Bug #68780 [NEW]: segfault when libxml error occurs

From: webmaster at jbfavre dot org Operating system: debian PHP version: 5.6.4 Package: FPM related Bug Type: Bug Bug description:segfault when libxml error occurs Description: ------------ Using fulltextrss php application, I got a segfault while processing a single URL: http://www.la-croix.com/Actualite/Monde/Une-femen-incarceree-au-Vatican-2014-12-27-1285422 This application purpose is to analyze given URL and extract relevant content (so no ads) from it. I made a core dump and looked into it (backtrace below) Same processing with PHP CLI goes well, without any segfault. Test script: --------------- Unfortunatly, I couldn't identify the exact function that cause segfault. I uploaded whole source code, as well as a core dump and a markdown file explaining how to reproduce it here: http://downloads.jbfavre.org/php-fpm-segfault-libxml.tar.gz Actual result: -------------- #0 _zend_mm_free_int (heap=0x7f7c4dd773f0, p=0x7f7c4dd77400) at /build/php5-8hNTmf/php5-5.6.4+dfsg/Zend/zend_alloc.c:2104 #1 0x000000000068511d in php_verror (docref=0x7f7c4d680c28 "\270\274\227\001", params=0xb27e2b "", type=2, format=0x7f7c4de32538 "\245\265\034\303\326U\367AJ", format@entry=0x2 <error: Cannot access memory at address 0x2>, args=0x0, args@entry=0x7fff1cdca040) at /build/php5-8hNTmf/php5-5.6.4+dfsg/main/main.c:944 #2 0x000000000068556b in php_error_docref0 (docref=docref@entry=0x0, type=type@entry=2, format=format@entry=0xb5835e "%s") at /build/php5-8hNTmf/php5-5.6.4+dfsg/main/main.c:958 #3 0x000000000049b4f3 in php_libxml_internal_error_handler (error_type=error_type@entry=0, ctx=0x0, ap=ap@entry=0x7fff1cdca160, msg=<optimized out>) at /build/php5-8hNTmf/php5-5.6.4+dfsg/ext/libxml/libxml.c:547 #4 0x000000000049b5fc in php_libxml_error_handler (ctx=<optimized out>, msg=<optimized out>) at /build/php5-8hNTmf/php5-5.6.4+dfsg/ext/libxml/libxml.c:727 #5 0x00007f7c5a358eb5 in ?? () from /usr/lib/x86_64-linux-gnu/libxml2.so.2 #6 0x00007f7c5a3591c6 in ?? () from /usr/lib/x86_64-linux-gnu/libxml2.so.2 #7 0x00007f7c5a35b0b5 in __xmlRaiseError () from /usr/lib/x86_64-linux-gnu/libxml2.so.2 #8 0x00007f7c5a36f052 in ?? () from /usr/lib/x86_64-linux-gnu/libxml2.so.2 #9 0x00007f7c5a3773bf in xmlParseElement () from /usr/lib/x86_64-linux-gnu/libxml2.so.2 -- Edit bug report at https://bugs.php.net/bug.php?id=68780&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=68780&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=68780&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=68780&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=68780&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=68780&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=68780&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=68780&r=needscript Try newer version: https://bugs.php.net/fix.php?id=68780&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=68780&r=support Expected behavior: https://bugs.php.net/fix.php?id=68780&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=68780&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=68780&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=68780&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=68780&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=68780&r=dst IIS Stability: https://bugs.php.net/fix.php?id=68780&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=68780&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=68780&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=68780&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=68780&r=mysqlcfg