Bug #70885 [Com]: session_regenerate_id segfaults

Edit report at https://bugs.php.net/bug.php?id=70885&edit=1 ID: 70885 Comment by: JosiahBradley at gmail dot com Reported by: JosiahBradley at gmail dot com Summary: session_regenerate_id segfaults Status: Feedback Type: Bug Package: Session related Operating System: Amazon Linux PHP Version: 7.0.0RC6 Assigned To: yohgaki Block user comment: N Private report: N New Comment: session.save_path => /usr/local/php5/sessions When running your code: sudo -u php php <?php ini_set('session.save_path','/'); ini_set('session.hash_function',1); ini_set('session.hash_bits_per_character',6); ob_start(); session_start(); var_dump(session_save_path(),session_id()); session_regenerate_id(); var_dump(session_save_path(),session_id()); var_dump(ini_get('session.hash_function'),ini_get('session.hash_bits_per_character')); ?> PHP Warning: session_start(): open(//sess_ZXiPpBRkQ80MdKYrhWszKREGL83, O_RDWR) failed: Permission denied (13) in - on line 6 PHP Warning: session_regenerate_id(): open(//sess_ZXiPpBRkQ80MdKYrhWszKREGL83, O_RDWR) failed: Permission denied (13) in - on line 8 PHP Warning: session_regenerate_id(): Session write failed. ID: files (path: /) in - on line 8 string(1) "/" string(27) "ZXiPpBRkQ80MdKYrhWszKREGL83" string(1) "/" string(27) "ZXiPpBRkQ80MdKYrhWszKREGL83" string(1) "1" string(1) "6" When changing the directory to /tmp where user php can write to the CLI segfaults and there is no output. Here is the output of strace: "<?php\n", 1024) = 6 session_regenerate_id(); var_dump(session_save_path(),session_id()); var_dump(ini_get('session.hash_function'),ini_get('session.hash_bits_per_character')); read(0, "ini_set('session.save_path','/tm"..., 1024) = 37 ?>read(0, "ini_set('session.hash_function',"..., 1024) = 36 read(0, "ini_set('session.hash_bits_per_c"..., 1024) = 46 read(0, "ob_start();\n", 1024) = 12 read(0, "session_start();\n", 1024) = 17 read(0, "var_dump(session_save_path(),ses"..., 1024) = 44 read(0, "session_regenerate_id();\n", 1024) = 25 read(0, "var_dump(session_save_path(),ses"..., 1024) = 44 read(0, "var_dump(ini_get('session.hash_f"..., 1024) = 87 read(0, "?>\n", 1024) = 3 read(0, "", 1024) = 0 gettimeofday({1447295001, 211980}, NULL) = 0 gettimeofday({1447295001, 212072}, NULL) = 0 gettimeofday({1447295001, 212158}, NULL) = 0 open("/dev/urandom", O_RDONLY) = 3 read(3, "_\21A\31\325\376p\251\241+\246\235*n\336\351\305\275\22\307\374'S\206\230\352\325>\334\31\7\350", 32) = 32 close(3) = 0 stat("/tmp/sess_ei0-lWyGDQzU2Ad0xzgOvv5S04e", 0x7ffc18c18240) = -1 ENOENT (No such file or directory) open("/tmp/sess_ei0-lWyGDQzU2Ad0xzgOvv5S04e", O_RDWR|O_CREAT|O_NOFOLLOW, 0600) = 3 fstat(3, {st_mode=S_IFREG|0600, st_size=0, ...}) = 0 getuid() = 501 flock(3, LOCK_EX) = 0 fcntl(3, F_SETFD, FD_CLOEXEC) = 0 fstat(3, {st_mode=S_IFREG|0600, st_size=0, ...}) = 0 pwrite(3, "", 0, 0) = 0 close(3) = 0 gettimeofday({1447295001, 219125}, NULL) = 0 open("/dev/urandom", O_RDONLY) = 3 read(3, "2\352\22\17q\201\33\17VaS\17\203Y\350\212}d\276}\0F\323\24\236\31\303\32/\331m\320", 32) = 32 close(3) = 0 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=0x18} --- +++ killed by SIGSEGV +++ Segmentation fault Notice that the file /tmp/sess_ei0-lWyGDQzU2Ad0xzgOvv5S04e is created. My latest build is from commit fdb14346dce221842310f237a7fa8029bda5d5cc on master. I can't update past that commit because of hash.c not wanting to compile because of missing SHA3 references. Previous Comments: ------------------------------------------------------------------------ [2015-11-12 01:51:02] yohgaki@php.net According to backtrace, it seems empty save_path is causing the segfault. #0 ps_files_path_create (buf=0x7ffc75268dc0 "", data=0x0, key=0x7fb976803068 "DKMeRn,GkcwqPerBP6zex4FaSg3", buflen=4096) at /usr/local/src/php/php-src/ext/session/mod_files.c:117 However, I don't get segfault on my Fedora22. [yohgaki@dev PHP-7.0]$ ./php-bin <?php ini_set('session.hash_function',1); ini_set('session.hash_bits_per_character',6); ob_start(); session_start(); var_dump(session_save_path(),session_id()); session_regenerate_id(); var_dump(session_save_path(),session_id()); var_dump(ini_get('session.hash_function'),ini_get('session.hash_bits_per_character')); ?