From: [EMAIL PROTECTED]
Operating system: Debian Linux 2/testing
PHP version: 4.0.6
PHP Bug Type: Reproducible crash
Bug description: SIGSEGV with DOMXML (double free()?)
Script too complex to post here (XML edit module). php.ini and apache
config - nothing special.
PHP 4.0.6
./configure --prefix=/rscr/apprscr \
--with-apache=../../APACHE/ORIG/apache_1.3.20 \
--with-config-file-path=/rscr/apprscr/conf \
--with-regex=system \
--enable-debug \
--enable-track-vars \
--enable-trans-sid \
--disable-rpath \
--enable-session \
--enable-memory-limit \
--enable-sysvsem \
--enable-sysvshm \
--enable-shmop \
--enable-ctype \
--enable-sockets \
--enable-exif \
--with-jpeg-dir=shared,/usr \
--with-xpm-dir=shared,/usr/X11R6 \
--with-png-dir=shared,/usr \
--with-ttf=shared,/usr \
--with-t1lib=shared,/usr \
--with-mm \
--with-xml=/usr \ (debian ext/xml/config.m4 patch)
--with-expat-dir=/usr \
--with-pcre-regex=/usr \
--without-pgsql \
--with-mysql=/usr \
--with-dom=/usr \
--with-zlib=/usr \
--with-ming=/usr \
--with-iconv=/usr
Apache 1.3.20
./configure --prefix=/rscr/apprscr --with-layout=Apache
--disable-module=env --enable-module=setenvif --disable-module=negotiation
--enable-module=alias --disable-module=userdir --disable-module=asis
--disable-module=include --disable-module=cgi --disable-module=actions
--disable-module=imap --disable-module=autoindex --enable-module=dir
--activate-module=src/modules/php4/libphp4.a
--activate-module=src/modules/gzip/mod_gzip.o --enable-module=rewrite
make EXTRA_CFLAGS=-DDYNAMIC_MODULE_LIMIT=0
ldd httpd
libpam.so.0 => /lib/libpam.so.0 (0x40020000)
libdl.so.2 => /lib/libdl.so.2 (0x40028000)
libexpat.so.0 => /usr/lib/libexpat.so.0 (0x4002c000)
libmm.so.11 => /usr/lib/libmm.so.11 (0x40049000)
libpcre.so.3 => /usr/lib/libpcre.so.3 (0x4004e000)
libmysqlclient.so.10 => /usr/lib/libmysqlclient.so.10
(0x40057000)
libz.so.1 => /usr/lib/libz.so.1 (0x4008b000)
libming.so => /usr/lib/libming.so (0x4009b000)
libxml2.so.2 => /usr/lib/libxml2.so.2 (0x400c2000)
libcrypt.so.1 => /lib/libcrypt.so.1 (0x4014e000)
libresolv.so.2 => /lib/libresolv.so.2 (0x4017c000)
libm.so.6 => /lib/libm.so.6 (0x4018d000)
libnsl.so.1 => /lib/libnsl.so.1 (0x401af000)
libdb.so.2 => /lib/libdb.so.2 (0x401c4000)
libc.so.6 => /lib/libc.so.6 (0x401d2000)
/lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x40000000)
libc6 2.2.3-5
libc6-dbg 2.2.3-5
libxml2 2.3.13-1
libxml2-dev 2.3.13-1
libexpat1 1.95.1-5
libexpat1-dev 1.95.1-5
libc6-dev 2.2.3-5
GDB trace:
(gdb) run -X
Starting program: /XX/./httpd -X
Program received signal SIGSEGV, Segmentation fault.
