From: aharvey
Operating system: Probably irrelevant (OSX; Linux)
PHP version: 7.0Git-2015-12-01 (Git)
Package: Built-in web server
Bug Type: Bug
Bug description:Segfault in php_cli_server_dispatch_router()
Description:
------------
Using a router script that handles an exception with
set_exception_handler() results in an invalid read occurring in
php_cli_server_dispatch_router() when it attempts to destroy the
retval.
PHP was built with --disable-all --enable-debug, then run with "php -S
0.0.0.0:8888 /tmp/test.php" (test.php is provided as the test script
below), then curl was used to poke the router script via "curl
http://localhost:8888/".
The segfault isn't totally reliable (I've seen it on both OS X 10.11.1
and Ubuntu 15.10, but not completely consistently on either), but the
valgrind output is, and is pasted below:
==22135== Memcheck, a memory error detector
==22135== Copyright (C) 2002-2015, and GNU GPL'd, by Julian Seward et
al.
==22135== Using Valgrind-3.11.0 and LibVEX; rerun with -h for copyright
info
==22135== Command: ./sapi/cli/php -S 0.0.0.0:8888 /tmp/test.php
==22135==
PHP 7.0.1-dev Development Server started at Tue Dec 1 00:41:00 2015
Listening on http://0.0.0.0:8888
Document root is /home/vagrant/php-src/7.0
Press Ctrl-C to quit.
==22135== Conditional jump or move depends on uninitialised value(s)
==22135== at 0xD11824: php_cli_server_dispatch_router
(php_cli_server.c:2054)
==22135== by 0xD1133D: php_cli_server_dispatch
(php_cli_server.c:2092)
==22135== by 0xD0FF84: php_cli_server_recv_event_read_request
(php_cli_server.c:2313)
==22135== by 0xD144DA: php_cli_server_do_event_for_each_fd_callback
(php_cli_server.c:2393)
==22135== by 0xD1424B: php_cli_server_poller_iter_on_active
(php_cli_server.c:834)
==22135== by 0xD0FE7F: php_cli_server_do_event_for_each_fd
(php_cli_server.c:2416)
==22135== by 0xD0FBB9: php_cli_server_do_event_loop
(php_cli_server.c:2426)
==22135== by 0xD0F5B7: do_cli_server (php_cli_server.c:2527)
==22135== by 0xD06DA7: main (php_cli.c:1348)
==22135==
==22135== Conditional jump or move depends on uninitialised value(s)
==22135== at 0xBF14D7: i_zval_ptr_dtor (zend_variables.h:56)
==22135== by 0xBF0F62: _zval_ptr_dtor (zend_execute_API.c:527)
==22135== by 0xD11861: php_cli_server_dispatch_router
(php_cli_server.c:2056)
==22135== by 0xD1133D: php_cli_server_dispatch
(php_cli_server.c:2092)
==22135== by 0xD0FF84: php_cli_server_recv_event_read_request
(php_cli_server.c:2313)
==22135== by 0xD144DA: php_cli_server_do_event_for_each_fd_callback
(php_cli_server.c:2393)
==22135== by 0xD1424B: php_cli_server_poller_iter_on_active
(php_cli_server.c:834)
==22135== by 0xD0FE7F: php_cli_server_do_event_for_each_fd
(php_cli_server.c:2416)
==22135== by 0xD0FBB9: php_cli_server_do_event_loop
(php_cli_server.c:2426)
==22135== by 0xD0F5B7: do_cli_server (php_cli_server.c:2527)
==22135== by 0xD06DA7: main (php_cli.c:1348)
==22135==
==22135== Conditional jump or move depends on uninitialised value(s)
==22135== at 0xBF15AE: zval_delref_p (zend_types.h:826)
==22135== by 0xBF14E5: i_zval_ptr_dtor (zend_variables.h:57)
==22135== by 0xBF0F62: _zval_ptr_dtor (zend_execute_API.c:527)
==22135== by 0xD11861: php_cli_server_dispatch_router
