[php-maint] Bug#549492: Bug#549492: php5-cgi causes segmention fault

[sean finney]

hi vincent,

On Wed, Oct 28, 2009 at 04:28:49AM +0100, Vincent Caron wrote:
> Found this trace by googl'ing: http://pastie.org/pastes/508339/download
> 
> Looks relevant, it's about php5-5.2.6.dfsg.1 and fails on hashing
> REMOTE_ADDR key with bogus value size. Although this one fails in a
> 'apache2' SAPI whereas my bugreport was about CGI SAPI in FastCGI
> context.

this has to be the single most annoying issue left in lenny's php
but we haven't had a great deal of success in tracking it down.

> #0  0x00007fa08d356fd9 in _zend_hash_add_or_update (ht=0x7fa09775e870,
> arKey=0x7fa0969cd018 "REMOTE_ADDR", nKeyLength=12, 
>     pData=0x88d068fa2, nDataSize=32767, pDest=0x8800003,

i have no idea of it's significant, but nDataSize seems kinda big for
what ought to be an address (assuming that's the size of the object
being inserted/updated).  also, 32767 == 2^15-1 == INT16_MAX (always a
point of interest when you see an integer near a limit at crash-time),
but again don't know if it's relevant.

are you at all able to reproduce the issue with a simple script (or perhaps
by a second script which loops around calling the first until it crashes?)


thanks,

	sean
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 190 bytes
Desc: Digital signature
URL: <http://lists.alioth.debian.org/pipermail/pkg-php-maint/attachments/20091029/e538a481/attachment.pgp>