Bug #69769 [NEW]: php throws signal SEGV in php_iconv_string

From: dev at cor0 dot com Operating system: Solaris 10 PHP version: 5.6.9 Package: Reproducible crash Bug Type: Bug Bug description:php throws signal SEGV in php_iconv_string Description: ------------ Attempts to use php 5.6.9 with various php scripts on Apache 2.4.12 within Solaris 10 Sparc results in highly consistent core dumps which all indicate a sigsegv thus : t@1 (l@1) program terminated by signal SEGV (no mapping at the fault address) 0xffffffff7c35e8e4: _iconv+0x002c: jmp %l5 Current function is php_iconv_string 634 result = iconv(cd, (char **) &in_p, &in_left, (char **) &out_p, &out_left); (dbx) where current thread: t@1 [1] _iconv(0xf077a7f7f277a7ef, 0xffffffff7fffe528, 0xffffffff7fffe4e8, 0xffffffff7fffe4d0, 0xffffffff7fffe4d8, 0xffffffff7b33f4a8), at 0xffffffff7c35e8e4 =>[2] php_iconv_string(in_p = 0x101a33228 "Hello, world.\n", in_len = 14U, out = 0xffffffff7fffe630, out_len = 0xffffffff7fffe628, out_charset = 0x101a33208 "UTF-8", in_charset = 0x101a331e8 "UTF-8"), line 634 in "iconv.c" [3] php_if_iconv(ht = 3, return_value = 0x101a33248, return_value_ptr = 0x1019fe0d0, this_ptr = (nil), return_value_used = 1, tsrm_ls = 0x1019f2ff0), line 2461 in "iconv.c" [4] zend_do_fcall_common_helper_SPEC(execute_data = 0x1019fe0e8, tsrm_ls = 0x1019f2ff0), line 558 in "zend_vm_execute.h" [5] ZEND_DO_FCALL_SPEC_CONST_HANDLER(execute_data = 0x1019fe0e8, tsrm_ls = 0x1019f2ff0), line 2599 in "zend_vm_execute.h" [6] execute_ex(execute_data = 0x1019fe0e8, tsrm_ls = 0x1019f2ff0), line 363 in "zend_vm_execute.h" [7] zend_execute(op_array = 0x101a31dd8, tsrm_ls = 0x1019f2ff0), line 388 in "zend_vm_execute.h" [8] zend_eval_stringl(str = 0x1019f5f20 "echo iconv("UTF-8", "UTF-8", "Hello, world.\n");", str_len = 48, retval_ptr = (nil), string_name = 0x1017db850 "Command line code", tsrm_ls = 0x1019f2ff0), line 1077 in "zend_execute_API.c" [9] zend_eval_stringl_ex(str = 0x1019f5f20 "echo iconv("UTF-8", "UTF-8", "Hello, world.\n");", str_len = 48, retval_ptr = (nil), string_name = 0x1017db850 "Command line code", handle_exceptions = 1, tsrm_ls = 0x1019f2ff0), line 1124 in "zend_execute_API.c" [10] zend_eval_string_ex(str = 0x1019f5f20 "echo iconv("UTF-8", "UTF-8", "Hello, world.\n");", retval_ptr = (nil), string_name = 0x1017db850 "Command line code", handle_exceptions = 1, tsrm_ls = 0x1019f2ff0), line 1135 in "zend_execute_API.c" [11] do_cli(argc = 3, argv = 0x1019f2f30, tsrm_ls = 0x1019f2ff0), line 1034 in "php_cli.c" [12] main(argc = 3, argv = 0x1019f2f30), line 1378 in "php_cli.c" (dbx) Highly similar codedumps with 5.6.8 from calls that are downstream of Apache httpd and we end up in the same place : $ dbx /usr/local/bin/httpd time_1433704427-pid_793-uid_80-gid_80-fid_httpd.core Reading httpd core file header read successfully Reading ld.so.1 Reading libpcre.so.1.2.4 Reading libaprutil-1.so.0.5.4 Reading libexpat.so.1.6.0 Reading libiconv.so.2.5.1 Reading libapr-1.so.0.5.1 Reading libuuid.so.1 Reading libsendfile.so.1 Reading librt.so.1 Reading libsocket.so.1 Reading libnsl.so.1 Reading libpthread.so.1 Reading libc.so.1 Reading libaio.so.1 Reading libmd.so.1 Reading libc_psr.so.1 Reading libmp.so.2 Reading libscf.so.1 Reading libdoor.so.1 Reading libuutil.so.1 Reading libgen.so.1 Reading libresolv.so.2 Reading libm.so.2 Reading libldap.so.5 Reading libthread.so.1 Reading libdl.so.1 Reading libsasl.so.1 Reading libmd_psr.so.1 Reading libplc4.so Reading libnspr4.so Reading libssl3.so Reading libnss3.so Reading libnssutil3.so Reading libplds4.so