(php_cli_server.c:2056)
==22135== by 0xD1133D: php_cli_server_dispatch
(php_cli_server.c:2092)
==22135== by 0xD0FF84: php_cli_server_recv_event_read_request
(php_cli_server.c:2313)
==22135== by 0xD144DA: php_cli_server_do_event_for_each_fd_callback
(php_cli_server.c:2393)
==22135== by 0xD1424B: php_cli_server_poller_iter_on_active
(php_cli_server.c:834)
==22135== by 0xD0FE7F: php_cli_server_do_event_for_each_fd
(php_cli_server.c:2416)
==22135== by 0xD0FBB9: php_cli_server_do_event_loop
(php_cli_server.c:2426)
==22135== by 0xD0F5B7: do_cli_server (php_cli_server.c:2527)
==22135== by 0xD06DA7: main (php_cli.c:1348)
==22135==
==22135== Use of uninitialised value of size 8
==22135== at 0xBF15DF: zval_delref_p (zend_types.h:827)
==22135== by 0xBF14E5: i_zval_ptr_dtor (zend_variables.h:57)
==22135== by 0xBF0F62: _zval_ptr_dtor (zend_execute_API.c:527)
==22135== by 0xD11861: php_cli_server_dispatch_router
(php_cli_server.c:2056)
==22135== by 0xD1133D: php_cli_server_dispatch
(php_cli_server.c:2092)
==22135== by 0xD0FF84: php_cli_server_recv_event_read_request
(php_cli_server.c:2313)
==22135== by 0xD144DA: php_cli_server_do_event_for_each_fd_callback
(php_cli_server.c:2393)
==22135== by 0xD1424B: php_cli_server_poller_iter_on_active
(php_cli_server.c:834)
==22135== by 0xD0FE7F: php_cli_server_do_event_for_each_fd
(php_cli_server.c:2416)
==22135== by 0xD0FBB9: php_cli_server_do_event_loop
(php_cli_server.c:2426)
==22135== by 0xD0F5B7: do_cli_server (php_cli_server.c:2527)
==22135== by 0xD06DA7: main (php_cli.c:1348)
==22135==
==22135== Conditional jump or move depends on uninitialised value(s)
==22135== at 0xBF66A4: gc_check_possible_root (zend_gc.h:134)
==22135== by 0xBF1511: i_zval_ptr_dtor (zend_variables.h:60)
==22135== by 0xBF0F62: _zval_ptr_dtor (zend_execute_API.c:527)
==22135== by 0xD11861: php_cli_server_dispatch_router
(php_cli_server.c:2056)
==22135== by 0xD1133D: php_cli_server_dispatch
(php_cli_server.c:2092)
==22135== by 0xD0FF84: php_cli_server_recv_event_read_request
(php_cli_server.c:2313)
==22135== by 0xD144DA: php_cli_server_do_event_for_each_fd_callback
(php_cli_server.c:2393)
==22135== by 0xD1424B: php_cli_server_poller_iter_on_active
(php_cli_server.c:834)
==22135== by 0xD0FE7F: php_cli_server_do_event_for_each_fd
(php_cli_server.c:2416)
==22135== by 0xD0FBB9: php_cli_server_do_event_loop
(php_cli_server.c:2426)
==22135== by 0xD0F5B7: do_cli_server (php_cli_server.c:2527)
==22135== by 0xD06DA7: main (php_cli.c:1348)
==22135==
==22135== Conditional jump or move depends on uninitialised value(s)
==22135== at 0xBF66D4: gc_check_possible_root (zend_gc.h:135)
==22135== by 0xBF1511: i_zval_ptr_dtor (zend_variables.h:60)
==22135== by 0xBF0F62: _zval_ptr_dtor (zend_execute_API.c:527)
==22135== by 0xD11861: php_cli_server_dispatch_router
(php_cli_server.c:2056)
==22135== by 0xD1133D: php_cli_server_dispatch
(php_cli_server.c:2092)
==22135== by 0xD0FF84: php_cli_server_recv_event_read_request
(php_cli_server.c:2313)
==22135== by 0xD144DA: php_cli_server_do_event_for_each_fd_callback
(php_cli_server.c:2393)
==22135== by 0xD1424B: php_cli_server_poller_iter_on_active
(php_cli_server.c:834)
