Grundig, Telefunken, Ampex and more.";
$x[]="Antique horse brasses for sale at this extensive web site, plus informative articles on their collection.";
$x[]="(United kingdom) A wide selection of Golf, equine and country antiques sports items";
$x[]="Specializing in 18th Century/Early 19th Century American Furniture and related decorative accessories, with occasional English items.";
$x[]="Fine American and European antiques, furniture, decorative arts, oil paintings from the 17th 18th 19th and 20th century. Estate silver and jewelry bought, consigned, appraisals.";
$x[]="Contains antiques for sale including: art, ceramics, antique furniture, arms and armour, architectural, militaria, toys, treen and more. Also included antiques fairs and auctions and dealer sites.";
$x[]="A selection of splendid Asian art, antiques, and curios.";
$x[]="Information on antiques, collectibles and auctions, feature articles, an advice column and links.";
$x[]="Informational site for early 1900's English metalware, particularly JS&amp;S and Beldray copper and brass items.";
$x[]="Silver and Silver Hallmarks. A site to aid in the study and identification of the marks struck on silver, including a brief history of English silver, bookshop, world silver marks and an Exchange to post and reply to queries.";
$x[]="Museum of antique mechanical musical instruments.";
$x[]="Online community of restorers sharing ideas with each other and providing information and advice about the proper restoration and care of antiques, porcelain, furniture, glass, art, pottery, fine art, and fine art frames.";
$x[]="Fine collectibles, antiques, collectible firearms, fine art, jewelry, and furniture.";
$x[]="TEFAF Maastricht and pan Amsterdam, organised by The European Fine Art Foundation, are known for their high quality art and antiques.";
$x[]="A personal collection of art deco items collected over 30 years.";
$x[]="Links you to antique dealers, artists and painters in France, Spain, Italy.";
$x[]="Carousel animal restoration, painting, and new carvings. Museum quality restoration, and painting.";
$x[]="Fine Art Nouveau and Art Deco decorative arts.  Specializing in signed lamps, art glass and Louis Icart etchings.";
$x[]="Lots of information and hints with a featured antique section.";
$x[]="This is a directory of American Silver marks often seen on sterling or coin silver flatware and hollowware.";
$x[]="A complete resource center &amp; guide for antique &amp; collectibles dealers &amp; hobbyists with auction &amp; marketing sources and references.";
$x[]="Groups of plaster statuary by John Rogers, other collectibles; buying, restoring, and selling by K&amp;G Enterprises.";
$x[]="Organizes ten d'Or Awards, &quot;Oscars&quot; for collectors, with a treasure hunt for trophies, and prizes totalling 9  million Euros.";
$x[]="Radiocarbon dating laboratory exclusively for fine art and antiquity conservators, appraisers, dealers and collectors. 20 years experience.";
$x[]="Volunteer experts answer your questions about all different kinds of antiques; what they are, what they're worth, and where to find more.";
$x[]="Specializes in Mexican retablos, santos, furniture, silver, ceramics, textiles, Spanish colonial art and antiques.";
$x[]="Antiques for sell inculde farm, musical, toy, coins, antique jewelry, books, and much more.";
$x[]="Browse these antique shops for your favourite collectable or open an online antique shop.";
$x[]="Since 1750 - Restoration of gilded antiques, interior decoration, gilding, binding, framing.";
$x[]="Antique Music Box Repair &amp; Restoration";

for ($i = 0; $i < 70; $i++){
	$wrappedtext = wordwrap($x[i],5," ",1);
}

print "end.\n";

?>
 [2000-12-16 20:07 UTC] paul at rydell dot com
Sorry... forget that last long script. This will give you the seg fault much faster:

<?

header("Content-type: text/plain"); 

print "start.\n";

$x=array();

for ($j = 0; $j < 5000; $j++){
	$x[]="This isa longsentence that needsto be wordwrappedThis isa longsentence that needsto be wordwrapped";
}

for ($i = 0; $i < 5000; $i++){
	$wrappedtext = wordwrap($x[i],5," ",1);
}

print "end.\n";

?>



 [2000-12-16 21:11 UTC] sas@php.net
Thanks for your report. I've fixed empty string handling in wordwrap().

Note however that there was a bug in your code which triggered this edge case ($x[i] should read $x[$i]).
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Thu Apr 25 11:01:30 2024 UTC