Reading mod_authn_file.so Reading mod_authn_anon.so Reading mod_authn_core.so Reading mod_authz_host.so Reading mod_authz_groupfile.so Reading mod_authz_user.so Reading mod_authz_core.so Reading mod_access_compat.so Reading mod_auth_basic.so Reading mod_auth_digest.so Reading mod_file_cache.so Reading mod_cache.so Reading mod_socache_shmcb.so Reading mod_reqtimeout.so Reading mod_ext_filter.so Reading mod_include.so Reading mod_filter.so Reading mod_deflate.so Reading libz.so.1.2.7 Reading mod_mime.so Reading mod_log_config.so Reading mod_logio.so Reading mod_env.so Reading mod_expires.so Reading mod_headers.so Reading mod_usertrack.so Reading mod_unique_id.so Reading mod_setenvif.so Reading mod_version.so Reading mod_proxy.so Reading mod_proxy_connect.so Reading mod_proxy_ftp.so Reading mod_proxy_http.so Reading mod_unixd.so Reading mod_dav.so Reading mod_status.so Reading mod_autoindex.so Reading mod_info.so Reading mod_suexec.so Reading mod_cgid.so Reading mod_dav_fs.so Reading mod_vhost_alias.so Reading mod_negotiation.so Reading mod_dir.so Reading mod_actions.so Reading mod_speling.so Reading mod_userdir.so Reading mod_alias.so Reading mod_rewrite.so Reading libphp5.so Reading libmysqlclient.so.18.0.0 Reading libgmp.so.10.2.0 Reading libintl.so.8.1.3 Reading libX11.so.4 Reading libXpm.so.4 Reading libpng15.so.15.14.0 Reading libjpeg.so.9.0.0 Reading libssl.so.1.0.0 Reading libcrypto.so.1.0.0 Reading libcurl.so.4.3.0 Reading libidn.so.11.6.12 Reading libssh2.so.1.0.1 Reading libfreetype.so.6.10.0 Reading libxml2.so.2.9.2 Reading libgcc_s.so.1 Reading liblzma.so.5.0.5 Reading mod_ssl.so t@27 (l@27) terminated by signal SEGV (Segmentation Fault) 0xffffffff7d95e884: _iconv+0x002c: jmp %l5 Current function is php_iconv_string dbx: warning: can't find file "/usr/local/build/php-5.6.8_SunOS5.10_sparcv9.001/ext/iconv/iconv.c" dbx: warning: see `help finding-files' (dbx) where current thread: t@27 [1] _iconv(0xf077a7f7f277a7ef, 0xffffffff677fa758, 0xffffffff677fa718, 0xffffffff677fa700, 0xffffffff677fa708, 0xffffffff7e83f4a8), at 0xffffffff7d95e884 =>[2] php_iconv_string(in_p = 0x101161180 "Access denied for user 'teddy'@'fep' to database '"tfs"'", in_len = 56U, out = 0xffffffff677fa860, out_len = 0xffffffff677fa858, out_charset = 0x101162090 "utf-8//TRANSLIT", in_charset = 0x101161fd0 "CP1252"), line 634 in "iconv.c" [3] php_if_iconv(ht = 3, return_value = 0x10110c800, return_value_ptr = 0x100748f68, this_ptr = (nil), return_value_used = 1, tsrm_ls = 0x10069f790), line 2461 in "iconv.c" [4] zend_do_fcall_common_helper_SPEC(execute_data = 0x100749120, tsrm_ls = 0x10069f790), line 558 in "zend_vm_execute.h" [5] ZEND_DO_FCALL_SPEC_CONST_HANDLER(execute_data = 0x100749120, tsrm_ls = 0x10069f790), line 2599 in "zend_vm_execute.h" [6] execute_ex(execute_data = 0x100749120, tsrm_ls = 0x10069f790), line 363 in "zend_vm_execute.h" [7] zend_execute(op_array = 0x10076cb88, tsrm_ls = 0x10069f790), line 388 in "zend_vm_execute.h" [8] zend_execute_scripts(type = 8, tsrm_ls = 0x10069f790, retval = (nil), file_count = 3, ... = 0x12c, ...), line 1341 in "zend.c" [9] php_execute_script(primary_file = 0xffffffff677fb500, tsrm_ls = 0x10069f790), line 2597 in "main.c" [10] php_handler(r = 0x10094aeb0), line 667 in "sapi_apache2.c" [11] ap_run_handler(r = 0x10094aeb0), at 0x10006b260 [12] ap_invoke_handler(r = 0x10094aeb0), line 433 in "config.c" [13] ap_process_async_request(r = 0x10094aeb0), line 317 in "http_request.c" [14] ap_process_http_async_connection(c = 0x1006f99f0), line 143 in "http_core.c" [15] ap_process_http_connection(c = 0x1006f99f0), line 228 in "http_core.c" [16] ap_run_process_connection(c = 0x1006f99f0), at 0x100080530 [17] process_socket(thd = 0x100294418, p = 0x1006f95d8, sock = 0x1006f9660, cs = 0x1006f9968, my_child_num = 1, my_thread_num = 24), line 1037 in "event.c" [18] worker_thread(thd = 0x100294418, dummy = 0x10069a920), line 1872 in "event.c" [19] dummy_worker(opaque = 0x100294418), line 142 in "thread.c" (dbx) quit Test script: --------------- seems related to 53844 because the dbx debugger confirms the segfault : $ dbx /usr/local/bin/php Reading php Reading ld.so.1 Reading libz.so.1.2.8 Reading libresolv.so.2 Reading librt.so.1 Reading libmysqlclient.so.18.0.0 Reading libgmp.so.10.2.0 Reading libX11.so.4 Reading libXpm.so.4 Reading libpng15.so.15.14.0 Reading libm.so.2 Reading libjpeg.so.9.1.0 Reading libsocket.so.1 Reading libnsl.so.1 Reading libssl.so.1.0.0 Reading libcrypto.so.1.0.0 Reading libcurl.so.4.3.0 Reading libidn.so.11.6.12 Reading libintl.so.8.1.3 Reading libc.so.1 Reading libssh2.so.1.0.1 Reading libldap.so.5 Reading libfreetype.so.6.10.1 Reading libxml2.so.2.9.2 Reading liblzma.so.5.2.1 Reading libpthread.so.1 Reading libiconv.so.2.5.1 Reading libaio.so.1 Reading libmd.so.1 Reading libthread.so.1 Reading libgcc_s.so.1 Reading libdl.so.1 (dbx) run -r 'echo iconv("UTF-8", "UTF-8", "Hello, world.\n");' Running: php -r "echo iconv("UTF-8", "UTF-8", "Hello, world.\n");" (process id 4357) Reading libc_psr.so.1 Reading libnspr4.so Reading libXext.so.0 Reading libmp.so.2 Reading libscf.so.1 Reading libdoor.so.1 Reading libuutil.so.1 Reading libgen.so.1 Reading libsasl.so.1 Reading libmd_psr.so.1 Reading libplc4.so Reading libnss3.so Reading libnssutil3.so Reading libplds4.so Reading libssl3.so t@1 (l@1) signal SEGV (no mapping at the fault address) in _iconv at 0xffffffff7c35e8e4 0xffffffff7c35e8e4: _iconv+0x002c: jmp %l5 Current function is php_iconv_string 634 result = iconv(cd, (char **) &in_p, &in_left, (char **) &out_p, &out_left); (dbx) quit Expected result: ---------------- $ /usr/local/bin/php -r 'echo iconv("UTF-8", "UTF-8", "Hello, world.\n");' Hello, world. Actual result: -------------- $ /usr/local/bin/php -r 'echo iconv("UTF-8", "UTF-8", "Hello, world.\n");' Segmentation Fault (core dumped) -- Edit bug report at https://bugs.php.net/bug.php?id=69769&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=69769&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=69769&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=69769&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=69769&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=69769&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=69769&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=69769&r=needscript Try newer version: https://bugs.php.net/fix.php?id=69769&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=69769&r=support Expected behavior: https://bugs.php.net/fix.php?id=69769&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=69769&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=69769&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=69769&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=69769&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=69769&r=dst IIS Stability: https://bugs.php.net/fix.php?id=69769&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=69769&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=69769&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=69769&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=69769&r=mysqlcfg