==22135== by 0xD0FE7F: php_cli_server_do_event_for_each_fd
(php_cli_server.c:2416)
==22135== by 0xD0FBB9: php_cli_server_do_event_loop
(php_cli_server.c:2426)
==22135== by 0xD0F5B7: do_cli_server (php_cli_server.c:2527)
==22135== by 0xD06DA7: main (php_cli.c:1348)
==22135==
==22135== Use of uninitialised value of size 8
==22135== at 0xBF66E1: gc_check_possible_root (zend_gc.h:135)
==22135== by 0xBF1511: i_zval_ptr_dtor (zend_variables.h:60)
==22135== by 0xBF0F62: _zval_ptr_dtor (zend_execute_API.c:527)
==22135== by 0xD11861: php_cli_server_dispatch_router
(php_cli_server.c:2056)
==22135== by 0xD1133D: php_cli_server_dispatch
(php_cli_server.c:2092)
==22135== by 0xD0FF84: php_cli_server_recv_event_read_request
(php_cli_server.c:2313)
==22135== by 0xD144DA: php_cli_server_do_event_for_each_fd_callback
(php_cli_server.c:2393)
==22135== by 0xD1424B: php_cli_server_poller_iter_on_active
(php_cli_server.c:834)
==22135== by 0xD0FE7F: php_cli_server_do_event_for_each_fd
(php_cli_server.c:2416)
==22135== by 0xD0FBB9: php_cli_server_do_event_loop
(php_cli_server.c:2426)
==22135== by 0xD0F5B7: do_cli_server (php_cli_server.c:2527)
==22135== by 0xD06DA7: main (php_cli.c:1348)
==22135==
==22135== Use of uninitialised value of size 8
==22135== at 0xC4DC3A: gc_possible_root (zend_gc.c:226)
==22135== by 0xBF6713: gc_check_possible_root (zend_gc.h:136)
==22135== by 0xBF1511: i_zval_ptr_dtor (zend_variables.h:60)
==22135== by 0xBF0F62: _zval_ptr_dtor (zend_execute_API.c:527)
==22135== by 0xD11861: php_cli_server_dispatch_router
(php_cli_server.c:2056)
==22135== by 0xD1133D: php_cli_server_dispatch
(php_cli_server.c:2092)
==22135== by 0xD0FF84: php_cli_server_recv_event_read_request
(php_cli_server.c:2313)
==22135== by 0xD144DA: php_cli_server_do_event_for_each_fd_callback
(php_cli_server.c:2393)
==22135== by 0xD1424B: php_cli_server_poller_iter_on_active
(php_cli_server.c:834)
==22135== by 0xD0FE7F: php_cli_server_do_event_for_each_fd
(php_cli_server.c:2416)
==22135== by 0xD0FBB9: php_cli_server_do_event_loop
(php_cli_server.c:2426)
==22135== by 0xD0F5B7: do_cli_server (php_cli_server.c:2527)
==22135==
==22135== Use of uninitialised value of size 8
==22135== at 0xC4DC4E: gc_possible_root (zend_gc.c:226)
==22135== by 0xBF6713: gc_check_possible_root (zend_gc.h:136)
==22135== by 0xBF1511: i_zval_ptr_dtor (zend_variables.h:60)
==22135== by 0xBF0F62: _zval_ptr_dtor (zend_execute_API.c:527)
==22135== by 0xD11861: php_cli_server_dispatch_router
(php_cli_server.c:2056)
==22135== by 0xD1133D: php_cli_server_dispatch
(php_cli_server.c:2092)
==22135== by 0xD0FF84: php_cli_server_recv_event_read_request
(php_cli_server.c:2313)
==22135== by 0xD144DA: php_cli_server_do_event_for_each_fd_callback
(php_cli_server.c:2393)
==22135== by 0xD1424B: php_cli_server_poller_iter_on_active
(php_cli_server.c:834)
==22135== by 0xD0FE7F: php_cli_server_do_event_for_each_fd
(php_cli_server.c:2416)
==22135== by 0xD0FBB9: php_cli_server_do_event_loop
(php_cli_server.c:2426)
==22135== by 0xD0F5B7: do_cli_server (php_cli_server.c:2527)
==22135==
php: /home/vagrant/php-src/7.0/Zend/zend_gc.c:226: void
gc_possible_root(zend_refcounted *): Assertion `(ref)->gc.u.v.type == 7
|| (ref)->gc.u.v.type == 8' failed.
