Bug #67174 [NEW]: cli/TSRM/tsrm_virtual_cwd.c:578 - Program received signal SIGSEGV

From: beber at meleeweb dot net Operating system: Gentoo GNU/Linux PHP version: 5.4.27 Package: Reproducible crash Bug Type: Bug Bug description:cli/TSRM/tsrm_virtual_cwd.c:578 - Program received signal SIGSEGV Description: ------------ I'm getting a SIGSEGV using the following php : # php -v PHP 5.4.27-pl0-gentoo (cli) (built: May 2 2014 00:33:46) (DEBUG) Copyright (c) 1997-2014 The PHP Group Zend Engine v2.4.0, Copyright (c) 1998-2014 Zend Technologies Build options : ./configure --prefix=/usr --build=x86_64-pc-linux-gnu --host=x86_64-pc-linux-gnu --mandir=/usr/share/man --infodir=/usr/share/info --datadir=/usr/share --sysconfdir=/etc --localstatedir=/var/lib --prefix=/usr/lib64/php5.4 --mandir=/usr/lib64/php5.4/man --infodir=/usr/lib64/php5.4/info --libdir=/usr/lib64/php5.4/lib --with-libdir=lib64 --without-pear --disable-maintainer-zts --disable-bcmath --with-bz2=/usr --disable-calendar --enable-ctype --with-curl=/usr --without-curlwrappers --enable-dom --without-enchant --enable-exif --enable-fileinfo --enable-filter --disable-ftp --without-gettext --without-gmp --enable-hash --without-mhash --with-iconv --disable-intl --enable-ipv6 --enable-json --without-kerberos --enable-libxml --with-libxml-dir=/usr --enable-mbstring --with-mcrypt=/usr --without-mssql --with-onig=/usr --with-openssl=/usr --with-openssl-dir=/usr --enable-pcntl --enable-phar --enable-pdo --without-pgsql --enable-posix --without-pspell --without-recode --enable-simplexml --disable-shmop --without-snmp --disable-soap --disable-sockets --with-sqlite3=/usr --without-sybase-ct --disable-sysvmsg --disable-sysvsem --disable-sysvshm --without-fpm-systemd --without-tidy --enable-tokenizer --disable-wddx --enable-xml --enable-xmlreader --enable-xmlwriter --with-xmlrpc --with-xsl=/usr --disable-zip --with-zlib=/usr --enable-debug --without-cdb --without-db4 --disable-flatfile --without-gdbm --disable-inifile --without-qdbm --with-freetype-dir=/usr --with-t1lib=/usr --disable-gd-jis-conv --with-jpeg-dir=/usr --with-png-dir=/usr --without-xpm-dir --with-gd --with-mysql=mysqlnd --with-mysql-sock=/var/run/mysqld/mysqld.sock --with-mysqli=mysqlnd --without-pdo-dblib --with-pdo-mysql=mysqlnd --without-pdo-pgsql --with-pdo-sqlite=/usr --without-pdo-odbc --with-readline=/usr --without-libedit --without-mm --with-pic --with-pcre-regex=/usr --with-pcre-dir=/usr --with-config-file-path=/etc/php/cli-php5.4 --with-config-file-scan-dir=/etc/php/cli-php5.4/ext-active --disable-embed --enable-cli --disable-cgi --disable-fpm --without-apxs2 Using drupal 7.23, 7.x-1.5 entity module. Program received signal SIGSEGV, Segmentation fault. 0x0000555555a5b673 in realpath_cache_key (path=<error reading variable: Cannot access memory at address 0x7fffff7feff8>, path_len=<error reading variable: Cannot access memory at address 0x7fffff7feff4>) at /usr/src/debug/dev-lang/php-5.4.27/sapis-build/cli/TSRM/tsrm_virtual_cwd.c:578 578 { #0 0x0000555555a5b673 in realpath_cache_key (path=<error reading variable: Cannot access memory at address 0x7fffff7feff8>, path_len=<error reading variable: Cannot access memory at address 0x7fffff7feff4>) at /usr/src/debug/dev-lang/php-5.4.27/sapis-build/cli/TSRM/tsrm_virtual_cwd.c:578 h = 44424 e = 0x0 Expected result: ---------------- I should expect a 'Allowed memory size exhausted' or another error, but a SEGV. Actual result: -------------- Full backtrace can be found here (25MB) : http://people.meleeweb.net/~beber/triskel/wwwdev.gdb.txt This is reproducible using apache or cli SAPI with php 5.4.27 and 5.5.10 I seems that an infinite loop is present that lead to memory exhausting. gdb backtrace has 48350 frames. # grep '^#' gdb.txt | awk '{print $4}' | sort | uniq -c | sort -bg 1 ZEND_INCLUDE_OR_EVAL_SPEC_CV_HANDLER 1 do_cli 1 main 1 phar_find_in_include_path 1 phar_resolve_path 1 php_execute_script 1 php_resolve_path 1 php_resolve_path_for_zend 1 realpath_cache_find 1 realpath_cache_key 1 tsrm_realpath 1 virtual_file_ex 1 zend_execute_scripts 2 tsrm_realpath_r 9667 ZEND_DO_FCALL_SPEC_CONST_HANDLER 9667 zend_call_function 9667 zend_do_fcall_common_helper_SPEC 9667 zif_call_user_func_array 9668 execute # grep '^#' gdb.txt | awk '{if ($6 == "at") {print $7}}' | sort | uniq -c | sort -bg 1 /usr/src/debug/dev-lang/php-5.4.27/sapis-build/cli/main/main.c:2502 9668 /usr/src/debug/dev-lang/php-5.4.27/sapis-build/cli/Zend/zend_vm_execute.h:410 -- Edit bug report at https://bugs.php.net/bug.php?id=67174&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=67174&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=67174&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=67174&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=67174&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=67174&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=67174&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=67174&r=needscript Try newer version: https://bugs.php.net/fix.php?id=67174&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=67174&r=support Expected behavior: https://bugs.php.net/fix.php?id=67174&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=67174&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=67174&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=67174&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=67174&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=67174&r=dst IIS Stability: https://bugs.php.net/fix.php?id=67174&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=67174&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=67174&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=67174&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=67174&r=mysqlcfg