Bug #67644 [NEW]: Memory corruption & crash

From: jocelyn dot fournier at gmail dot com Operating system: Mac OS X PHP version: 5.4.30 Package: Reproducible crash Bug Type: Bug Bug description:Memory corruption & crash Description: ------------ Hi, When accessing a amqplib function inside an ob_start() callback function, PHP memory is badly corrupted and eventually crashes. Even the backtrace is random : E.g. : * thread #1: tid = 0x665749, 0x00000001004fb525 php54debug`_efree(ptr=0x0000000102af1778, __zend_filename=0x0000000100a2088d, __zend_lineno=357, __zend_orig_filename=0x0000000000000000, __zend_orig_lineno=0) + 85 at zend_alloc.c:2432, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=EXC_I386_GPFLT) frame #0: 0x00000001004fb525 php54debug`_efree(ptr=0x0000000102af1778, __zend_filename=0x0000000100a2088d, __zend_lineno=357, __zend_orig_filename=0x0000000000000000, __zend_orig_lineno=0) + 85 at zend_alloc.c:2432 2429 { 2430 TSRMLS_FETCH(); 2431 -> 2432 if (UNEXPECTED(!AG(mm_heap)->use_zend_alloc)) { 2433 AG(mm_heap)->_free(ptr); 2434 return; 2435 } (lldb) bt * thread #1: tid = 0x665749, 0x00000001004fb525 php54debug`_efree(ptr=0x0000000102af1778, __zend_filename=0x0000000100a2088d, __zend_lineno=357, __zend_orig_filename=0x0000000000000000, __zend_orig_lineno=0) + 85 at zend_alloc.c:2432, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=EXC_I386_GPFLT) * frame #0: 0x00000001004fb525 php54debug`_efree(ptr=0x0000000102af1778, __zend_filename=0x0000000100a2088d, __zend_lineno=357, __zend_orig_filename=0x0000000000000000, __zend_orig_lineno=0) + 85 at zend_alloc.c:2432 frame #1: 0x0000000100532307 php54debug`destroy_op_array(op_array=0x0000000102eca310, tsrm_ls=0x0000000102c00070) + 183 at zend_opcode.c:357 frame #2: 0x0000000100532231 php54debug`destroy_zend_function(function=0x0000000102eca310, tsrm_ls=0x0000000102c00070) + 81 at zend_opcode.c:112 frame #3: 0x0000000100532733 php54debug`zend_function_dtor(function=0x0000000102eca310) + 51 at zend_opcode.c:124 frame #4: 0x000000010055d89e php54debug`zend_hash_destroy(ht=0x0000000102c00650) + 126 at zend_hash.c:560 frame #5: 0x0000000100544b88 php54debug`compiler_globals_dtor(compiler_globals=0x0000000102c006b0, tsrm_ls=0x0000000102c00070) + 56 at zend.c:538 frame #6: 0x0000000100466007 php54debug`tsrm_shutdown + 263 at TSRM.c:180 frame #7: 0x00000001006184dc php54debug`main(argc=2, argv=0x00007fff5fbffab8) + 2220 at php_cli.c:1386 or * thread #1: tid = 0x666260, 0x0000000100471d26 php54debug`php_message_handler_for_zend(message=6, data=0x0000000000000000, tsrm_ls=0x0000000102c00070) + 1542 at main.c:1458, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x40) frame #0: 0x0000000100471d26 php54debug`php_message_handler_for_zend(message=6, data=0x0000000000000000, tsrm_ls=0x0000000102c00070) + 1542 at main.c:1458 1455 datetime_str = php_asctime_r(ta, asctimebuf); 1456 if (datetime_str) { 1457 datetime_str[strlen(datetime_str)-1]=0; /* get rid of the trailing newline */ -> 1458 snprintf(memory_leak_buf, sizeof(memory_leak_buf), "[%s] Script: '%s'\n", datetime_str, SAFE_FILENAME(SG(request_info).path_translated)); 1459 } else { 1460 snprintf(memory_leak_buf, sizeof(memory_leak_buf), "[null] Script: '%s'\n", SAFE_FILENAME(SG(request_info).path_translated)); 1461 } (lldb) bt * thread #1: tid = 0x666260, 0x0000000100471d26 php54debug`php_message_handler_for_zend(message=6, data=0x0000000000000000, tsrm_ls=0x0000000102c00070) + 1542 at main.c:1458, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x40) * frame #0: 0x0000000100471d26 php54debug`php_message_handler_for_zend(message=6, data=0x0000000000000000, tsrm_ls=0x0000000102c00070) + 1542 at main.c:1458 frame #1: 0x0000000100545dea php54debug`zend_message_dispatcher(message=6, data=0x0000000000000000, tsrm_ls=0x0000000102c00070) + 58 at zend.c:972 