==22135==
==22135== Process terminating with default action of signal 6 (SIGABRT)
==22135== at 0xA88E267: raise (raise.c:55)
==22135== by 0xA88FEC9: abort (abort.c:89)
==22135== by 0xA88703C: __assert_fail_base (assert.c:92)
==22135== by 0xA8870F1: __assert_fail (assert.c:101)
==22135== by 0xC4DC81: gc_possible_root (zend_gc.c:226)
==22135== by 0xBF6713: gc_check_possible_root (zend_gc.h:136)
==22135== by 0xBF1511: i_zval_ptr_dtor (zend_variables.h:60)
==22135== by 0xBF0F62: _zval_ptr_dtor (zend_execute_API.c:527)
==22135== by 0xD11861: php_cli_server_dispatch_router
(php_cli_server.c:2056)
==22135== by 0xD1133D: php_cli_server_dispatch
(php_cli_server.c:2092)
==22135== by 0xD0FF84: php_cli_server_recv_event_read_request
(php_cli_server.c:2313)
==22135== by 0xD144DA: php_cli_server_do_event_for_each_fd_callback
(php_cli_server.c:2393)
==22135==
==22135== HEAP SUMMARY:
==22135== in use at exit: 2,405,356 bytes in 23,054 blocks
==22135== total heap usage: 29,250 allocs, 6,196 frees, 3,120,371
bytes allocated
==22135==
==22135== LEAK SUMMARY:
==22135== definitely lost: 0 bytes in 0 blocks
==22135== indirectly lost: 0 bytes in 0 blocks
==22135== possibly lost: 1,673,791 bytes in 18,116 blocks
==22135== still reachable: 731,565 bytes in 4,938 blocks
==22135== suppressed: 0 bytes in 0 blocks
==22135== Rerun with --leak-check=full to see details of leaked memory
==22135==
==22135== For counts of detected and suppressed errors, rerun with: -v
==22135== Use --track-origins=yes to see where uninitialised values come
from
==22135== ERROR SUMMARY: 9 errors from 9 contexts (suppressed: 0 from
0)
Aborted (core dumped)
Test script:
---------------
<?php
set_exception_handler(function () {});
throw new Exception;
--
Edit bug report at https://bugs.php.net/bug.php?id=71005&edit=1
--
Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=71005&r=trysnapshot54
Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=71005&r=trysnapshot55
Try a snapshot (trunk): https://bugs.php.net/fix.php?id=71005&r=trysnapshottrunk
Fixed in SVN: https://bugs.php.net/fix.php?id=71005&r=fixed
Fixed in release: https://bugs.php.net/fix.php?id=71005&r=alreadyfixed
Need backtrace: https://bugs.php.net/fix.php?id=71005&r=needtrace
Need Reproduce Script: https://bugs.php.net/fix.php?id=71005&r=needscript
Try newer version: https://bugs.php.net/fix.php?id=71005&r=oldversion
Not developer issue: https://bugs.php.net/fix.php?id=71005&r=support
Expected behavior: https://bugs.php.net/fix.php?id=71005&r=notwrong
Not enough info: https://bugs.php.net/fix.php?id=71005&r=notenoughinfo
Submitted twice: https://bugs.php.net/fix.php?id=71005&r=submittedtwice
register_globals: https://bugs.php.net/fix.php?id=71005&r=globals
PHP 4 support discontinued: https://bugs.php.net/fix.php?id=71005&r=php4
Daylight Savings: https://bugs.php.net/fix.php?id=71005&r=dst
IIS Stability: https://bugs.php.net/fix.php?id=71005&r=isapi
Install GNU Sed: https://bugs.php.net/fix.php?id=71005&r=gnused
Floating point limitations: https://bugs.php.net/fix.php?id=71005&r=float
No Zend Extensions: https://bugs.php.net/fix.php?id=71005&r=nozend
MySQL Configuration Error: https://bugs.php.net/fix.php?id=71005&r=mysqlcfg