Bug #69547 [NEW]: php-fpm segfault (reproducible)

From: waldner at katamail dot com Operating system: Debian wheezy PHP version: 5.6.8 Package: FPM related Bug Type: Bug Bug description:php-fpm segfault (reproducible) Description: ------------ The following request crashes a php-fpm process almost 100% reliably for me. This is nginx + fpm via unix socket from the dotdeb repository. Crucially a request with less headers works (and after that, requests like the one below start working too - though not always). Test script: --------------- curl -X POST -d '{}' -H 'Connection: close' -H 'X-FORWARDED-FOR: 127.0.0.1' -H 'X-REAL-IP: 127.0.0.1' -H 'X-FORWARDED-HOST: 1.2.3.4' -H 'X-FORWARDED-PROTO: https' -H 'Content-Length: 2' -H 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:37.0) Gecko/20100101 Firefox/37.0' -H 'Accept: application/json' -H 'Accept-Language: ca,en-US;q=0.7,en;q=0.3' -H 'Accept-Encoding: gzip, deflate' -H 'Content-Type: application/json; charset=UTF-8' -H 'apikey: YmRhZjQ3MGRlYTczYTllZmFjMTNjNTRhYTgxZDg5YTgyODU0OTVhOQ==' -H 'Referer: https://xxxxxxxxxx.xxxxx.xxx/documentation/' -H 'Cookie: PHPSESSID=9be03814eea0ef3e3a7fbc9a1f69c062' -H 'Pragma: no-cache' -H 'Cache-Control: no-cache' http://127.0.0.1/api/clients Expected result: ---------------- The pool process should process the request without segfaulting. Actual result: -------------- Backtrace: (gdb) bt full #0 0x00000000006e88ea in zend_hash_find (ht=ht@entry=0x7ff11fa6f9b0, arKey=arKey@entry=0x238a820 "Europe/Madrid", nKeyLength=14, pData=pData@entry=0x7ffe4538fac0) at /usr/src/php5.6/nonzts/source/dotdeb-php5/Zend/zend_hash.c:849 h = 1394799404352781269 nIndex = 15313 p = <optimized out> #1 0x000000000043aad4 in php_date_parse_tzfile (formal_tzname=0x238a820 "Europe/Madrid", tzdb=0xea4e00) at /usr/src/php5.6/nonzts/source/dotdeb-php5/ext/date/php_date.c:918 ptzi = <optimized out> #2 0x000000000043c4ca in get_timezone_info () at /usr/src/php5.6/nonzts/source/dotdeb-php5/ext/date/php_date.c:997 tz = 0x238a820 "Europe/Madrid" tzi = <optimized out> #3 0x000000000043e6c5 in php_format_date (format=format@entry=0xb88939 "d-M-Y H:i:s e", format_len=format_len@entry=13, ts=1430320522, localtime=localtime@entry=1) at /usr/src/php5.6/nonzts/source/dotdeb-php5/ext/date/php_date.c:1250 t = 0x271b050 tzi = <optimized out> string = <optimized out> #4 0x0000000000673c92 in php_log_err ( log_message=0x7ff11faa0170 "PHP Deprecated: Automatically populating $HTTP_RAW_POST_DATA is deprecated and will be removed in a future version. To avoid this warning set 'always_populate_raw_post_data' to '-1' in php.ini and us"...) at /usr/src/php5.6/nonzts/source/dotdeb-php5/main/main.c:713 tmp = <optimized out> len = <optimized out> error_time_str = <optimized out> fd = <optimized out> error_time = 1430320522 #5 0x00000000006740a7 in php_error_cb (type=8192, error_filename=0xb6e9d1 "Unknown", error_lineno=0, format=<optimized out>, args=<optimized out>) at /usr/src/php5.6/nonzts/source/dotdeb-php5/main/main.c:1144 log_buffer = 0x7ff11faa0170 "PHP Deprecated: Automatically populating $HTTP_RAW_POST_DATA is deprecated and will be removed in a future version. To avoid this warning set 'always_populate_raw_post_data' to '-1' in php.ini and us"... error_type_str = 0xb6bf0a "Deprecated" buffer = 0x7ff11faa0010 "Automatically populating $HTTP_RAW_POST_DATA is deprecated and will be removed in a future version. To avoid this warning set 'always_populate_raw_post_data' to '-1' in php.ini and use the php://input"... buffer_len = 216 display = <optimized out> #6 0x00000000005887c0 in soap_error_handler (error_num=8192, error_filename=0xb6e9d1 "Unknown", error_lineno=0, format=0xb95098 "Automatically populating $HTTP_RAW_POST_DATA is deprecated and will be removed in a future version. To avoid this warning set 'always_populate_raw_post_data' to '-1' in php.ini and use the php://input"..., args=0x7ffe453902e0) at /usr/src/php5.6/nonzts/source/dotdeb-php5/ext/soap/soap.c:2216 copy = {{gp_offset = 16, fp_offset = 48, overflow_arg_area = 0x7ffe45390400, reg_save_area = 0x7ffe45390310}} tmp = 0x553787cb use_exceptions = <optimized out> _old_in_compilation = 0 '\000' _old_in_execution = 0 '\000' _old_current_execute_data = 0x0 _old_http_response_code = 200 _old_http_status_line = 0x0 #7 0x00000000006da92c in zend_error (type=8192, format=0xb95098 "Automatically populating $HTTP_RAW_POST_DATA is deprecated and will be removed in a future version. To avoid this warning set 'always_populate_raw_post_data' to '-1' in php.ini and use the php://input"...) at /usr/src/php5.6/nonzts/source/dotdeb-php5/Zend/zend.c:1142 args = {{gp_offset = 16, fp_offset = 48, overflow_arg_area = 0x7ffe45390400, reg_save_area = 0x7ffe45390310}} usr_copy = {{gp_offset = 2, fp_offset = 0, overflow_arg_area = 0x2002, reg_save_area = 0x7ff11fa9fa18}} params = <optimized out> retval = <optimized out> z_error_type = <optimized out> z_error_message = <optimized out> z_error_filename = <optimized out> z_error_lineno = <optimized out> z_context = <optimized out> error_filename = 0xb6e9d1 "Unknown" error_lineno = <optimized out> orig_user_error_handler = <optimized out> in_compilation = <optimized out> saved_class_entry = <optimized out> bp_stack = <optimized out> function_call_stack = <optimized out> switch_cond_stack = <optimized out> foreach_copy_stack = <optimized out> object_stack = <optimized out> declare_stack = <optimized out> list_stack = <optimized out> context_stack = <optimized out> #8 0x0000000000681c97 in php_default_post_reader () at /usr/src/php5.6/nonzts/source/dotdeb-php5/main/php_content_types.c:75 length = <optimized out> data = 0x7ff11fa9fd40 "{}" #9 php_default_post_reader () at /usr/src/php5.6/nonzts/source/dotdeb-php5/main/php_content_types.c:51 No locals. #10 0x000000000067e4c7 in sapi_read_post_data () at /usr/src/php5.6/nonzts/source/dotdeb-php5/main/SAPI.c:247 content_type_length = <optimized out> content_type = 0x7ff11fa9f9b0 "application/json; charset=UTF-8" oldchar = <optimized out> post_entry = 0x705846 p = 0x7ff11fa9f9c1 " charset=UTF-8" post_reader_func = <optimized out> #11 sapi_activate () at /usr/src/php5.6/nonzts/source/dotdeb-php5/main/SAPI.c:482 No locals. #12 0x00000000006754cc in php_request_startup () at /usr/src/php5.6/nonzts/source/dotdeb-php5/main/main.c:1632 __orig_bailout = <optimized out> __bailout = {{__jmpbuf = {15610304, -798298996382607278, 140673594877200, 0, 140673594879856, 15501569, 799201161399785554, -798298749005047726}, __mask_was_saved = 0, __saved_mask = { __val = {140673568943750, 140730059785568, 140673594877488, 0, 7876671, 81739, 15610304, 140673594877488, 7912927, 15501628, 2, 81739, 856902, 0, 15610304, 0}}}} retval = 0 #13 0x0000000000433e97 in main (argc=<optimized out>, argv=<optimized out>) at /usr/src/php5.6/nonzts/source/dotdeb-php5/sapi/fpm/fpm/fpm_main.c:1902 primary_script = 0x0 __orig_bailout = 0x0 __bailout = {{__jmpbuf = {0, -798298996382082990, 70, 4294967295, 140730059802835, 15501628, 799201161435437138, -798298438956328878}, __mask_was_saved = 0, __saved_mask = {__val = { 140673540653051, 0, 140673593026626, 0, 0, 0, 0, 0, 0, 0, 0, 4294967296, 0, 0, 0, 0}}}} exit_status = 0 c = <optimized out> use_extended_info = 0 file_handle = {type = ZEND_HANDLE_FILENAME, filename = 0x0, opened_path = 0x0, handle = {fd = 0, fp = 0x0, stream = {handle = 0x0, isatty = 0, mmap = {len = 0, pos = 0, map = 0x0, buf = 0x0, old_handle = 0x0, old_closer = 0}, reader = 0, fsizer = 0, closer = 0}}, free_filename = 0 '\000'} orig_optind = 1 orig_optarg = 0x0 ini_entries_len = 0 max_requests = 0 requests = 0 fcgi_fd = 15610304 request = {listen_socket = 0, fd = 4, id = 1, keep = 0, closed = 0, in_len = 0, in_pad = 6, out_hdr = 0x0, out_pos = 0x7ffe45390900 "", out_buf = '\000' <repeats 8191 times>, reserved = '\000' <repeats 15 times>, env = 0x7ff11fa6e310} fpm_config = 0x7ffe453948d3 "" fpm_prefix = 0x0 fpm_pid = 0x0 test_conf = 0 force_daemon = 1 force_stderr = 0 php_information = 0 php_allow_to_run_as_root = 0 __func__ = "main" The offending code line is: p = ht->arBuckets[nIndex]; ht here is date_globals.tzcache: date_globals.tzcache->arBuckets = (Bucket **) 0x0 It seems to have a valid value until SG(request_info).request_body = php_stream_temp_create_ex(TEMP_STREAM_DEFAULT, SAPI_POST_BLOCK_SIZE, PG(upload_tmp_dir)); (main/SAPI.c, line 282). When php_stream_temp_create_ex returns, it's 0x0. It looks like memory of date_globals.tzcache->arBuckets gets overwritten by emalloc() or similar at some point. -- Edit bug report at https://bugs.php.net/bug.php?id=69547&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=69547&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=69547&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=69547&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=69547&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=69547&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=69547&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=69547&r=needscript Try newer version: https://bugs.php.net/fix.php?id=69547&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=69547&r=support Expected behavior: https://bugs.php.net/fix.php?id=69547&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=69547&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=69547&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=69547&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=69547&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=69547&r=dst IIS Stability: https://bugs.php.net/fix.php?id=69547&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=69547&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=69547&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=69547&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=69547&r=mysqlcfg