Apache seg faults -- Possible problem with libc? [solved]

[Norbert Papke]

On May 17, 2008, Norbert Papke wrote:
> Environment:  FreeBSD 7.0 Stable (as of Apr 30), apache-2.0.63
>
> I am experiencing Apache crashes on a fairly consistent and frequent basis.
> The crash occurs in strncmp().  To help with the diagnosis, I have rebuilt
> libc with debug symbols.  Here is a typical stack dump:
>
>   #0  strncmp () at /usr/src/lib/libc/i386/string/strncmp.S:69
>   #1  0x2832558c in getenv (name=0x28338648 "TZ")
>      at /usr/src/lib/libc/stdlib/getenv.c:144
>   #2  0x2830ce3a in tzset_basic (rdlocked=0)
>      at /usr/src/lib/libc/stdtime/localtime.c:1013
>   #3  0x2830d42f in localtime (timep=0xbfbfc1d4)
>      at /usr/src/lib/libc/stdtime/localtime.c:1158

The problem is not in libc.  Instead it is caused by Apache's PHP5 module.  
Under certain circumstances, the module will allocate memory for an 
environment variable, pass this variable to putenv(), and then immediately 
free the memory.  putenv(), of course, requires the environment variable to 
remain valid.  The seg fault occurs at a subsequent getenv() invocation.

I have contacted the PHP5 maintainer with this information.

Best,

-- Norbert.