ID: 32893
User updated by: php at fiddaman dot net
Reported By: php at fiddaman dot net
-Status: Feedback
+Status: Open
Bug Type: GD related
Operating System: Solaris 9
PHP Version: 4.3.11
Assigned To: pajoye
New Comment:
Here's a patch which fixes the problem. The variable being passed to
the zend argument parser was too small to hold the result (int versus
long).
--- ext/gd/gd.c~ 2005-05-01 11:36:21.134419000 +0000
+++ ext/gd/gd.c 2005-05-01 11:42:37.369849000 +0000
@@ -3017,7 +3017,8 @@
{
zval *IM, *EXT = NULL;
gdImagePtr im=NULL;
- int col = -1, x = -1, y = -1, str_len, fontname_len, i,
brect[8];
+ long col = -1, x = -1, y = -1;
+ int str_len, fontname_len, i, brect[8];
double ptsize, angle;
unsigned char *str = NULL, *fontname = NULL;
char *error = NULL;
I'm using freetype 2.1.3 and gd 2.0.15 but it wasn't getting to even
call a function in those libraries.
A simpler test case which doesn't need the font file. It generates an
error in 4.3.10 but still crashes the snapshot.
% cat test
<?php
$img = imagecreate(400, 70);
imagettftext($img, 11/81*64, 0, 0, 27, 0, "/dev/null",
"test");
?>
% ./php4-STABLE-200504301042/sapi/cli/php test
zsh: bus error (core dumped) ./php4-STABLE-200504301042/sapi/cli/php
test
% ./php-4.3.10/sapi/cli/php test
PHP Warning: imagettftext(): Could not read font in
/spool/src/build/test on line 3
Previous Comments:
------------------------------------------------------------------------
[2005-05-01 01:29:04] [EMAIL PROTECTED]
Which Freetype version do you use?
Please give us a link to the TTF file you use.
------------------------------------------------------------------------
[2005-04-30 13:53:31] php at fiddaman dot net
Same result with the snapshot:
Starting program:
/spool/src/build/php4-STABLE-200504301042/sapi/cli/php t
Program received signal SIGSEGV, Segmentation fault.
0x00000001001a6df4 in zend_parse_va_args (num_args=4,
type_spec=0x10023d1b3 "lllss|a", va=0xffffffff7fffe978, flags=0)
at /spool/src/build/php4-STABLE-200504301042/Zend/zend_API.c:260
260 *p =
Z_LVAL_PP(arg);
it looks like a memory alignment problem, the SPARC MMU won't allow a
32 or 64-bit read that isn't aligned.
I added this just before line 260:
zend_printf("Alignment: %d\n", __alignof__(arg));
which gives:
% sapi/cli/php t
Alignment: 8
zsh: bus error (core dumped) sapi/cli/php t
------------------------------------------------------------------------
[2005-04-30 03:45:50] [EMAIL PROTECTED]
Please try using this CVS snapshot:
http://snaps.php.net/php4-STABLE-latest.tar.gz
For Windows:
http://snaps.php.net/win32/php4-win32-STABLE-latest.zip
I can't reproduce this crash.
------------------------------------------------------------------------
[2005-04-29 21:26:27] php at fiddaman dot net
Description:
------------
PHP crashes in imagettftext - worked fine in 4.3.10
./configure \
--prefix=/opt/php \
--with-exec-dir=/opt/php/bin \
--with-apxs2=/opt/apache/bin/apxs \
--enable-memory-limit \
--with-iconv \
--enable-ftp \
--enable-mbstring \
--with-mbstring=all \
--with-gettext \
--enable-calendar \
--with-mime-magic \
--with-mysql \
--with-mysqli=/opt/mysql/bin/mysql_config \
\
--with-openssl=/opt/openssl \
--with-mysql=/opt/mysql \
--with-gdbm=/opt/GNUgdbm \
--with-db4=/opt/newdb \
--with-dom=/opt/libxml2 \
--with-gmp=/opt/GNUmp \
--with-mcrypt=/opt/libmcrypt \
\
--with-imap=/opt/c-client \
--with-imap-ssl=/opt/openssl \
\
--with-zlib=/usr \
--with-zlib-dir=/usr \
--with-bz2=/usr \
\
--with-gd \
--with-jpeg-dir=/opt/libjpg \
--with-png-dir=/opt/libpng \
--with-freetype-dir=/opt/freetype
Reproduce code:
---------------
<?php
$img = imagecreate(400, 70);
$font_colour = imagecolorallocate($img, 0, 0x50, 0);
imagettftext($img, 11/81*64, 0, 0, 27,
"$font_colour", "/tmp/federation.ttf",
"test");
imagedestroy($img);
?>
Expected result:
----------------
No errors.
Actual result:
--------------
#0 0x00000001001a70b4 in zend_parse_va_args (num_args=4,
type_spec=0x10023cd7b "lllss|a", va=0xffffffff7fffe898, flags=0)
at /spool/src/build/php-4.3.11/Zend/zend_API.c:260
#1 0x00000001001a7b18 in zend_parse_parameters (num_args=8,
type_spec=0x10023cd78 "rddlllss|a")
at /spool/src/build/php-4.3.11/Zend/zend_API.c:552
#2 0x0000000100071a7c in php_imagettftext_common (ht=8,
return_value=0x10061dd28, this_ptr=0x0, return_value_used=0,
mode=0,
extended=0) at /spool/src/build/php-4.3.11/ext/gd/gd.c:3042
#3 0x00000001001bb0c4 in execute (op_array=0x10063b2a8)
at /spool/src/build/php-4.3.11/Zend/zend_execute.c:1654
#4 0x00000001001a64b0 in zend_execute_scripts (type=8, retval=0x0,
file_count=3) at /spool/src/build/php-4.3.11/Zend/zend.c:926
#5 0x0000000100173ba0 in php_execute_script
(primary_file=0xffffffff7ffffaa0)
at /spool/src/build/php-4.3.11/main/main.c:1745
#6 0x00000001001c3f08 in main (argc=2, argv=0xffffffff7ffffb98)
at /spool/src/build/php-4.3.11/sapi/cli/php_cli.c:828
------------------------------------------------------------------------
--
Edit this bug report at http://bugs.php.net/?id=32893&edit=1
