Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:57253
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain brendata.co.uk designates 109.170.137.202 as permitted sender)
Content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: multipart/alternative;
	boundary="----_=_NextPart_001_01CCCC88.F512A13D"
Date: Fri, 6 Jan 2012 15:36:28 -0000
Message-ID: <6B8895CA39846F4DB78FAE7979D9D77E7BE345@prodntsc2.brendata>
Thread-Topic: debugging PHP memory corruption 
Thread-Index: AczMiPUFQkCV/6hVT+eNRaNoQtXUXw==
To: <internals@lists.php.net>
Subject: debugging PHP memory corruption 
From: amorum@brendata.co.uk ("Andrew Morum")

------_=_NextPart_001_01CCCC88.F512A13D
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

We've got a problem with PHP 5.3.8 and a third party (open source)
library (WSo2 SOAP).

 

At some point during the request to the PHP script, some structures see=
m
to be getting corrupted causing PHP to crash.

 

Depending on the code in the PHP script, it's either crashing during in=

a print_r/var_export or crashing when the PHP shuts down (the exact
location of the crash moves around when we alter the code).

 

We can reprod this on Win32 and Linux now. But how can we go about
debugging where the corruption occurred? The address of the corrupted
data is not known until the segfault/access violation occurs so we can'=
t
set a watch on it (as far as we can tell). 

 

Here's what we see in the debugger on Win32:

 

Unhandled exception at 0x1008eb45 (php5ts.dll) in php-cgi.exe:

Access violation reading location 0x4cac5400

 

php5ts.dll!_zval_ptr_dtor(_zval_struct * * zval_ptr=3D0x4cab5400)  + 0x=
5
bytes        

php5ts.dll!zend_hash_destroy(_hashtable * ht=3D0x034cc0f0)  + 0x27 byte=
s


php5ts.dll!zend_objects_free_object_storage(_zend_object *
object=3D0x03489fa0, void * * * tsrm_ls=3D0x003f42b0)  + 0x2b bytes    =


php5ts.dll!zend_objects_store_free_object_storage(_zend_objects_store *=

objects=3D0x003f685c, void * * * tsrm_ls=3D0x003f42b0)  + 0x9c bytes   =
     

php5ts.dll!shutdown_executor(void * * * tsrm_ls=3D0x003f42b0)  + 0x2fe
bytes       

php5ts.dll!zend_deactivate(void * * * tsrm_ls=3D0x003f42b0)  + 0x91 byt=
es 

php5ts.dll!php_request_shutdown(void * dummy=3D0x00000000)  + 0x31f byt=
es


php-cgi.exe!main(int argc=3D1, char * * argv=3D0x003f31d0)  + 0xe89 byt=
es   

php-cgi.exe!__tmainCRTStartup()  + 0x10f bytes 

 

Any tips welcomed.

 

Andy.

 



The information contained in this email is intended for the personal an=
d confidential use
of the addressee only. It may also be privileged information. If you ar=
e not the intended
recipient then you are hereby notified that you have received this docu=
ment in error and
that any review, distribution or copying of this document is strictly p=
rohibited. If you have 
received  this communication in error, please notify Brendata immediate=
ly on: 

+44 (0)1268 466100, or email 'technical@brendata.co.uk' 

Brendata (UK) Ltd
Nevendon Hall, Nevendon Road, Basildon, Essex. SS13 1BX  UK
Registered Office as above. Registered in England No. 2764339

See our current vacancies at www.brendata.co.uk
------_=_NextPart_001_01CCCC88.F512A13D--