ID: 15511
Updated by: [EMAIL PROTECTED]
-Summary: sablotron and php : segfault in
Situation::generateMessage
-Reported By: [EMAIL PROTECTED]
+Reported By: [EMAIL PROTECTED]
-Status: Open
+Status: Bogus
Bug Type: Sablotron XSL
-Operating System: Linux mandrake 8.0
+Operating System: Windows XP (Professional)
PHP Version: 4.1.1
New Comment:
Thank you for taking the time to report a problem with PHP.
Unfortunately your version of PHP is too old -- the problem
might already be fixed. Please download a new PHP
version from http://www.php.net/downloads.php
If you are able to reproduce the bug with one of the latest
versions of PHP, please change the PHP version on this bug report
to the version you tested and change the status back to "Open".
Again, thank you for your continued support of PHP.
Previous Comments:
------------------------------------------------------------------------
[2002-02-11 15:02:09] [EMAIL PROTECTED]
(this transcript originally posted to sablotron ml at address
http://archive.gingerall.cz/archives/sablot/msg00252.html .
they suggested me to post on php bugtracking too. An attached script
was posted and it's available at the above address. This mail was
transcripted here only for possible future reference. please contact me
if you need more data)
----------------------------
hi all... i'm using
- apache 1.3.23
- php 4.1.1
- expat 1.95.2
- Sablotron 0.82
- Linux Mandrake 8.0
i'm tring to parse the xml/xsl files i provide as attachment. parsing
them with
sabcmd give me the correct output. Parsing it through apache lead to a
brute
connection closed that smells a lot of segfault. So i tried to track
down the
problem. I compiled php as cgi executable and tried to parse the php
from gdb.
this is the result
(gdb) run
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /usr/local/bin/php -f slashdot.php
Program received signal SIGSEGV, Segmentation fault.
0x400d7765 in Situation::generateMessage (this=0x3e73746e,
type=538976288, code=538976288, arg1=@0x20202020,
arg2=@0x20202020, theMessage=@0x20202020) at situa.cpp:279
279 if (messenger && !(flags & SAB_NO_ERROR_REPORTING))
(gdb)
good... stack corruption
(gdb) bt
#0 0x400d7765 in Situation::generateMessage (this=0x3e73746e,
type=538976288, code=538976288,
arg1=@0x20202020, arg2=@0x20202020, theMessage=@0x20202020) at
situa.cpp:279
#1 0x656d6d6f in ?? ()
Cannot access memory at address 0x632f3c35
(gdb)
please note that 0x656d6d6f is "emmo" which really seems "cOMMEnt"
reversed. Also 0x632f3c35
is "c/<5" which is "5</c" from reversed "<comments>105</comments>".
arg1 and arg2 are filled
with spaces. as my file is (however, it crashes even without trailing
spaces)
If you need more data contact me.
a few debug:
(gdb) break *0x400d7cb8
Breakpoint 2 at 0x400d7cb8: file situa.cpp, line 350.
(gdb) run
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /usr/local/bin/php -f
/usr/local/apache/htdocs/slashdot.php
Breakpoint 2 at 0x400d7cb8
Breakpoint 2 at 0x400d7cb8: file situa.cpp, line 350.
Breakpoint 2, Situation::message (this=0x81bc890, type=MT_LOG,
code=L_START, arg1=@0xbfffdd10,
arg2=@0xbfffdd20) at situa.cpp:350
350 if (code == E2_SDOM)
(gdb) cont
Continuing.
Breakpoint 2, Situation::message (this=0x81bc890, type=MT_LOG,
code=L1_PARSING, arg1=@0x81b3b88,
arg2=@0xbfffda70) at situa.cpp:350
350 if (code == E2_SDOM)
(gdb) n
357 if (type == MT_ERROR)
(gdb)
361 Str temp;
(gdb)
362 if (type == MT_ERROR)
(gdb)
364 generateMessage(type, code, arg1, arg2, temp);
(gdb)
Program received signal SIGSEGV, Segmentation fault.