> string(0) "" string(27) "vwUp0sl8ZjlJL0kE-7WjVi6WXFb" string(0) "" string(27) "wq1vwpb9mH6,M,aLjurTV3TWQz1" string(1) "1" string(1) "6" Empty save_path should use the default tmp directory, usually "/tmp" on Linux. If you use invalid save_path like "/", you should get something like [yohgaki@dev PHP-7.0]$ ./php-bin <?php ini_set('session.save_path','/'); ini_set('session.hash_function',1); ini_set('session.hash_bits_per_character',6); ob_start(); session_start(); var_dump(session_save_path(),session_id()); session_regenerate_id(); var_dump(session_save_path(),session_id()); var_dump(ini_get('session.hash_function'),ini_get('session.hash_bits_per_character')); ?> Warning: session_start(): open(//sess_jxSkw0LA19QJ59sPJz3PR8dyyN2, O_RDWR) failed: Permission denied (13) in - on line 6 string(1) "/" string(27) "jxSkw0LA19QJ59sPJz3PR8dyyN2" Warning: session_regenerate_id(): open(//sess_jxSkw0LA19QJ59sPJz3PR8dyyN2, O_RDWR) failed: Permission denied (13) in - on line 8 Warning: session_regenerate_id(): Session write failed. ID: files (path: /) in - on line 8 string(1) "/" string(27) "jxSkw0LA19QJ59sPJz3PR8dyyN2" string(1) "1" string(1) "6" What is your "session.save_path" setting? Do you see any difference if you set it to "/tmp" explicitly? ------------------------------------------------------------------------ [2015-11-10 16:37:59] JosiahBradley at gmail dot com Unfortunately there was a change, SHA3, to ext/hash that is preventing compilation on either the master or PHP-7.0 branches. Should I file another bug about the SHA3 compilation error or wait until the 12th for the final PHP 7.0 release? Also the link to the snapshot is dead so I continued to use the git source. ------------------------------------------------------------------------ [2015-11-10 05:43:51] reeze@php.net Please try using this snapshot: http://snaps.php.net/php-trunk-latest.tar.gz For Windows: http://windows.php.net/snapshots/ it should been fixed in master. try master branch please. ------------------------------------------------------------------------ [2015-11-10 04:39:44] JosiahBradley at gmail dot com Description: ------------ Whenever session_regenerate_id() is called PHP segfaults. The session file is created in the save path. I am using php-fpm and my configure line is ./configure --enable-debug --prefix=/usr/local --enable-fpm --with-fpm-acl --with-fpm-user=php --with-fpm-group=php --with-config-file-path\ =/usr/local/php5/conf --disable-cgi --disable-short-tags --with-openssl --with-zlib --enable-zip --with-curl=/usr/local/lib --disable-flatf\ ile --enable-opcache --with-gd --with-jpeg-dir=/usr --without-ldap --enable-mbstring --with-mysqli=mysqlnd --with-pdo-mysql=mysqlnd --disab\ le-phar --with-readline --enable-sockets --enable-pcntl --without-pear --with-gnu-ld --with-libdir=lib64 --libdir=/usr/lib64/ php.ini related to session changed from defaults: session.hash_function = 1 session.hash_bits_per_character = 6 Test script: --------------- session_start(); echo session_save_path(); session_regenerate_id(); Expected result: ---------------- The location of the session save path. Actual result: -------------- #0 ps_files_path_create (buf=0x7ffc75268dc0 "", data=0x0, key=0x7fb976803068 "DKMeRn,GkcwqPerBP6zex4FaSg3", buflen=4096) at /usr/local/src/php/php-src/ext/session/mod_files.c:117 #1 0x0000000000649533 in ps_files_key_exists (data=0x7fb976803068, key=0x0) at /usr/local/src/php/php-src/ext/session/mod_files.c:334 #2 0x00000000006478df in zif_session_regenerate_id (execute_data=<optimized out>, return_value=0x7fb9768150b0) at /usr/local/src/php/php-src/ext/session/session.c:2081 #3 0x00000000007ce52d in ZEND_DO_ICALL_SPEC_HANDLER () at /usr/local/src/php/php-src/Zend/zend_vm_execute.h:586 #4 0x00000000007c0cdb in execute_ex (ex=<optimized out>) at /usr/local/src/php/php-src/Zend/zend_vm_execute.h:414 #5 0x0000000000809d47 in zend_execute (op_array=0x7fb976874000, op_array@entry=0x7fb9768692c0, return_value=return_value@entry=0x7fb976815030) at /usr/local/src/php/php-src/Zend/zend_vm_execute.h:458 #6 0x0000000000785cd4 in zend_execute_scripts (type=type@entry=8, retval=0x7fb976815030, retval@entry=0x0, file_count=file_count@entry=3) at /usr/local/src/php/php-src/Zend/zend.c:1428 #7 0x000000000072ac40 in php_execute_script (primary_file=primary_file@entry=0x7ffc7526c290) at /usr/local/src/php/php-src/main/main.c:2471 #8 0x000000000043f30c in main (argc=<optimized out>, argv=<optimized out>) at /usr/local/src/php/php-src/sapi/fpm/fpm/fpm_main.c:1944 ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=70885&edit=1