From: iand at ekit-inc dot com
Operating system: Solaris 9,10
PHP version: 5.6.10
Package: mcrypt related
Bug Type: Bug
Bug description:mcrypt broken in 5.6.10 fd caching not working
Description:
------------
mcrypt has broken in 5.6.10 on my platform under apache 2.4.12
running with threaded mpm.
$ /opt/local/apache/bin/httpd -M |grep mpm
mpm_worker_module (static)
Symptoms are that under apache, php's use of mcrypt runs into time
limits...
but if you run the same code from php command line it works fine.
Fatal error: Maximum execution time of 30 seconds exceeded in
/opt/local/apache/htdocs/mcr.php on line 7
Inspection with truss shows it is failing to open /dev/urandom
This is a truss from apache 2.4.12 with php 5.6.9:
24686/27: munmap(0xCD3B0000, 4096) = 0
24686/27: munmap(0xCD390000, 7880) = 0
24686/27: munmap(0xCD3A1000, 5040) = 0
24686/27: munmap(0xCD370000, 2724) = 0
24686/27: munmap(0xCD380000, 3028) = 0
24686/27: open("/dev/urandom", O_RDONLY) = 17
24686/27: read(17, "02F7F1F1 3CA $A8", 8) = 8
24686/27: close(17) = 0
24686/27: open("/opt/local/lib/libmcrypt/tripledes.la", O_RDONLY)
= 17
whereas on apache 2.4.12/php 5.6.10 (below) it keeps reading from fd #0
(lsof says this is /dev/null) until the timeout is reached.
25529/27: munmap(0xCD3B0000, 4096) = 0
25529/27: munmap(0xCD390000, 7880) = 0
25529/27: munmap(0xCD3A1000, 5040) = 0
25529/27: munmap(0xCD370000, 2724) = 0
25529/27: munmap(0xCD380000, 3028) = 0
25529/27: read(0, 0x0853CF78, 8) = 0
25529/27: read(0, 0x0853CF78, 8) = 0
25529/27: read(0, 0x0853CF78, 8) = 0
25529/27: read(0, 0x0853CF78, 8) = 0
25529/27: read(0, 0x0853CF78, 8) = 0
Looking at the php change log for 5.6.10 and the related changes in
mcrypt.c
it would seem that the changes here have caused this fail.
Looking at these changes, I can spot one obvious error; the close code
doesn't consider fd#0 an open fd. Patch for this below.
However I suspect there is something else going on perhaps related to
the multi-threaded environment.
$ diff -c mcrypt.c.orig mcrypt.c
*** mcrypt.c.orig Wed Jun 10 07:42:27 2015
--- mcrypt.c Mon Jun 15 03:33:18 2015
***************
*** 450,461 ****
php_stream_filter_unregister_factory("mcrypt.*" TSRMLS_CC);
php_stream_filter_unregister_factory("mdecrypt.*" TSRMLS_CC);
! if (MCG(fd[RANDOM]) > 0) {
close(MCG(fd[RANDOM]));
}
! if (MCG(fd[URANDOM]) > 0) {
close(MCG(fd[URANDOM]));
}
UNREGISTER_INI_ENTRIES();
--- 450,463 ----
php_stream_filter_unregister_factory("mcrypt.*" TSRMLS_CC);
php_stream_filter_unregister_factory("mdecrypt.*" TSRMLS_CC);
! if (MCG(fd[RANDOM]) >= 0) {
close(MCG(fd[RANDOM]));
+ MCG(fd[RANDOM]) = -1;
}
! if (MCG(fd[URANDOM]) >= 0) {
close(MCG(fd[URANDOM]));
+ MCG(fd[URANDOM]) = -1;
}
UNREGISTER_INI_ENTRIES();
-----------
So further debugging is required.
Test script:
---------------
<?php
$plaintext="hello world";
$key = "1;lk23GH2KJ:l*&^$^%$913S";
$encrypted =
bin2hex(mcrypt_encrypt(MCRYPT_3DES,$key,$plaintext,MCRYPT_MODE_ECB,mcrypt_create_iv(mcrypt_get_iv_size(MCRYPT_3DES,MCRYPT_MODE_CFB))));
$decrypted_data =
trim(mcrypt_decrypt(MCRYPT_3DES,$key,hex2bin($encrypted),MCRYPT_MODE_ECB,mcrypt_create_iv(mcrypt_get_iv_size(MCRYPT_3DES,MCRYPT_MODE_CFB))),
"\0");
print "orig=".$plaintext."\n";
print "encr=".$encrypted."\n";
print "decrypted=".$decrypted_data."\n";
if($plaintext != $decrypted_data) {
print "MISMATCH\n";
}
else {
print "MATCH\n";
}
?>
Expected result:
----------------
Instant; no timeout
Actual result:
--------------
timeout
--
Edit bug report at https://bugs.php.net/bug.php?id=69833&edit=1
--
Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=69833&r=trysnapshot54
Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=69833&r=trysnapshot55
Try a snapshot (trunk): https://bugs.php.net/fix.php?id=69833&r=trysnapshottrunk
Fixed in SVN: https://bugs.php.net/fix.php?id=69833&r=fixed
Fixed in release: https://bugs.php.net/fix.php?id=69833&r=alreadyfixed
Need backtrace: https://bugs.php.net/fix.php?id=69833&r=needtrace
Need Reproduce Script: https://bugs.php.net/fix.php?id=69833&r=needscript
Try newer version: https://bugs.php.net/fix.php?id=69833&r=oldversion
Not developer issue: https://bugs.php.net/fix.php?id=69833&r=support
Expected behavior: https://bugs.php.net/fix.php?id=69833&r=notwrong
Not enough info: https://bugs.php.net/fix.php?id=69833&r=notenoughinfo
Submitted twice: https://bugs.php.net/fix.php?id=69833&r=submittedtwice
register_globals: https://bugs.php.net/fix.php?id=69833&r=globals
PHP 4 support discontinued: https://bugs.php.net/fix.php?id=69833&r=php4
Daylight Savings: https://bugs.php.net/fix.php?id=69833&r=dst
IIS Stability: https://bugs.php.net/fix.php?id=69833&r=isapi
Install GNU Sed: https://bugs.php.net/fix.php?id=69833&r=gnused
Floating point limitations: https://bugs.php.net/fix.php?id=69833&r=float
No Zend Extensions: https://bugs.php.net/fix.php?id=69833&r=nozend
MySQL Configuration Error: https://bugs.php.net/fix.php?id=69833&r=mysqlcfg