Bug #69320 [Csd]: libmagic crash when running laravel tests

Edit report at https://bugs.php.net/bug.php?id=69320&edit=1 ID: 69320 Updated by: ab@php.net Reported by: nikic@php.net Summary: libmagic crash when running laravel tests Status: Closed Type: Bug Package: Reproducible crash PHP Version: master-Git-2015-03-28 (Git) Assigned To: ab Block user comment: N Private report: N New Comment: Should be fixed now. I guess we have one sec patch to go then. I wanted to pack it into the upgraded patch at once, but seems better to wait it's out with the next 5.x so one can do it cleaner in master. Thanks. Previous Comments: ------------------------------------------------------------------------ [2015-03-29 16:00:17] ab@php.net Automatic comment on behalf of ab Revision: http://git.php.net/?p=php-src.git;a=commit;h=aeabea4aa91af64db1fa1a592b92496fb5e293ba Log: Fixed bug #69320 libmagic crash when running laravel tests ------------------------------------------------------------------------ [2015-03-28 19:37:41] nikic@php.net Just did a clean build and still seeing the segfault. It also segfaults on Laravel's travis build, see https://travis-ci.org/laravel/framework/jobs/56238603. And yeah, your two-line reproduce script segfaults for me as well. But ext/fileinfo tests all run clean. ------------------------------------------------------------------------ [2015-03-28 19:22:34] ab@php.net Of course there could be some bugs after upgrade. Looking at the test https://github.com/laravel/framework/blob/5.0/tests/Filesystem/FilesystemTest.php#L228 and at the https://github.com/laravel/framework/blob/5.0/src/Illuminate/Filesystem/Filesystem.php#L186 - the reproduce snippet is as simple as file_put_contents("foo.txt", "foo"); echo finfo_file(finfo_open(FILEINFO_MIME_TYPE), "foo.txt"); However it doesn't crash for me (and is actually present in the phpt suite, like finfo_file_002.phpt and several others). This part looks not correct s = 0x7fffef91350a "", s_len = 18446744073709551615 I'll be able to go directly with lavarel tomorrow and also to check the patch again. Though i just have to ask you to ensure you've a clean rebuild. In general, looks really weird as it should be failing all the way on travis if such a simple piece is buggy :) Thanks. ------------------------------------------------------------------------ [2015-03-28 18:29:54] nikic@php.net @ab Maybe related to recent libmagic update? ------------------------------------------------------------------------ [2015-03-28 18:29:00] nikic@php.net Description: ------------ Running phpunit --filter FilesystemTest::testMimeTypeOutputsMimeType on https://github.com/laravel/framework results in a libmagic crash: #0 __memcpy_sse2_unaligned () at ../sysdeps/x86_64/multiarch/memcpy-sse2-unaligned.S:116 #1 0x0000000000928a4a in _estrndup (s=0x7fffef91350a "", length=18446744073709551615, __zend_filename=0xdb5028 "/home/nikic/php-src/ext/fileinfo/libmagic/softmagic.c", __zend_lineno=2017, __zend_orig_filename=0x0, __zend_orig_lineno=0) at /home/nikic/php-src/Zend/zend_alloc.c:2328 #2 0x000000000062cbdd in magiccheck (ms=0x7fffef8c5700, m=0xd4cae0 <php_magic_database+2639712>) at /home/nikic/php-src/ext/fileinfo/libmagic/softmagic.c:2017 #3 0x000000000062818d in match (ms=0x7fffef8c5700, magic=0xac8478 <php_magic_database+248>, nmagic=10786, s=0x7fffef913508 "", nbytes=3, offset=0, mode=64, text=1, flip=0, indir_level=0, name_count=0x7fffffff9b9a, printed_something=0x7fffffff9b9c, need_separator=0x7fffffff9ba0, returnval=0x7fffffff9adc) at /home/nikic/php-src/ext/fileinfo/libmagic/softmagic.c:202 #4 0x0000000000627ed0 in file_softmagic (ms=0x7fffef8c5700, buf=0x7fffef913508 "", nbytes=3, indir_level=0, name_count=0x7fffffff9b9a, mode=64, text=1) at /home/nikic/php-src/ext/fileinfo/libmagic/softmagic.c:94 #5 0x000000000061e77c in file_ascmagic_with_encoding (ms=0x7fffef8c5700, buf=0x7fffef601000 "foo", nbytes=3, ubuf=0x13e88e0, ulen=3, code=0xdb4354 "ASCII", type=0xdb4340 "text", text=1) at /home/nikic/php-src/ext/fileinfo/libmagic/ascmagic.c:149 #6 0x000000000061e592 in file_ascmagic (ms=0x7fffef8c5700, buf=0x7fffef601000 "foo", nbytes=3, text=1) at /home/nikic/php-src/ext/fileinfo/libmagic/ascmagic.c:92 #7 0x0000000000624e99 in file_buffer (ms=0x7fffef8c5700, stream=0x7fffef880100, inname=0x0, buf=0x7fffef601000, nb=3) at /home/nikic/php-src/ext/fileinfo/libmagic/funcs.c:264 #8 0x0000000000625fe1 in file_or_stream (ms=0x7fffef8c5700, inname=0x0, stream=0x7fffef880100) at /home/nikic/php-src/ext/fileinfo/libmagic/magic.c:410 #9 0x0000000000625d94 in magic_stream (ms=0x7fffef8c5700, stream=0x7fffef880100) at /home/nikic/php-src/ext/fileinfo/libmagic/magic.c:347 #10 0x000000000061749b in _php_finfo_get_type (execute_data=0x7ffff181a890, return_value=0x7ffff181a880, mode=2, mimetype_emu=0) at /home/nikic/php-src/ext/fileinfo/fileinfo.c:549 #11 0x000000000061768d in zif_finfo_file (execute_data=0x7ffff181a890, return_value=0x7ffff181a880) at /home/nikic/php-src/ext/fileinfo/fileinfo.c:587 #12 0x00000000009c21f2 in ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER () at /home/nikic/php-src/Zend/zend_vm_execute.h:691 #13 0x00000000009c1232 in execute_ex (ex=0x7ffff181a5d0) at /home/nikic/php-src/Zend/zend_vm_execute.h:394 #14 0x0000000000949fbe in zend_call_function (fci=0x7fffffffa3c0, fci_cache=0x7fffffffa390) at /home/nikic/php-src/Zend/zend_execute_API.c:875 #15 0x000000000073b765 in zim_reflection_method_invokeArgs (execute_data=0x7ffff181a550, return_value=0x7ffff181a250) at /home/nikic/php-src/ext/reflection/php_reflection.c:3044 #16 0x00000000009c2915 in ZEND_DO_FCALL_SPEC_HANDLER () at /home/nikic/php-src/Zend/zend_vm_execute.h:827 #17 0x00000000009c1232 in execute_ex (ex=0x7ffff1816030) at /home/nikic/php-src/Zend/zend_vm_execute.h:394 #18 0x00000000009c14a5 in zend_execute (op_array=0x7ffff1885000, return_value=0x0) at /home/nikic/php-src/Zend/zend_vm_execute.h:434 #19 0x00000000009637c3 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /home/nikic/php-src/Zend/zend.c:1355 (gdb) f 2 (gdb) p *ms $2 = {mlist = {0x7fffef8b5d70, 0x7fffef8b5d20}, c = {len = 10, li = 0x7fffef8dd9c0}, o = { buf = 0x0, pbuf = 0x0}, offset = 2, error = -1, flags = 16, event_flags = 0, file = 0xdb2545 "unknown", line = 250, search = {s = 0x7fffef91350a "", s_len = 18446744073709551615, offset = 2, rm_len = 0}, ms_value = {b = 102 'f', h = 28518, l = 7303014, q = 7303014, hs = "fo", hl = "foo", hq = "foo\000\000\000\000", s = "foo", '\000' <repeats 60 times>, us = "foo", '\000' <repeats 60 times>, f = 1,02337023e-38, d = 3,6081683284976653e-317}, indir_max = 15, name_max = 30, elf_shnum_max = 32768, elf_phnum_max = 128, elf_notes_max = 256} ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=69320&edit=1