Bug #69320 [Com]: libmagic crash when running laravel tests

Edit report at https://bugs.php.net/bug.php?id=69320&edit=1 ID: 69320 Comment by: nikic@php.net Reported by: nikic@php.net Summary: libmagic crash when running laravel tests Status: Assigned Type: Bug Package: Reproducible crash PHP Version: master-Git-2015-03-28 (Git) Assigned To: ab Block user comment: N Private report: N New Comment: Just did a clean build and still seeing the segfault. It also segfaults on Laravel's travis build, see https://travis-ci.org/laravel/framework/jobs/56238603. And yeah, your two-line reproduce script segfaults for me as well. But ext/fileinfo tests all run clean. Previous Comments: ------------------------------------------------------------------------ [2015-03-28 19:22:34] ab@php.net Of course there could be some bugs after upgrade. Looking at the test https://github.com/laravel/framework/blob/5.0/tests/Filesystem/FilesystemTest.php#L228 and at the https://github.com/laravel/framework/blob/5.0/src/Illuminate/Filesystem/Filesystem.php#L186 - the reproduce snippet is as simple as file_put_contents("foo.txt", "foo"); echo finfo_file(finfo_open(FILEINFO_MIME_TYPE), "foo.txt"); However it doesn't crash for me (and is actually present in the phpt suite, like finfo_file_002.phpt and several others). This part looks not correct s = 0x7fffef91350a "", s_len = 18446744073709551615 I'll be able to go directly with lavarel tomorrow and also to check the patch again. Though i just have to ask you to ensure you've a clean rebuild. In general, looks really weird as it should be failing all the way on travis if such a simple piece is buggy :) Thanks. ------------------------------------------------------------------------ [2015-03-28 18:29:54] nikic@php.net @ab Maybe related to recent libmagic update? ------------------------------------------------------------------------ [2015-03-28 18:29:00] nikic@php.net Description: ------------ Running phpunit --filter FilesystemTest::testMimeTypeOutputsMimeType on https://github.com/laravel/framework results in a libmagic crash: #0 __memcpy_sse2_unaligned () at ../sysdeps/x86_64/multiarch/memcpy-sse2-unaligned.S:116 #1 0x0000000000928a4a in _estrndup (s=0x7fffef91350a "", length=18446744073709551615, __zend_filename=0xdb5028 "/home/nikic/php-src/ext/fileinfo/libmagic/softmagic.c", __zend_lineno=2017, __zend_orig_filename=0x0, __zend_orig_lineno=0) at /home/nikic/php-src/Zend/zend_alloc.c:2328 #2 0x000000000062cbdd in magiccheck (ms=0x7fffef8c5700, m=0xd4cae0 <php_magic_database+2639712>) at /home/nikic/php-src/ext/fileinfo/libmagic/softmagic.c:2017 #3 0x000000000062818d in match (ms=0x7fffef8c5700, magic=0xac8478 <php_magic_database+248>, nmagic=10786, s=0x7fffef913508 "", nbytes=3, offset=0, mode=64, text=1, flip=0, indir_level=0, name_count=0x7fffffff9b9a, printed_something=0x7fffffff9b9c, need_separator=0x7fffffff9ba0, returnval=0x7fffffff9adc) at /home/nikic/php-src/ext/fileinfo/libmagic/softmagic.c:202 #4 0x0000000000627ed0 in file_softmagic (ms=0x7fffef8c5700, buf=0x7fffef913508 "", nbytes=3, indir_level=0, name_count=0x7fffffff9b9a, mode=64, text=1) at /home/nikic/php-src/ext/fileinfo/libmagic/softmagic.c:94 #5 0x000000000061e77c in file_ascmagic_with_encoding (ms=0x7fffef8c5700, buf=0x7fffef601000 "foo", nbytes=3, ubuf=0x13e88e0, ulen=3, code=0xdb4354 "ASCII", type=0xdb4340 "text", text=1) at /home/nikic/php-src/ext/fileinfo/libmagic/ascmagic.c:149 #6 0x000000000061e592 in file_ascmagic (ms=0x7fffef8c5700, buf=0x7fffef601000 "foo", nbytes=3, text=1) at /home/nikic/php-src/ext/fileinfo/libmagic/ascmagic.c:92 #7 0x0000000000624e99 in file_buffer (ms=0x7fffef8c5700, stream=0x7fffef880100, inname=0x0, buf=0x7fffef601000, nb=3) at /home/nikic/php-src/ext/fileinfo/libmagic/funcs.c:264 #8 0x0000000000625fe1 in file_or_stream (ms=0x7fffef8c5700, inname=0x0, stream=0x7fffef880100) at /home/nikic/php-src/ext/fileinfo/libmagic/magic.c:410 #9 0x0000000000625d94 in magic_stream (ms=0x7fffef8c5700, stream=0x7fffef880100) at /home/nikic/php-src/ext/fileinfo/libmagic/magic.c:347 #10 0x000000000061749b in _php_finfo_get_type (execute_data=0x7ffff181a890, return_value=0x7ffff181a880, mode=2, mimetype_emu=0) at /home/nikic/php-src/ext/fileinfo/fileinfo.c:549 #11 0x000000000061768d in zif_finfo_file (execute_data=0x7ffff181a890, return_value=0x7ffff181a880) at /home/nikic/php-src/ext/fileinfo/fileinfo.c:587 #12 0x00000000009c21f2 in ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER () at /home/nikic/php-src/Zend/zend_vm_execute.h:691 #13 0x00000000009c1232 in execute_ex (ex=0x7ffff181a5d0) at /home/nikic/php-src/Zend/zend_vm_execute.h:394 #14 0x0000000000949fbe in zend_call_function (fci=0x7fffffffa3c0, fci_cache=0x7fffffffa390) at /home/nikic/php-src/Zend/zend_execute_API.c:875 #15 0x000000000073b765 in zim_reflection_method_invokeArgs (execute_data=0x7ffff181a550, return_value=0x7ffff181a250) at /home/nikic/php-src/ext/reflection/php_reflection.c:3044 #16 0x00000000009c2915 in ZEND_DO_FCALL_SPEC_HANDLER () at /home/nikic/php-src/Zend/zend_vm_execute.h:827 #17 0x00000000009c1232 in execute_ex (ex=0x7ffff1816030) at /home/nikic/php-src/Zend/zend_vm_execute.h:394 #18 0x00000000009c14a5 in zend_execute (op_array=0x7ffff1885000, return_value=0x0) at /home/nikic/php-src/Zend/zend_vm_execute.h:434 #19 0x00000000009637c3 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /home/nikic/php-src/Zend/zend.c:1355 (gdb) f 2 (gdb) p *ms $2 = {mlist = {0x7fffef8b5d70, 0x7fffef8b5d20}, c = {len = 10, li = 0x7fffef8dd9c0}, o = { buf = 0x0, pbuf = 0x0}, offset = 2, error = -1, flags = 16, event_flags = 0, file = 0xdb2545 "unknown", line = 250, search = {s = 0x7fffef91350a "", s_len = 18446744073709551615, offset = 2, rm_len = 0}, ms_value = {b = 102 'f', h = 28518, l = 7303014, q = 7303014, hs = "fo", hl = "foo", hq = "foo\000\000\000\000", s = "foo", '\000' <repeats 60 times>, us = "foo", '\000' <repeats 60 times>, f = 1,02337023e-38, d = 3,6081683284976653e-317}, indir_max = 15, name_max = 30, elf_shnum_max = 32768, elf_phnum_max = 128, elf_notes_max = 256} ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=69320&edit=1