From:             pollmer at uni-sw dot gwdg dot de
Operating system: SuSE Linux 9.0
PHP version:      5CVS-2004-01-06 (dev)
PHP Bug Type:     Reproducible crash
Bug description:  Segmentation fault

Description:
------------
Segmentation fault happens by running the script via command line and via
apache 1.3.29.
Same behaviour using PHP 5.0.0b3 or 5.0.0b2.

./configure --prefix=/usr/local/php5
--with-apxs=/usr/local/apache/bin/apxs --enable-debug --enable-safe-mode
--with-openssl=/usr --enable-bcmath --enable-calendar
--with-libxml-dir=/usr/include/libxml2 --with-mysql=/usr --with-pgsql=/usr
--enable-trans-id

(gdb) bt
#0  0x08212096 in zend_pzval_unlock_func (z=0x1)
    at /usr/local/src/php5-200401061430/Zend/zend_execute.c:64
#1  0x082125b6 in zend_switch_free (opline=0x404b72b8, Ts=0xbfffcea0)
    at /usr/local/src/php5-200401061430/Zend/zend_execute.c:202
#2  0x0820e6aa in zend_switch_free_handler (execute_data=0xbfffd000, 
    op_array=0x404b6628)
    at /usr/local/src/php5-200401061430/Zend/zend_execute.c:3093
#3  0x08208fb2 in execute (op_array=0x404b6628)
    at /usr/local/src/php5-200401061430/Zend/zend_execute.c:1264
#4  0x081e7770 in zend_execute_scripts (type=8, retval=0x0, file_count=3)
    at /usr/local/src/php5-200401061430/Zend/zend.c:1050
#5  0x081a2ed5 in php_execute_script (primary_file=0xbffff400)
    at /usr/local/src/php5-200401061430/main/main.c:1642
#6  0x082165f4 in main (argc=2, argv=0xbffff494)
    at /usr/local/src/php5-200401061430/sapi/cli/php_cli.c:925


Reproduce code:
---------------
$string = "ab";

$strl = strlen( $string );
for ( $i =0; $i < $strl; $i++ ) {
    switch( $string[$i] ) {
        case 'a':
            echo 'a ';
            break;
        case 'b':
            echo 'b ';
            break;
    }
}

Expected result:
----------------
The output of the script should be:

a b


Actual result:
--------------
The output of the script is:

a Segmentation fault 


You'll get the output you want, if you use the script:

$string = "ab";

$strl = strlen( $string );
for ( $i =0; $i < $strl; $i++ ) {
    $string_i = $string[$i];
    switch( $string_i ) {
        case 'a':
            echo 'a ';
            break;
        case 'b':
            echo 'b ';
            break;
    }
}

-- 
Edit bug report at http://bugs.php.net/?id=26816&edit=1
-- 
Try a CVS snapshot (php4):  http://bugs.php.net/fix.php?id=26816&r=trysnapshot4
Try a CVS snapshot (php5):  http://bugs.php.net/fix.php?id=26816&r=trysnapshot5
Fixed in CVS:               http://bugs.php.net/fix.php?id=26816&r=fixedcvs
Fixed in release:           http://bugs.php.net/fix.php?id=26816&r=alreadyfixed
Need backtrace:             http://bugs.php.net/fix.php?id=26816&r=needtrace
Need Reproduce Script:      http://bugs.php.net/fix.php?id=26816&r=needscript
Try newer version:          http://bugs.php.net/fix.php?id=26816&r=oldversion
Not developer issue:        http://bugs.php.net/fix.php?id=26816&r=support
Expected behavior:          http://bugs.php.net/fix.php?id=26816&r=notwrong
Not enough info:            http://bugs.php.net/fix.php?id=26816&r=notenoughinfo
Submitted twice:            http://bugs.php.net/fix.php?id=26816&r=submittedtwice
register_globals:           http://bugs.php.net/fix.php?id=26816&r=globals
PHP 3 support discontinued: http://bugs.php.net/fix.php?id=26816&r=php3
Daylight Savings:           http://bugs.php.net/fix.php?id=26816&r=dst
IIS Stability:              http://bugs.php.net/fix.php?id=26816&r=isapi
Install GNU Sed:            http://bugs.php.net/fix.php?id=26816&r=gnused
Floating point limitations: http://bugs.php.net/fix.php?id=26816&r=float

Reply via email to