Bug #65593 [Asn]: Segfault when calling ob_start from output buffering callback.

Edit report at https://bugs.php.net/bug.php?id=65593&edit=1 ID: 65593 Updated by: mike@php.net Reported by: arjen at react dot com Summary: Segfault when calling ob_start from output buffering callback. Status: Assigned Type: Bug Package: Reproducible crash Operating System: Linux PHP Version: 5.4Git-2013-08-30 (Git) Assigned To: mike Block user comment: N Private report: N New Comment: Simpler test case: ob_start(function(){ob_start();}); The ob layer was not written with closures in mind. Actually I faced the exact same problem in several other extensions. @laruence, why ain't the closure just put in the GC if it cant be destroyed now? Previous Comments: ------------------------------------------------------------------------ [2015-02-17 14:29:16] laruence@php.net we need a way to indicate dtor is called: diff --git a/main/output.c b/main/output.c index f9b8a68..34b638f 100644 --- a/main/output.c +++ b/main/output.c @@ -714,7 +714,13 @@ PHPAPI int php_output_handler_hook(php_output_handler_hook_t type, void *arg TSR * Destroy an output handler */ PHPAPI void php_output_handler_dtor(php_output_handler *handler TSRMLS_DC) { - STR_FREE(handler->name); + if (handler->name) { + STR_FREE(handler->name); + handler->name = NULL; /* prevent recursively calling to this */ + } else { + return; + } + STR_FREE(handler->buffer.data); if (handler->flags & PHP_OUTPUT_HANDLER_USER) { zval_ptr_dtor(&handler->func.user->zoh); ------------------------------------------------------------------------ [2015-02-17 14:21:54] laruence@php.net also exists in 5.5+ ------------------------------------------------------------------------ [2014-11-19 12:22:11] arjen at react dot com php has to be compiled in debug mode: php-5.6.3/bin/php ~/public_html/php/bug65593.php PHP Fatal error: Cannot destroy active lambda function in ~/public_html/php/bug65593.php on line 12 Fatal error: Cannot destroy active lambda function in ~/public_html/php/bug65593.php on line 12 [Wed Nov 19 13:15:22 2014] Script: '~/public_html/php/bug65593.php' --------------------------------------- ~/phpdebug/phpfarm/src/php-5.6.3/main/output.c(717) : Block 0x7f5a1f63ad08 status: Beginning: Cached Freed (invalid) Start: OK End: OK --------------------------------------- [Wed Nov 19 13:15:22 2014] Script: '~/public_html/php/bug65593.php' --------------------------------------- ~/phpdebug/phpfarm/src/php-5.6.3/main/output.c(718) : Block 0x7f5a1f4649c8 status: Beginning: Freed Start: OK End: Overflown (magic=0x0000005A instead of 0x2373547F) At least 4 bytes overflown --------------------------------------- Testscript can be reduced to https://gist.github.com/arjenschol/6389030#file-test-php ------------------------------------------------------------------------ [2014-11-19 09:13:50] mike@php.net Doesn't seem to be an issue anymore? ------------------------------------------------------------------------ [2014-06-05 11:35:34] arjen at react dot com This still crashes 5.5.12 (and 5.6.0beta3): Fatal error: Cannot destroy active lambda function in /mnt/serve-a-lot_arjen/public_html/php/bug65593.php on line 12 *** Error in `/home/arjen/phpdebug/phpfarm/inst/php-5.5.12/bin/php': double free or corruption (!prev): 0x00000000013327d0 *** Program received signal SIGSEGV, Segmentation fault. 0x00007ffff5d03a40 in malloc_consolidate () from /usr/lib/libc.so.6 (gdb) bt #0 0x00007ffff5d03a40 in malloc_consolidate () from /usr/lib/libc.so.6 #1 0x00007ffff5d04e14 in _int_malloc () from /usr/lib/libc.so.6 #2 0x00007ffff5d07ac7 in calloc () from /usr/lib/libc.so.6 #3 0x00007ffff7de6c37 in _dl_new_object () from /lib64/ld-linux-x86-64.so.2 #4 0x00007ffff7de2204 in _dl_map_object_from_fd () from /lib64/ld-linux-x86-64.so.2 #5 0x00007ffff7de44bb in _dl_map_object () from /lib64/ld-linux-x86-64.so.2 #6 0x00007ffff7def253 in dl_open_worker () from /lib64/ld-linux-x86-64.so.2 #7 0x00007ffff7deaf04 in _dl_catch_error () from /lib64/ld-linux-x86-64.so.2 #8 0x00007ffff7deec23 in _dl_open () from /lib64/ld-linux-x86-64.so.2 #9 0x00007ffff5da8b3d in do_dlopen () from /usr/lib/libc.so.6 #10 0x00007ffff7deaf04 in _dl_catch_error () from /lib64/ld-linux-x86-64.so.2 #11 0x00007ffff5da8bcf in dlerror_run () from /usr/lib/libc.so.6 #12 0x00007ffff5da8c41 in __libc_dlopen_mode () from /usr/lib/libc.so.6 #13 0x00007ffff5d806b5 in init () from /usr/lib/libc.so.6 #14 0x00007ffff5a78f90 in pthread_once () from /usr/lib/libpthread.so.0 #15 0x00007ffff5d807cc in backtrace () from /usr/lib/libc.so.6 #16 0x00007ffff5ca9a44 in backtrace_and_maps () from /usr/lib/libc.so.6 #17 0x00007ffff5cfdf8e in __libc_message () from /usr/lib/libc.so.6 #18 0x00007ffff5d0388e in malloc_printerr () from /usr/lib/libc.so.6 #19 0x00007ffff5d0404b in _int_free () from /usr/lib/libc.so.6 #20 0x0000000000883350 in _efree (ptr=0x13327d0, __zend_filename=0xdd5238 "/home/arjen/phpdebug/phpfarm/src/php-5.5.12/main/output.c", __zend_lineno=718, __zend_orig_filename=0x0, __zend_orig_lineno=0) at /home/arjen/phpdebug/phpfarm/src/php-5.5.12/Zend/zend_alloc.c:2437 #21 0x0000000000840da8 in php_output_handler_dtor (handler=0x132fb00) at /home/arjen/phpdebug/phpfarm/src/php-5.5.12/main/output.c:718 #22 0x0000000000840e6b in php_output_handler_free (h=0x132ffc0) at /home/arjen/phpdebug/phpfarm/src/php-5.5.12/main/output.c:735 #23 0x000000000083fabb in php_output_deactivate () at /home/arjen/phpdebug/phpfarm/src/php-5.5.12/main/output.c:184 #24 0x0000000000828aeb in php_request_shutdown (dummy=0x0) at /home/arjen/phpdebug/phpfarm/src/php-5.5.12/main/main.c:1783 #25 0x0000000000969caa in do_cli (argc=2, argv=0x1143060) at /home/arjen/phpdebug/phpfarm/src/php-5.5.12/sapi/cli/php_cli.c:1177 #26 0x000000000096a39d in main (argc=2, argv=0x1143060) at /home/arjen/phpdebug/phpfarm/src/php-5.5.12/sapi/cli/php_cli.c:1378 ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=65593 -- Edit this bug report at https://bugs.php.net/bug.php?id=65593&edit=1