Bug #69406 [Asn->Fbk]: PHP crashes with 0xC00000005 (EACCESS): dangling pointer and double free?

Edit report at https://bugs.php.net/bug.php?id=69406&edit=1 ID: 69406 Updated by: yohgaki@php.net Reported by: jan dot starke at t-systems dot com Summary: PHP crashes with 0xC00000005 (EACCESS): dangling pointer and double free? -Status: Assigned +Status: Feedback Type: Bug Package: Reproducible crash Operating System: Windows PHP Version: 5.6.7 Assigned To: yohgaki Block user comment: N Private report: N New Comment: Applied from PHP-5.5 upto master. https://github.com/php/php-src/commit/e881017a7556061a8cff084bc823319270d4044e @jan, when you could test how it goes, please update this bug report. Thank you. Previous Comments: ------------------------------------------------------------------------ [2015-04-24 06:59:05] yohgaki@php.net I couldn't reproduce crash with invalid save_path setting, but this is possible patch. It does not harm any, so I may commit it see if it works. [yohgaki@dev github-php-src]$ git diff diff --git a/ext/session/mod_files.c b/ext/session/mod_files.c index 195104f..9dbe507 100644 --- a/ext/session/mod_files.c +++ b/ext/session/mod_files.c @@ -325,6 +325,7 @@ PS_CLOSE_FUNC(files) if (data->lastkey) { efree(data->lastkey); + data->lastkey = NULL; } efree(data->basedir); ------------------------------------------------------------------------ [2015-04-10 09:33:44] laruence@php.net yohgaki, could you please take care of this? ------------------------------------------------------------------------ [2015-04-09 09:40:12] jan dot starke at t-systems dot com fixed typo in my email address, sorry ------------------------------------------------------------------------ [2015-04-09 08:46:17] jan dot starke at t-systems dot com Description: ------------ Preconditions: - PHP running in IIS using FastCGI - error_log is set to "syslog" - session.save_path points to a directory to which the application pool user doesn't have write access Test script: --------------- <? session_start(); echo (phpinfo()); ?> Expected result: ---------------- accessing the page should do: - report an error, such as "php[6288] PHP Warning: session_start(): open(D:\sessions\sess_2bpr1lnu59pc559ng7dm0onau3, O_RDWR) failed: Permission denied (13) in [...]" - display the result of phpinfo() Actual result: -------------- On every first of two requests, php behaves as expected. On every second request, PHP: - logs a part of the response in the expected event entry, just before " session_start(): " this looks like a dangling pointer, which should point to the name of the currently executed php function, but actually points to any place of the zend heap. possibly someone forgot to zero some pointer variable after freeing the memory it pointed to? - PHP crashes with 0xc0000005, the callstack is the following: > php5.dll!_efree(void * ptr=0x010aa660) Zeile 2440 C php5.dll!closelog() Zeile 70 C php5.dll!php_request_shutdown(void * dummy=0x00000000) Zeile 1854 C php-cgi.exe!main(int argc=0x00000001, char * * argv=0x00bcafb0) Zeile 2508 C php-cgi.exe!__tmainCRTStartup() Zeile 536 C The error message is: "Unbehandelte Ausnahme bei 0x6DAE5189 (php5.dll) in php-cgi.exe_150318_151707.dmp: 0xC0000005: Zugriffsverletzung beim Lesen an Position 0x717418CC" It seems the memory which is to be freed has already been freed before, but the pointer has not been set to NULL. The similar problem than before? ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=69406&edit=1