From: fabian at tag1consulting dot com
Operating system: Linux / Ubuntu
PHP version: 7.0.0RC5
Package: Reproducible crash
Bug Type: Bug
Bug description:array_merge_recursive corrupts memory of unset items (Drupal 8 test failure)
Description:
------------
This is a very hard to reproduce bug, but I managed to transform it down
to the bare minimum. It is very fragile, too and little changes lead to
it no longer being reproducible.
I am not sure why the autoload.php is needed, but I guess it loads
enough classes so that the memory corruption becomes relevant. I was not
able to create a test case without this autoload.php ...
I imagine if the index is just NULL by accident that then the thing
succeeds even though the memory is corrupted, just because the data
structure are correct by accident ...
This is a pretty critical bug as it clearly leads to a segfault without
the user doing anything problematic.
It also is one of two last blockers for Drupal 8's test suite passing on
PHP 7.
Test script:
---------------
You need Drupal 8, but no database, get setup with the following
commands:
curl http://ftp.drupal.org/files/projects/drupal-8.0.0-rc2.tar.gz
-O
tar xzf drupal-8.0.0-rc2.tar.gz
cd drupal-8.0.0-rc2/
curl
https://gist.githubusercontent.com/LionsAd/73e027259c9ff8444eeb/raw/ab60b2041949f335a079731e4a83030b2bd81878/test_php7_crash.php
-O
mv test_php7_crash.php tc.php
php tc.php
Note: The filename of the script does matter - yes this memory
corruption bug is that fragile :-/.
Expected result:
----------------
Array
(
[html_head] => Array
(
[0] => 0
[2] => 2
)
)
Note:
PHP5 however gives back:
Array
(
[html_head] => Array
(
[0] => 0
[1] => 2
)
)
so the array_merge_recursive() has done an automatic re-index - which
also 'work-arounds' the bug in here and might be the cause of the
problems in the first place.
Actual result:
--------------
Array
(
[html_head] => Array
(
[0] => 0
[Segmentation fault (core dumped)
Core was generated by `php tc.php'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0 print_hash (write_func=write_func@entry=0x755040
<php_output_wrapper>, indent=12, indent@entry=8,
is_object=is_object@entry=0 '\000',
ht=<optimized out>, ht=<optimized out>) at
/home/ubuntu/php7/php-src/Zend/zend.c:202
202 ZEND_WRITE_EX(ZSTR_VAL(string_key), ZSTR_LEN(string_key));
Traceback (most recent call last):
File
"/usr/share/gdb/auto-load/usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.19-gdb.py",
line 63, in <module>
from libstdcxx.v6.printers import register_libstdcxx_printers
ImportError: No module named 'libstdcxx'
(gdb) bt
#0 print_hash (write_func=write_func@entry=0x755040
<php_output_wrapper>, indent=12, indent@entry=8,
is_object=is_object@entry=0 '\000',
ht=<optimized out>, ht=<optimized out>) at
/home/ubuntu/php7/php-src/Zend/zend.c:202
#1 0x00000000007b22fe in zend_print_zval_r_ex
(write_func=write_func@entry=0x755040 <php_output_wrapper>,
expr=expr@entry=0x7f6ed0ce0a20,
indent=indent@entry=8) at /home/ubuntu/php7/php-src/Zend/zend.c:340
#2 0x00000000007b258e in print_hash
(write_func=write_func@entry=0x755040 <php_output_wrapper>, indent=4,
indent@entry=0,
is_object=is_object@entry=0 '\000', ht=<optimized out>,
ht=<optimized out>) at /home/ubuntu/php7/php-src/Zend/zend.c:210
#3 0x00000000007b22fe in zend_print_zval_r_ex (write_func=0x755040
<php_output_wrapper>, expr=0x7f6ed0c13310, indent=indent@entry=0)
at /home/ubuntu/php7/php-src/Zend/zend.c:340
#4 0x00000000007b23c4 in zend_print_zval_r (expr=<optimized out>,
indent=indent@entry=0) at /home/ubuntu/php7/php-src/Zend/zend.c:324
#5 0x00000000006dcda0 in zif_print_r (execute_data=<optimized out>,
return_value=0x7f6ed0c132a0)
at /home/ubuntu/php7/php-src/ext/standard/basic_functions.c:5487
#6 0x00000000007fbc8d in ZEND_DO_ICALL_SPEC_HANDLER () at
/home/ubuntu/php7/php-src/Zend/zend_vm_execute.h:586
#7 0x00000000007ee43b in execute_ex (ex=<optimized out>) at
/home/ubuntu/php7/php-src/Zend/zend_vm_execute.h:414
#8 0x00000000008374c7 in zend_execute (op_array=0x7f6ed0c7e000,
op_array@entry=0x7f6ed0c85120,
return_value=return_value@entry=0x7f6ed0c131f0)
at /home/ubuntu/php7/php-src/Zend/zend_vm_execute.h:458
#9 0x00000000007b31d4 in zend_execute_scripts (type=type@entry=8,
retval=0x7f6ed0c131f0, retval@entry=0x0, file_count=file_count@entry=3)
at /home/ubuntu/php7/php-src/Zend/zend.c:1428
#10 0x0000000000757658 in php_execute_script
(primary_file=primary_file@entry=0x7ffff3fb9660) at
/home/ubuntu/php7/php-src/main/main.c:2471
#11 0x0000000000839093 in do_cli (argc=2, argv=0x15f1e40) at
/home/ubuntu/php7/php-src/sapi/cli/php_cli.c:974
#12 0x0000000000441db0 in main (argc=2, argv=0x15f1e40) at
/home/ubuntu/php7/php-src/sapi/cli/php_cli.c:1345
(gdb)
--
Edit bug report at https://bugs.php.net/bug.php?id=70808&edit=1
--
Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=70808&r=trysnapshot54
Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=70808&r=trysnapshot55
Try a snapshot (trunk): https://bugs.php.net/fix.php?id=70808&r=trysnapshottrunk
Fixed in SVN: https://bugs.php.net/fix.php?id=70808&r=fixed
Fixed in release: https://bugs.php.net/fix.php?id=70808&r=alreadyfixed
Need backtrace: https://bugs.php.net/fix.php?id=70808&r=needtrace
Need Reproduce Script: https://bugs.php.net/fix.php?id=70808&r=needscript
Try newer version: https://bugs.php.net/fix.php?id=70808&r=oldversion
Not developer issue: https://bugs.php.net/fix.php?id=70808&r=support
Expected behavior: https://bugs.php.net/fix.php?id=70808&r=notwrong
Not enough info: https://bugs.php.net/fix.php?id=70808&r=notenoughinfo
Submitted twice: https://bugs.php.net/fix.php?id=70808&r=submittedtwice
register_globals: https://bugs.php.net/fix.php?id=70808&r=globals
PHP 4 support discontinued: https://bugs.php.net/fix.php?id=70808&r=php4
Daylight Savings: https://bugs.php.net/fix.php?id=70808&r=dst
IIS Stability: https://bugs.php.net/fix.php?id=70808&r=isapi
Install GNU Sed: https://bugs.php.net/fix.php?id=70808&r=gnused
Floating point limitations: https://bugs.php.net/fix.php?id=70808&r=float
No Zend Extensions: https://bugs.php.net/fix.php?id=70808&r=nozend
MySQL Configuration Error: https://bugs.php.net/fix.php?id=70808&r=mysqlcfg