Bug #71659 [Com]: segmentation fault in pcre running twig tests

Edit report at https://bugs.php.net/bug.php?id=71659&edit=1 ID: 71659 Comment by: ngompa13 at gmail dot com Reported by: nish dot aravamudan at canonical dot com Summary: segmentation fault in pcre running twig tests Status: Open Type: Bug Package: Reproducible crash Operating System: Ubuntu 16.04 PHP Version: 7.0.3 Block user comment: N Private report: N New Comment: I've been able to reproduce the issue on CentOS 7.2 with Remi's php70 SCL with PHP package version 7.0.3-1.el7.remi. Previous Comments: ------------------------------------------------------------------------ [2016-02-24 20:57:30] nish dot aravamudan at canonical dot com Description: ------------ Ubuntu 16.04 is moving to PHP7.0 only, and we are hitting the following failures with the twig test-suite: 1) Twig_Tests_IntegrationTest::testIntegration with data set #214 ('filters/last.test', '"last" filter', '', array('\n{{ [1, 2, 3, 4]|last }}\n{{ {...ast }}'), false, array(array('--DATA--\nreturn array('arr' +=...4\n4\né', '\nreturn array('arr' => new Ar... 4)))\n', '', '\n4\n4\n4\n4\né'))) "last" filter (in filters/last.test) Failed asserting that two strings are equal. --- Expected +++ Actual @@ @@ '4 4 4 4 -é' +�' /build/twig-0SRlZk/twig-1.23.1/lib/Twig/Test/IntegrationTestCase.php:219 /build/twig-0SRlZk/twig-1.23.1/lib/Twig/Test/IntegrationTestCase.php:62 2) Twig_Tests_IntegrationTest::testIntegration with data set #240 ('filters/first.test', '"first" filter', '', array('\n{{ [1, 2, 3, 4]|first }}\n{{ ...rst }}'), false, array(array('--DATA--\nreturn array('arr' +=...1\n1\nÄ', '\nreturn array('arr' => new Ar... 4)))\n', '', '\n1\n1\n1\n1\nÄ'))) "first" filter (in filters/first.test) Failed asserting that two strings are equal. --- Expected +++ Actual @@ @@ '1 1 1 1 -Ä' +�' /build/twig-0SRlZk/twig-1.23.1/lib/Twig/Test/IntegrationTestCase.php:219 /build/twig-0SRlZk/twig-1.23.1/lib/Twig/Test/IntegrationTestCase.php:62 I *believe* the differing character is the result of SUBSTITUTE on the string. That is neither here nor there for this bug report, necessarily, but just context. Ondřej Surý recommended we try and install php-mbstring, but that led to segmentation faults: #0 __memcpy_avx_unaligned () at ../sysdeps/x86_64/multiarch/memcpy-avx-unaligned.S:273 #1 0x00005555556798d8 in memcpy (__len=18446744073709551614, __src=0x7fffed43e1fc, __dest=0x7fffed49e390) at /usr/include/x86_64-linux-gnu/bits/string3.h:53 #2 zend_string_init (persistent=0, len=18446744073709551614, str=0x7fffed43e1fc "\303\237\343\201\224a") at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_string.h:159 #3 php_pcre_split_impl (pce=pce@entry=0x555555d4aea0, subject=0x7fffed43e1f8 "\303\251\303\204\303\237\343\201\224a", subject_len=10, return_value=return_value@entry=0x7ffff381b240, limit_val=-1, flags=<optimized out>) at /build/php7.0-Y7XHJx/php7.0-7.0.3/ext/pcre/php_pcre.c:1808 #4 0x000055555567a1eb in zif_preg_split (execute_data=<optimized out>, return_value=0x7ffff381b240) at /build/php7.0-Y7XHJx/php7.0-7.0.3/ext/pcre/php_pcre.c:1721 #5 0x000055555579b58a in dtrace_execute_internal ( execute_data=<optimized out>, return_value=<optimized out>) at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_dtrace.c:107 #6 0x000055555582f5f0 in ZEND_DO_FCALL_SPEC_HANDLER () at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:844 #7 0x00005555557eaedb in execute_ex (ex=ex@entry=0x7ffff381b070) at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:414 #8 0x000055555579b421 in dtrace_execute_ex (execute_data=0x7ffff381b070) at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_dtrace.c:83 #9 0x000055555582f72d in ZEND_DO_FCALL_SPEC_HANDLER () at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:800 #10 0x00005555557eaedb in execute_ex (ex=ex@entry=0x7ffff3819ff0) at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:414 #11 0x000055555579b421 in dtrace_execute_ex (execute_data=0x7ffff3819ff0) at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_dtrace.c:83 #12 