: Bug #36113 :: Reading records causes malloc(): memory corruption:
| Bug #36113 | Reading records causes malloc(): memory corruption: | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Submitted: | 2006-01-20 23:55 UTC | Modified: | 2006-01-23 23:42 UTC |
|
||||||||||
| From: | kermodebear at kermodebear dot org | Assigned: | tony2001 (profile) | |||||||||||
| Status: | Closed | Package: | dBase related | |||||||||||
| PHP Version: | 5.1.2 | OS: | RedHat Linux | |||||||||||
| Private report: | No | CVE-ID: | None | |||||||||||
[2006-01-20 23:55 UTC] kermodebear at kermodebear dot org
Description:
------------
Reading records from a specific dBase file causes the following error message:
*** glibc detected *** malloc(): memory corruption: 0x09efb7d0 ***
Aborted
However, if dbase_get_header_info() is called before the reading of records, then a different error occurs:
*** glibc detected *** free(): invalid next size (fast): 0x08c4b270 ***
Aborted
You can download the file causing the issue: www.kermodebear.org/php_bug_data/sample.DBF
I thought that the file may be corrupted, so I downloaded three different software packages ('DBF View', 'DBF Viewer 2000', 'DBF Manager') and each of them was able to view the data without a problem. I'm fairly certain that the file itself is not corrupt. Even if it is, PHP should not cause these kinds of errors; The dbase_get_record function should return false on error.
PHP version is 5.1.2;
./configure --enable-dbase
Reproduce code:
---------------
<?php
$h = dbase_open( 'sample.DBF', 0 );
// Uncomment the line below for a different error.
// dbase_get_header_info( $h );
for( $i = 1; $i <= dbase_numrecords( $h ); $i++ ) {
dbase_get_record( $h, $i );
}
?>
Expected result:
----------------
No output at all; The file should be opened, all records should be read, and the script should end.
Actual result:
--------------
[jmiller@DEVEL cli]$ ./php test.php
*** glibc detected *** malloc(): memory corruption: 0x09efb7d0 ***
Aborted
With dbase_get_header_info() called before fetching records:
[jmiller@DEVEL cli]$ ./php test.php
*** glibc detected *** free(): invalid next size (fast): 0x091f60b8 ***
Aborted
Patches
Pull Requests
History
AllCommentsChangesGit/SVN commits
[2006-01-21 01:03 UTC] tony2001@php.net
[2006-01-21 01:47 UTC] kermodebear at kermodebear dot org
[2006-01-23 23:42 UTC] tony2001@php.net