frame #2: 0x00000001004fa85f php54debug`zend_mm_check_ptr(heap=0x0000000103802200, ptr=0x0000000102af5f98, silent=0, __zend_filename=0x0000000100a2088d, __zend_lineno=378, __zend_orig_filename=0x0000000100a20b7a, __zend_orig_lineno=36) + 191 at zend_alloc.c:1348 frame #3: 0x00000001004faa69 php54debug`zend_mm_check_ptr(heap=0x0000000103802200, ptr=0x0000000102af5f98, silent=1, __zend_filename=0x0000000100a2088d, __zend_lineno=378, __zend_orig_filename=0x0000000100a20b7a, __zend_orig_lineno=36) + 713 at zend_alloc.c:1385 frame #4: 0x00000001004f8d6a php54debug`_zend_mm_free_int(heap=0x0000000103802200, p=0x0000000102af5f98, __zend_filename=0x0000000100a2088d, __zend_lineno=378, __zend_orig_filename=0x0000000100a20b7a, __zend_orig_lineno=36) + 74 at zend_alloc.c:2064 frame #5: 0x00000001004fb590 php54debug`_efree(ptr=0x0000000102af5f98, __zend_filename=0x0000000100a2088d, __zend_lineno=378, __zend_orig_filename=0x0000000100a20b7a, __zend_orig_lineno=36) + 192 at zend_alloc.c:2436 frame #6: 0x0000000100540128 php54debug`_zval_dtor_func(zvalue=0x0000000102af4660, __zend_filename=0x0000000100a2088d, __zend_lineno=378) + 184 at zend_variables.c:36 frame #7: 0x000000010053354c php54debug`_zval_dtor(zvalue=0x0000000102af4660, __zend_filename=0x0000000100a2088d, __zend_lineno=378) + 60 at zend_variables.h:35 frame #8: 0x0000000100532444 php54debug`destroy_op_array(op_array=0x0000000102af5d88, tsrm_ls=0x0000000102c00070) + 500 at zend_opcode.c:378 frame #9: 0x0000000100532231 php54debug`destroy_zend_function(function=0x0000000102af5d88, tsrm_ls=0x0000000102c00070) + 81 at zend_opcode.c:112 frame #10: 0x0000000100532733 php54debug`zend_function_dtor(function=0x0000000102af5d88) + 51 at zend_opcode.c:124 frame #11: 0x000000010055d89e php54debug`zend_hash_destroy(ht=0x0000000102af1300) + 126 at zend_hash.c:560 frame #12: 0x0000000100533278 php54debug`destroy_zend_class(pce=0x0000000102d06f98) + 552 at zend_opcode.c:296 frame #13: 0x000000010055d89e php54debug`zend_hash_destroy(ht=0x000000010511c440) + 126 at zend_hash.c:560 frame #14: 0x0000000100544bc3 php54debug`compiler_globals_dtor(compiler_globals=0x0000000102d00890, tsrm_ls=0x0000000102c00070) + 115 at zend.c:542 frame #15: 0x0000000100466007 php54debug`tsrm_shutdown + 263 at TSRM.c:180 frame #16: 0x00000001006184dc php54debug`main(argc=2, argv=0x00007fff5fbffab8) + 2220 at php_cli.c:1386 Test script: --------------- To reproduce, clone this repository : https://github.com/jocel1/php5.4-crash and execute php app_test.php Note : you should have a rabbitmq server running (the script is using the default rabbitmq params : localhost, port 5672, user : guest, password : guest, vhost : '/') Expected result: ---------------- No crash ! Actual result: -------------- Result in debug : /opt/local/php54-debug/bin/php54debug app_test.php <18:34:17 barPHP Fatal error: Access to undeclared static property: PhpAmqpLib\Channel\AbstractChannel::$PROTOCOL_CONSTANTS_CLASS in /Users/jocelynfournier/Documents/workspace/sylius/web/bug/libs/php-amqplib-2.4.0/PhpAmqpLib/Channel/AbstractChannel.php on line 276 zsh: segmentation fault Result without debug : php app_test.php <18:34:47 barzsh: segmentation fault Result with php 5.5.13 : barPHP Fatal error: Access to undeclared static property: PhpAmqpLib\Channel\AbstractChannel::$PROTOCOL_CONSTANTS_CLASS in /Users/jocelynfournier/Documents/workspace/sylius/web/bug/libs/php-amqplib-2.4.0/PhpAmqpLib/Channel/AbstractChannel.php on line 276 Fatal error: Access to undeclared static property: PhpAmqpLib\Channel\AbstractChannel::$PROTOCOL_CONSTANTS_CLASS in /Users/jocelynfournier/Documents/workspace/sylius/web/bug/libs/php-amqplib-2.4.0/PhpAmqpLib/Channel/AbstractChannel.php on line 276 zend_mm_heap corrupted zsh: segmentation fault -- Edit bug report at https://bugs.php.net/bug.php?id=67644&edit=1 --