0x4024320b in free () from /lib/libc.so.6
(gdb) bt
#0 0x4024320b in free () from /lib/libc.so.6
#1 0x401124d0 in xmlXPathFreeNodeSet () from /usr/lib/libxml2.so.2
#2 0x40112fc8 in xmlXPathFreeObject () from /usr/lib/libxml2.so.2
#3 0x8085362 in php_free_xpath_object (rsrc=0x86e6ed4) at
php_domxml.c:188
#4 0x8118bda in list_entry_destructor (ptr=0x86e6ed4) at zend_list.c:179
#5 0x811722b in zend_hash_apply_deleter (ht=0x81e8150, p=0x86e6d04)
at zend_hash.c:615
#6 0x81173e8 in zend_hash_graceful_destroy (ht=0x81e8150) at
zend_hash.c:666#7 0x8118d27 in zend_destroy_rsrc_list () at
zend_list.c:234
#8 0x81090c1 in shutdown_executor () at zend_execute_API.c:179
#9 0x811242c in zend_deactivate () at zend.c:540
#10 0x807a867 in php_request_shutdown (dummy=0x0) at main.c:660
#11 0x8077c77 in php_apache_request_shutdown ()
#12 0x8147c39 in run_cleanups ()
#13 0x81462d5 in ap_clear_pool ()
#14 0x8146357 in ap_destroy_pool ()
#15 0x81462c1 in ap_clear_pool ()
#16 0x8156551 in child_main ()
#17 0x8156b91 in make_child ()
#18 0x8156d0c in startup_children ()
#19 0x815737c in standalone_main ()
#20 0x8157bac in main ()
#21 0x401ef2db in __libc_start_main () from /lib/libc.so.6
or with MALLOC_CHECK_=2
#0 0x401feaf1 in kill () from /lib/libc.so.6
#1 0x401fe7d4 in raise () from /lib/libc.so.6
#2 0x401fff51 in abort () from /lib/libc.so.6
#3 0x402451d0 in malloc_set_state () from /lib/libc.so.6
#4 0x402431fa in free () from /lib/libc.so.6
#5 0x401124d0 in xmlXPathFreeNodeSet () from /usr/lib/libxml2.so.2
#6 0x40112fc8 in xmlXPathFreeObject () from /usr/lib/libxml2.so.2
#7 0x8085362 in php_free_xpath_object (rsrc=0x841bc84) at
php_domxml.c:188
#8 0x8118bda in list_entry_destructor (ptr=0x841bc84) at zend_list.c:179
#9 0x811722b in zend_hash_apply_deleter (ht=0x81e8150, p=0x8682fb4)
at zend_hash.c:615
#10 0x81173e8 in zend_hash_graceful_destroy (ht=0x81e8150) at
zend_hash.c:666
#11 0x8118d27 in zend_destroy_rsrc_list () at zend_list.c:234
#12 0x81090c1 in shutdown_executor () at zend_execute_API.c:179
#13 0x811242c in zend_deactivate () at zend.c:540
#14 0x807a867 in php_request_shutdown (dummy=0x0) at main.c:660
#15 0x8077c77 in php_apache_request_shutdown ()
#16 0x8147c39 in run_cleanups ()
#17 0x81462d5 in ap_clear_pool ()
#18 0x8146357 in ap_destroy_pool ()
#19 0x81462c1 in ap_clear_pool ()
#20 0x8156551 in child_main ()
#21 0x8156b91 in make_child ()
#22 0x8156d0c in startup_children ()
#23 0x815737c in standalone_main ()
#24 0x8157bac in main ()
#25 0x401ef2db in __libc_start_main () from /lib/libc.so.6
php-error.log
php_domxml.c(1475) : Freeing 0x082E7BCC (12 bytes),
script=/edit_article_dom.html
Last leak repeated 44 times
free(): invalid pointer 0x860dc38!
free(): invalid pointer 0x89f7498!
free(): invalid pointer 0x887a8b0!
free(): invalid pointer 0x84ae8e8!
php_domxml.c(1475) : Freeing 0x086A867C (12 bytes),
script=/edit_article_dom.html
Last leak repeated 45 times
php_domxml.c(1689) : Freeing 0x0897C19C (48 bytes),
script=/edit_article_dom.html
zend_API.c(208) : Actual location (location was relayed)
Last leak repeated 1 time
php_domxml.c(1700) : Freeing 0x087712B4 (12 bytes),
script=/edit_article_dom.html
Last leak repeated 1 time
zend_API.c(574) : Freeing 0x0850AE4C (12 bytes),
script=/edit_article_dom.html
Last leak repeated 1 time
zend_API.c(544) : Freeing 0x0850AB1C (12 bytes),
script=/edit_article_dom.html
Last leak repeated 1 time
zend_hash.c(198) : Freeing 0x089698E4 (20 bytes),
script=/edit_article_dom.htmlLast leak repeated 3 times
php_domxml.c(1701) : Freeing 0x0896AAA4 (48 bytes),
script=/edit_article_dom.html
zend_API.c(188) : Actual location (location was relayed)
Last leak repeated 1 time
zend_hash.c(287) : Freeing 0x0850BCDC (47 bytes),
script=/edit_article_dom.htmlLast leak repeated 3 times
php_domxml.c(1475) : Freeing 0x0826A50C (12 bytes),
script=/edit_article_dom.html
Last leak repeated 44 times
--
Edit bug report at: http://bugs.php.net/?id=12002&edit=1
--
PHP Development Mailing List <http://www.php.net/>
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
To contact the list administrators, e-mail: [EMAIL PROTECTED]
