Bug #66470 [NEW]: PHP crash (php segmentation fault)

From: os at irj dot ru Operating system: Linux Debian Sid x64 PHP version: 5.5.8 Package: *General Issues Bug Type: Bug Bug description:PHP crash (php segmentation fault) Description: ------------ Hellow. PHP Crashed on Debian Sid x64 This error occurred on some pages You can download full core dump file: https://www.dropbox.com/s/azy1r6e725w21v0/core.php5-cgi.11199 root@home:/var/log/dumps# dpkg -l | grep php5 ii php5-cgi 5.5.8+dfsg-1 amd64 server-side, HTML-embedded scripting language (CGI binary) ii php5-cli 5.5.8+dfsg-1 amd64 command-line interpreter for the php5 scripting language ii php5-common 5.5.8+dfsg-1 amd64 Common files for packages built from the php5 source ii php5-curl 5.5.8+dfsg-1 amd64 CURL module for php5 ii php5-dbg 5.5.8+dfsg-1 amd64 Debug symbols for PHP5 ii php5-dev 5.5.8+dfsg-1 amd64 Files for PHP5 module development ii php5-gd 5.5.8+dfsg-1 amd64 GD module for php5 ii php5-json 1.3.2-2 amd64 JSON module for php5 ii php5-mcrypt 5.5.8+dfsg-1 amd64 MCrypt module for php5 ii php5-mysqlnd 5.5.8+dfsg-1 amd64 MySQL module for php5 (Native Driver) root@home:/var/log/dumps# gdb /usr/bin/php5-cgi core.php5-cgi.11199 GNU gdb (GDB) 7.6.1 (Debian 7.6.1-1) ... (gdb) bt (gdb) bt #0 _zend_mm_alloc_int (heap=0x103c300, size=33) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_alloc.c:1910 #1 0x00000000006acf92 in _estrndup (s=0x13c717c "Всё для кормления", length=32) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_alloc.c:2650 #2 0x00000000006d0b04 in _zval_copy_ctor_func (zvalue=0x143bc80) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_variables.c:123 #3 0x00007fb347fc4902 in _zval_copy_ctor (zvalue=<optimized out>) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_variables.h:45 #4 mysqlnd_rset_zval_ptr_dtor (zv=0x1429f88, type=<optimized out>, copy_ctor_called=0x7fffb835ffaf "\001") at /build/php5-EG7b3R/php5-5.5.8+dfsg/ext/mysqlnd/mysqlnd_result.c:110 #5 0x00007fb347fc4c16 in php_mysqlnd_res_free_buffered_data_pub (result=0x139b460) at /build/php5-EG7b3R/php5-5.5.8+dfsg/ext/mysqlnd/mysqlnd_result.c:200 #6 0x00007fb347fc4e05 in php_mysqlnd_res_free_result_buffers_pub (result=0x139b460) at /build/php5-EG7b3R/php5-5.5.8+dfsg/ext/mysqlnd/mysqlnd_result.c:244 #7 0x00007fb347fc3cba in mysqlnd_internal_free_result_contents (result=0x139b460) at /build/php5-EG7b3R/php5-5.5.8+dfsg/ext/mysqlnd/mysqlnd_result.c:274 #8 0x00007fb347fc3cea in mysqlnd_internal_free_result (result=0x139b460) at /build/php5-EG7b3R/php5-5.5.8+dfsg/ext/mysqlnd/mysqlnd_result.c:291 #9 0x00007fb347fc3e98 in php_mysqlnd_res_free_result_pub (result=0x139b460, implicit=<optimized out>) at /build/php5-EG7b3R/php5-5.5.8+dfsg/ext/mysqlnd/mysqlnd_result.c:1307 #10 0x00007fb342e2bce0 in mysqli_result_free_storage (object=0x14236f8) at /build/php5-EG7b3R/php5-5.5.8+dfsg/ext/mysqli/mysqli.c:270 #11 0x00000000006f9a34 in zend_objects_store_del_ref_by_handle_ex (handle=80, handlers=<optimized out>) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_objects_API.c:226 #12 0x00000000006f9a53 in zend_objects_store_del_ref (zobject=0x141e7a8) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_objects_API.c:178 #13 0x00000000006c1b90 in _zval_dtor (zvalue=0x141e7a8) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_variables.h:35 #14 i_zval_ptr_dtor (zval_ptr=0x141e7a8) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_execute.h:81 #15 _zval_ptr_dtor (zval_ptr=<optimized out>) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_execute_API.c:426 #16 0x00000000006f3b17 in zend_object_std_dtor (object=0x141e5c8) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_objects.c:54 #17 0x00000000006f3b49 in zend_objects_free_object_storage (object=0x141e5c8) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_objects.c:137 #18 0x00000000006f9a34 in zend_objects_store_del_ref_by_handle_ex (handle=81, handlers=<optimized out>) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_objects_API.c:226 #19 0x00000000006f9a53 in zend_objects_store_del_ref (zobject=0x141ec68) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_objects_API.c:178 #20 0x00000000006c1b90 in _zval_dtor (zvalue=0x141ec68) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_variables.h:35 #21 i_zval_ptr_dtor (zval_ptr=0x141ec68) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_execute.h:81 #22 _zval_ptr_dtor (zval_ptr=<optimized out>) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_execute_API.c:426 #23 0x00000000006f3b17 in zend_object_std_dtor (object=0x141eb80) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_objects.c:54 #24 0x00000000006f3b49 in zend_objects_free_object_storage (object=0x141eb80) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_objects.c:137 #25 0x00000000006f9a34 in zend_objects_store_del_ref_by_handle_ex (handle=82, handlers=<optimized out>) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_objects_API.c:226 #26 0x00000000006f9a53 in zend_objects_store_del_ref (zobject=0x141eb50) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_objects_API.c:178 #27 0x000000000077e535 in _zval_dtor (zvalue=0x141eb50) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_variables.h:35 #28 i_zval_ptr_dtor (zval_ptr=0x141eb50) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_execute.h:81 #29 i_free_compiled_variables (execute_data=0x7fb34c0be8c0) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_execute.c:1510 #30 zend_leave_helper_SPEC (execute_data=0x7fb34c0be8c0) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_vm_execute.h:399 #31 0x00000000006fb718 in execute_ex (execute_data=0x7fb34c0be8c0) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_vm_execute.h:363 #32 0x00000000006c1949 in dtrace_execute_ex (execute_data=<optimized out>) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_dtrace.c:73 #33 0x000000000078218c in zend_do_fcall_common_helper_SPEC (execute_data=0x7fb34c0be7c8) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_vm_execute.h:584 #34 0x00000000006fb718 in execute_ex (execute_data=0x7fb34c0be7c8) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_vm_execute.h:363 #35 0x00000000006c1949 in dtrace_execute_ex (execute_data=<optimized out>) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_dtrace.c:73 #36 0x000000000078218c in zend_do_fcall_common_helper_SPEC (execute_data=0x7fb34c0be6b8) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_vm_execute.h:584 #37 0x00000000006fb718 in execute_ex (execute_data=0x7fb34c0be6b8) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_vm_execute.h:363 #38 0x00000000006c1949 in dtrace_execute_ex (execute_data=<optimized out>) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_dtrace.c:73 #39 0x000000000078218c in zend_do_fcall_common_helper_SPEC (execute_data=0x7fb34c0be5a8) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_vm_execute.h:584 #40 0x00000000006fb718 in execute_ex (execute_data=0x7fb34c0be5a8) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_vm_execute.h:363 #41 0x00000000006c1949 in dtrace_execute_ex (execute_data=<optimized out>) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_dtrace.c:73 #42 0x0000000000780b72 in ZEND_INCLUDE_OR_EVAL_SPEC_VAR_HANDLER (execute_data=0x7fb34c0be488) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_vm_execute.h:13370 #43 0x00000000006fb718 in execute_ex (execute_data=0x7fb34c0be488) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_vm_execute.h:363 #44 0x00000000006c1949 in dtrace_execute_ex (execute_data=<optimized out>) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_dtrace.c:73 #45 0x000000000078218c in zend_do_fcall_common_helper_SPEC (execute_data=0x7fb34c0be320) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_vm_execute.h:584 #46 0x00000000006fb718 in execute_ex (execute_data=0x7fb34c0be320) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_vm_execute.h:363 #47 0x00000000006c1949 in dtrace_execute_ex (execute_data=<optimized out>) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_dtrace.c:73 #48 0x000000000078218c in zend_do_fcall_common_helper_SPEC (execute_data=0x7fb34c0be1c0) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_vm_execute.h:584 #49 0x00000000006fb718 in execute_ex (execute_data=0x7fb34c0be1c0) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_vm_execute.h:363 #50 0x00000000006c1949 in dtrace_execute_ex (execute_data=<optimized out>) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_dtrace.c:73 #51 0x00000000007816bf in ZEND_INCLUDE_OR_EVAL_SPEC_CONST_HANDLER (execute_data=0x7fb34c0be0c0) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_vm_execute.h:2748 #52 0x00000000006fb718 in execute_ex (execute_data=0x7fb34c0be0c0) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_vm_execute.h:363 #53 0x00000000006c1949 in dtrace_execute_ex (execute_data=<optimized out>) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_dtrace.c:73 #54 0x00000000006d3330 in zend_execute_scripts (type=type@entry=8, retval=retval@entry=0x0, file_count=file_count@entry=3) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend.c:1316 #55 0x0000000000673585 in php_execute_script (primary_file=primary_file@entry=0x7fffb83634c0) at /build/php5-EG7b3R/php5-5.5.8+dfsg/main/main.c:2506 #56 0x000000000046138a in main (argc=1, argv=0x7fffb83637f8) at /build/php5-EG7b3R/php5-5.5.8+dfsg/sapi/cgi/cgi_main.c:2454 Test script: --------------- <?php class app_catalog_categories extends app_models { ... use app_object_sql { save as SQLSave; destroy as SQLDestoy; } public function getAllCategories() { $db = new app_db; $db->query("SELECT * FROM app_catalog_category WHERE public = '1' ORDER BY position"); $objects = array(); while ($row = $db->fetch()) { $object = new app_catalog_category; $objects[] = $object->setAttributes($row); // if comment wish line script work ok! PHP don't crash. } return $objects; } ... } .. <?php trait app_object_sql { /** * Return avail attributes for object * @return array */ abstract function getSQLAttributes(); /** * Setup SQL Attributes to object * @param array $attributes */ public function setAttributes(array $attributes) { foreach ($attributes as $attribute => $value) { if (array_search($attribute, $this->getSQLAttributes()) !== false) { $this->$attribute = $value; } } return $this; } Then i rewrite two method like public function setAttributes(array $attributes) { foreach ($attributes as $attribute => $value) { if (array_search($attribute, $this->getSQLAttributes()) !== false) { $this->$attribute = $value; } } //return $this; } public function getAllCategories() { $db = new app_db; $db->query("SELECT * FROM app_catalog_category FORCE INDEX (position) WHERE public = '1' ORDER BY position"); $objects = array(); while ($row = $db->fetch()) { $object = new app_catalog_category; $object->setAttributes($row); $objects[] = $object; } return $objects; } php-cgi not crashed Expected result: ---------------- segmentation fault -- Edit bug report at https://bugs.php.net/bug.php?id=66470&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=66470&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=66470&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=66470&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=66470&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=66470&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=66470&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=66470&r=needscript Try newer version: https://bugs.php.net/fix.php?id=66470&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=66470&r=support Expected behavior: https://bugs.php.net/fix.php?id=66470&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=66470&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=66470&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=66470&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=66470&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=66470&r=dst IIS Stability: https://bugs.php.net/fix.php?id=66470&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=66470&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=66470&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=66470&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=66470&r=mysqlcfg