#41290 [NEW]: ldap_start_tls produces glibc corrupted double-linked list

From: wyatt dot neal at ngc dot com Operating system: RHEL4U4 PHP version: 5.2.2 PHP Bug Type: Reproducible crash Bug description: ldap_start_tls produces glibc corrupted double-linked list Description: ------------ Running PHP version 5.2.2, I can consistently crash php (cli) with a *** glibc detected *** corrupted double-linked list Verified permissions to all files and paths. Running Openldap 2.3. The test code below should reproduce the error without fail. I've verified the same operations against Openldap with a client written in C and this error does not occur. I'll apologize ahead of time for any mis-spellings since I've had to retype the entire backtrace by hand. Reproduce code: --------------- <?php $host = "ldap://host.domain.com"; $tls_cacert = "/etc/openldap/cacerts/cacert.pem"; $tls_cert = "/etc/openldap/certificates/ldap-client.pem"; $tls_key = "/etc/openldap/certificates/ldap-client-key.pem"; putenv("LDAPTLS_CACERT=$tls_cacert"); putenv("LDAPTLS_CERT=$tls_cert"); putenv("LDAPTLS_KEY=$tls_key"); $result = ldap_set_option(NULL, LDAP_OPT_PROTOCOL_VERSION, 3); if(!$result) { exit(0); } $conn = ldap_connect($host); if(!conn) { exit(0); } $result = ldap_start_tls($conn); if(!result) { exit(0); } ?> Expected result: ---------------- A clean exit. Actual result: -------------- (gdb) run test.php ..... [New Tread -1208449344 (LWP 10103)] *** glibc detected *** corrupted double-linked list: 0x09e63d0 *** Program received signal SIGABRT, Aborted. [Switching to Thread -1208449344 (LWP 10103)] 0x0061b7a2 in _dl_sysinfo_int80 () from /lib/ld-linux.so.2 (gdb) bt #0 0x0061b7a2 in _dl_sysinfo_int80 ... #5 0x0016333a in free() from /lib/tls/libc.so.6 #6 0x006f8cf2 in CRYPTO_free() from /lib/libcrypto.so.4 #7 0x00753213 in X509_CINF_free() from /lib/libcrypto.so.4 #8 0x00758003 in ASN1_primitive_free () from /lib/libcrypto.so.4 #9 0x007581d3 in ASN1_item_free () from /lib/libcrypto.so.4 #10 0x00753311 in X509_free() from /lib/libcrypto.so.4 #11 0x00ba353e in ssl_cert_free () from /lib/libssl.so.4 #12 0x00ba11c7 in SSL_CTX_free() from /lib/libssl.so.4 #13 0x009b0e13 in ldap_pvt_tls_init_def_ctx () from /usr/lib/libldap-2.3.so.0 #14 0x009b113e in ldap_pvt_tls_init_def_ctx () from /usr/lib/libldap-2.3.so.0 #15 0x009b1482 in ldap_int_tls_start () from /usr/lib/libldap-2.3.so.0 #16 0x009b1bbc in ldap_start_tls_s () from /usr/lib/libldap-2.3.so.0 #17 0x080f36b2 in zif_ldap_start_tls (ht=1, return_value=0xb7f53120, return_value_ptr=0x0, this_ptr=0x0, return_value_used=1) at /usr/src/debug/php-5.2.2/ext/ldap/ldap.c:2110 #18 0x08255321 in zend_do_fcal_common_helper_SPEC (execute_data=0xbff90b20) at /usr/src/debug/php-5.2.2/Zend/zend_vm_execute.h:200 #19 0x08254a99 in execute (op_array=0xb7f520f8) at /usr/src/debug/php-5.2.2/Zend/zend_vm_execute.h:92 #20 0x0823b8d9 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /usr/src/debug/php-5.2.2/Zend/zend.c:1134 #21 0x08202f29 in php_execute_script (primary_file=0xbff92f80) at /usr/src/debug/php-5.2.2/main/main.c:1794 #22 0x082b619e in main (argc=2, argv=0xbff93054) at /usr/src/debug/php-5.2.2/sapi/cli/php_cli.c:1130 -- Edit bug report at http://bugs.php.net/?id=41290&edit=1 -- Try a CVS snapshot (PHP 4.4): http://bugs.php.net/fix.php?id=41290&r=trysnapshot44 Try a CVS snapshot (PHP 5.2): http://bugs.php.net/fix.php?id=41290&r=trysnapshot52 Try a CVS snapshot (PHP 6.0): http://bugs.php.net/fix.php?id=41290&r=trysnapshot60 Fixed in CVS: http://bugs.php.net/fix.php?id=41290&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=41290&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=41290&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=41290&r=needscript Try newer version: http://bugs.php.net/fix.php?id=41290&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=41290&r=support Expected behavior: http://bugs.php.net/fix.php?id=41290&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=41290&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=41290&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=41290&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=41290&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=41290&r=dst IIS Stability: http://bugs.php.net/fix.php?id=41290&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=41290&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=41290&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=41290&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=41290&r=mysqlcfg