0x400d7765 in Situation::generateMessage (this=0x3e73746e,
type=538976288, code=538976288, arg1=@0x20202020,
arg2=@0x20202020, theMessage=@0x20202020) at situa.cpp:279
279 if (messenger && !(flags & SAB_NO_ERROR_REPORTING))
(gdb)
---------------
(gdb) run
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /usr/local/bin/php -f
/usr/local/apache/htdocs/slashdot.php
Breakpoint 2 at 0x400d7cb8
Breakpoint 2 at 0x400d7cb8: file situa.cpp, line 350.
ciao
Breakpoint 2, Situation::message (this=0x81bc890, type=MT_LOG,
code=L_START, arg1=@0xbfffdd10,
arg2=@0xbfffdd20) at situa.cpp:350
350 if (code == E2_SDOM)
(gdb) cont
Continuing.
Breakpoint 2, Situation::message (this=0x81bc890, type=MT_LOG,
code=L1_PARSING, arg1=@0x81b3b88,
arg2=@0xbfffda70) at situa.cpp:350
350 if (code == E2_SDOM)
(gdb) n
357 if (type == MT_ERROR)
(gdb)
361 Str temp;
(gdb)
362 if (type == MT_ERROR)
(gdb)
364 generateMessage(type, code, arg1, arg2, temp);
(gdb) s
Situation::generateMessage (this=0x81bc890, type=MT_LOG,
code=L1_PARSING, arg1=@0x81b3b88, arg2=@0xbfffda70,
theMessage=@0xbfffd9a0) at situa.cpp:227
227 PList<DStr*> out;
(gdb) n
228 void *messengerUD = NULL;
(gdb)
230 if (proc)
(gdb)
229 MessageHandler *messenger = NULL;
(gdb)
230 if (proc)
(gdb)
231 messenger = proc -> getMessageHandler(&messengerUD);
(gdb)
232 if (messenger)
(gdb)
234 out.append(new DStr("msgtype:"));
(gdb)
235 switch(type)
(gdb)
720 assert((ndx < nItems) && (ndx >= 0));
(gdb)
719 {
(gdb)
720 assert((ndx < nItems) && (ndx >= 0));
(gdb)
719 {
(gdb)
239 case MT_LOG: *(out[0]) += "log"; break;
(gdb)
242 if (type != MT_LOG)
(gdb)
247 if (messenger)
(gdb)
248 out.append(new DStr("module:Sablotron"));
(gdb)
249 if (!info.currFile.isEmpty())
(gdb)
254 if (info.currLine && type != MT_LOG)
(gdb)
259 if (info.currV && type != MT_LOG)
(gdb)
269 SabMsg *p = GetMessage(code);
(gdb)
271 if (p -> text[0])
(gdb) print p
$1 = (SabMsg *) 0x40110dd0
(gdb) print arg1
$2 = (Str &) @0x81b3b88: {
text_ = 0x81b2b98 "<?xml version=\"1.0\"?>\n<backslash
xmlns:/backslash=\"http://slashdot.org/backslash.dtd\";;>\n<story>\n<title>Free
Stripped-Down 3D Studio
Max</title>\n<url>http://slashdot.org/article.pl?sid=00/07/30/2056209<"...,
byteLength_ = 2022, _vptr. = 0x40111d80}
(gdb) print arg2
$3 = (Str &) @0xbfffda70: {text_ = 0x81b19b8 "", byteLength_ = 0,
_vptr. = 0x40111d80}
(gdb) n
273 DStr msgText = messenger ? (char*)"msg:" : (char*)"";
(gdb)
274 sprintf(buf,p ->
text,(char*)(Str&)arg1,(char*)(Str&)arg2);
(gdb)
275 msgText += buf;
(gdb)
276 out.append(new DStr(msgText));
(gdb)
279 if (messenger && !(flags & SAB_NO_ERROR_REPORTING))
(gdb)
Program received signal SIGSEGV, Segmentation fault.
0x400d7765 in Situation::generateMessage (this=0x3e73746e,
type=538976288, code=538976288, arg1=@0x20202020,
arg2=@0x20202020, theMessage=@0x20202020) at situa.cpp:279
279 if (messenger && !(flags & SAB_NO_ERROR_REPORTING))
(gdb)
------------------------------------------------------------------------
--
Edit this bug report at http://bugs.php.net/?id=15511&edit=1