0x000055555582f72d in ZEND_DO_FCALL_SPEC_HANDLER () at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:800 #13 0x00005555557eaedb in execute_ex (ex=ex@entry=0x7ffff3819e80) at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:414 #14 0x000055555579b421 in dtrace_execute_ex (execute_data=0x7ffff3819e80) at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_dtrace.c:83 #15 0x000055555582f72d in ZEND_DO_FCALL_SPEC_HANDLER () at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:800 #16 0x00005555557eaedb in execute_ex (ex=ex@entry=0x7ffff3819db0) at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:414 #17 0x000055555579b421 in dtrace_execute_ex (execute_data=0x7ffff3819db0) at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_dtrace.c:83 #18 0x000055555582f72d in ZEND_DO_FCALL_SPEC_HANDLER () at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:800 #19 0x00005555557eaedb in execute_ex (ex=ex@entry=0x7ffff3819ca0) at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:414 #20 0x000055555579b421 in dtrace_execute_ex (execute_data=0x7ffff3819ca0) at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_dtrace.c:83 #21 0x000055555582f72d in ZEND_DO_FCALL_SPEC_HANDLER () at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:800 #22 0x00005555557eaedb in execute_ex (ex=ex@entry=0x7ffff38192e0) at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:414 #23 0x000055555579b421 in dtrace_execute_ex (execute_data=0x7ffff38192e0) at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_dtrace.c:83 #24 0x000055555582f72d in ZEND_DO_FCALL_SPEC_HANDLER () at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:800 #25 0x00005555557eaedb in execute_ex (ex=ex@entry=0x7ffff3819210) at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:414 #26 0x000055555579b421 in dtrace_execute_ex (execute_data=0x7ffff3819210) at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_dtrace.c:83 #27 0x000055555579d03c in zend_call_function (fci=fci@entry=0x7fffffff9ae0, fci_cache=fci_cache@entry=0x7fffffff9ab0) at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_execute_API.c:860 #28 0x000055555569e042 in zim_reflection_method_invokeArgs ( execute_data=<optimized out>, return_value=0x7ffff3818e60) at /build/php7.0-Y7XHJx/php7.0-7.0.3/ext/reflection/php_reflection.c:3348 #29 0x000055555579b58a in dtrace_execute_internal ( execute_data=<optimized out>, return_value=<optimized out>) at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_dtrace.c:107 #30 0x000055555582f5f0 in ZEND_DO_FCALL_SPEC_HANDLER () at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:844 #31 0x00005555557eaedb in execute_ex (ex=ex@entry=0x7ffff3818c60) at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:414 #32 0x000055555579b421 in dtrace_execute_ex (execute_data=0x7ffff3818c60) at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_dtrace.c:83 #33 0x000055555582f72d in ZEND_DO_FCALL_SPEC_HANDLER () at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:800 #34 0x00005555557eaedb in execute_ex (ex=ex@entry=0x7ffff3818470) at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:414 #35 0x000055555579b421 in dtrace_execute_ex (execute_data=0x7ffff3818470) at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_dtrace.c:83 #36 0x000055555582f72d in ZEND_DO_FCALL_SPEC_HANDLER () at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:800 #37 0x00005555557eaedb in execute_ex (ex=ex@entry=0x7ffff3817880) at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:414 #38 0x000055555579b421 in dtrace_execute_ex (execute_data=0x7ffff3817880) at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_dtrace.c:83 #39 0x000055555582f72d in ZEND_DO_FCALL_SPEC_HANDLER () at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:800 #40 0x00005555557eaedb in execute_ex (ex=ex@entry=0x7ffff3816e20) at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:414 #41 0x000055555579b421 in dtrace_execute_ex (execute_data=0x7ffff3816e20) at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_dtrace.c:83 #42 0x000055555582f72d in ZEND_DO_FCALL_SPEC_HANDLER () at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:800 #43 0x00005555557eaedb in execute_ex (ex=ex@entry=0x7ffff3816840) at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:414 #44 0x000055555579b421 in dtrace_execute_ex (execute_data=0x7ffff3816840) at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_dtrace.c:83 #45 0x000055555582f72d in ZEND_DO_FCALL_SPEC_HANDLER () at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:800 #46 0x00005555557eaedb in execute_ex (ex=ex@entry=0x7ffff3816260) at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:414 #47 0x000055555579b421 in dtrace_execute_ex (execute_data=0x7ffff3816260) at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_dtrace.c:83 #48 0x000055555582f72d in ZEND_DO_FCALL_SPEC_HANDLER () at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:800 #49 0x00005555557eaedb in execute_ex (ex=ex@entry=0x7ffff3815c80) at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:414 #50 0x000055555579b421 in dtrace_execute_ex (execute_data=0x7ffff3815c80) at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_dtrace.c:83 #51 0x000055555582f72d in ZEND_DO_FCALL_SPEC_HANDLER () at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:800 #52 0x00005555557eaedb in execute_ex (ex=ex@entry=0x7ffff3814640) at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:414 #53 0x000055555579b421 in dtrace_execute_ex (execute_data=0x7ffff3814640) at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_dtrace.c:83 #54 0x000055555582f72d in ZEND_DO_FCALL_SPEC_HANDLER () at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:800 #55 0x00005555557eaedb in execute_ex (ex=ex@entry=0x7ffff3814220) at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:414 #56 0x000055555579b421 in dtrace_execute_ex (execute_data=0x7ffff3814220) at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_dtrace.c:83 #57 0x000055555582f72d in ZEND_DO_FCALL_SPEC_HANDLER () at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:800 #58 0x00005555557eaedb in execute_ex (ex=ex@entry=0x7ffff3814130) at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:414 #59 0x000055555579b421 in dtrace_execute_ex (execute_data=0x7ffff3814130) at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_dtrace.c:83 #60 0x000055555582f72d in ZEND_DO_FCALL_SPEC_HANDLER () at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:800 #61 0x00005555557eaedb in execute_ex (ex=ex@entry=0x7ffff3814030) at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:414 #62 0x000055555579b421 in dtrace_execute_ex (execute_data=0x7ffff3814030) at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_dtrace.c:83 #63 0x000055555583e2b7 in zend_execute ( op_array=op_array@entry=0x7ffff3883000, return_value=return_value@entry=0x0) at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:458 #64 0x00005555557ab6b3 in zend_execute_scripts (type=type@entry=8, retval=retval@entry=0x0, file_count=file_count@entry=3) at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend.c:1427 #65 0x000055555574c0c0 in php_execute_script (primary_file=0x7fffffffcb10) at /build/php7.0-Y7XHJx/php7.0-7.0.3/main/main.c:2484 #66 0x000055555583ff84 in do_cli (argc=4, argv=0x555555bab130) at /build/php7.0-Y7XHJx/php7.0-7.0.3/sapi/cli/php_cli.c:974 #67 0x00005555556364e4 in main (argc=4, argv=0x555555bab130) at /build/php7.0-Y7XHJx/php7.0-7.0.3/sapi/cli/php_cli.c:1345 From a live gdb session: (gdb) print subject $3 = 0x7fffed43e1f8 "\303\251\303\204\303\237\343\201\224a" (gdb) print offsets $4 = (int *) 0x7fffffff9150 (gdb) print offsets[0] $5 = 2 (gdb) print last_match $6 = 0x7fffed43e1fc "\303\237\343\201\224a" (gdb) print &subject[offsets[0]]-last_match $7 = -2 This line (ext/pcre/php_pcre.c:1808): ZVAL_STRINGL(&tmp, last_match, &subject[offsets[0]]-last_match); is the culprit, but I don't know why. The last value is -2, as indicated above? This code seems relatively unchanged compared to the PHP5 version I have handy, so I'm unsure of what's happening. ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=71659&edit=1