Edit report at https://bugs.php.net/bug.php?id=71482&edit=1
ID: 71482
Updated by: laruence@php.net
Reported by: alex dot schneider at sevenval dot com
Summary: Lost zend_string after "reached pm.max_children
setting" with segfault
-Status: Assigned
+Status: Closed
Type: Bug
Package: PCRE related
Operating System: Linux Mint 17.3
PHP Version: 7.0.2
Assigned To: laruence
Block user comment: N
Private report: N
New Comment:
The fix for this bug has been committed.
Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
For Windows:
http://windows.php.net/snapshots/
Thank you for the report, and for helping us make PHP better.
this should be fixed in svn
Previous Comments:
------------------------------------------------------------------------
[2016-02-08 20:40:23] alex dot schneider at sevenval dot com
Sorry, but it's not possible to run my complex test suite with/via valgrind.
I have run tests in a subdirectory in my project and the error/segfault has occurred each time in an
other test, but always with the same gdb-backtrace (see above).
My guess is, that any caller of "pcre_get_compiled_regex_cache()" sometimes wrong flags
the "zend string *regex" and releases them afterwards. I would not trust to any caller
here and ALWAYS duplicate and make persistent the string (without any checks).
------------------------------------------------------------------------
[2016-02-08 03:18:42] laruence@php.net
could you please try with valgrind?
or could you grant me a ssh access to a reproducible box(mail)?
thanks
------------------------------------------------------------------------
[2016-02-01 09:26:46] alex dot schneider at sevenval dot com
I agree. I could not find out which module was responsible, too.
I made debug outputs while destructoring of the "module_registry" and saw that it crashes
right here, in the "pcre" module. But i don't know, who is the trigger.
------------------------------------------------------------------------
[2016-02-01 08:36:17] laruence@php.net
in generally, your patch is right. we need a persistent alloc memory for the key
but I am prefer to find out which extension(case) break this..
the only reason I can think out is, that some interned string in a extension used as a pcre
pattern..
I just don't know which extension and how does it do this..
------------------------------------------------------------------------
[2016-01-31 05:54:26] alex dot schneider at sevenval dot com
Program terminated with signal SIGSEGV, Segmentation fault.
#0 0x00000000007a140d in gc_check_possible_root (z=0x7f523c5311e0) at
~/test/build/src/external/php-7.0.2/Zend/zend_gc.h:136
136 gc_possible_root(Z_COUNTED_P(z));
(gdb) bt
#0 0x00000000007a140d in gc_check_possible_root (z=0x7f523c5311e0) at
~/test/build/src/external/php-7.0.2/Zend/zend_gc.h:136
#1 0x00000000007a549d in zend_hash_clean (ht=0xdf9320) at
~/test/build/src/external/php-7.0.2/Zend/zend_hash.c:1355
#2 0x00000000004773a7 in make_subpats_table (num_subpats=0, pce=0x7fff9e3591c0) at
~/test/build/src/external/php-7.0.2/ext/pcre/php_pcre.c:226
#3 0x000000000079ad42 in do_register_internal_class (orig_class_entry=0x79ad42
<do_register_internal_class+6>, ce_flags=32767)
at ~/test/build/src/external/php-7.0.2/Zend/zend_API.c:2641
#4 0x000000000078ef00 in zend_startup (utility_functions=0x27df3e0, extensions=0x7fff9e359380) at
~/test/build/src/external/php-7.0.2/Zend/zend.c:708
#5 0x00000000007a4a8a in zend_hash_del_ind (ht=0x27df3e0, key=0x7fff9e359380) at
~/test/build/src/external/php-7.0.2/Zend/zend_hash.c:1106
#6 0x00000000007a4b55 in zend_hash_str_del_ind (ht=0x7a4b55 <zend_hash_str_del_ind+12>,
str=0x7fff9e3592d0 "", len=4294967313)
at ~/test/build/src/external/php-7.0.2/Zend/zend_hash.c:1128
#7 0x00000000007a5e16 in zend_hash_apply_with_arguments (ht=0x78ef00 <zend_startup+670>,
apply_func=0x7fff9e359230, num_args=0)
at ~/test/build/src/external/php-7.0.2/Zend/zend_hash.c:1571
#8 0x0000000000798a7e in zend_check_magic_method_implementation (ce=0x7a5e16
<zend_hash_apply_with_arguments+192>, fptr=0x7fff9e359300, error_type=0)
at ~/test/build/src/external/php-7.0.2/Zend/zend_API.c:2062
#9 0x000000000078f582 in zend_call_destructors () at
~/test/build/src/external/php-7.0.2/Zend/zend.c:953
#10 0x00000000006fe1ba in php_execute_script (primary_file=0x0) at
~/test/build/src/external/php-7.0.2/main/main.c:2473
#11 0x00000000008610e1 in ?? ()
#12 0x0000000000000000 in ?? ()
(gdb) bt full
#0 0x00000000007a140d in gc_check_possible_root (z=0x7f523c5311e0) at
~/test/build/src/external/php-7.0.2/Zend/zend_gc.h:136
No locals.
#1 0x00000000007a549d in zend_hash_clean (ht=0xdf9320) at
~/test/build/src/external/php-7.0.2/Zend/zend_hash.c:1355
p = 0x29b8180
end = 0x29b8240
#2 0x00000000004773a7 in make_subpats_table (num_subpats=0, pce=0x7fff9e3591c0) at
~/test/build/src/external/php-7.0.2/ext/pcre/php_pcre.c:226
extra = 0xc
name_cnt = 43745856
name_size = 43745664
ni = 0
rc = 32767
name_table = 0x4773a7 <make_subpats_table+76> "E\334H\213E\260H\213"
name_idx = 0
subpat_names = 0xdf9320
rc1 = 0
rc2 = -1640656416
#3 0x000000000079ad42 in do_register_internal_class (orig_class_entry=0x79ad42
<do_register_internal_class+6>, ce_flags=32767)
at ~/test/build/src/external/php-7.0.2/Zend/zend_API.c:2641
class_entry = 0x7fff9e359230
lowercase_name = 0x27df3e0
#4 0x000000000078ef00 in zend_startup (utility_functions=0x27df3e0, extensions=0x7fff9e359380) at
~/test/build/src/external/php-7.0.2/Zend/zend.c:708
No locals.
#5 0x00000000007a4a8a in zend_hash_del_ind (ht=0x27df3e0, key=0x7fff9e359380) at
~/test/build/src/external/php-7.0.2/Zend/zend_hash.c:1106
---Type <return> to continue, or q <return> to quit---
data = 0x119e3594f0
h = 15539213552
nIndex = 0
idx = 0
p = 0xdfe080
prev = 0x27c3000
#6 0x00000000007a4b55 in zend_hash_str_del_ind (ht=0x7a4b55 <zend_hash_str_del_ind+12>,
str=0x7fff9e3592d0 "", len=4294967313)
at ~/test/build/src/external/php-7.0.2/Zend/zend_hash.c:1128
h = 14672000
nIndex = 0
idx = 41693184
p = 0x3ffffffef
prev = 0x300abc580
#7 0x00000000007a5e16 in zend_hash_apply_with_arguments (ht=0x78ef00 <zend_startup+670>,
apply_func=0x7fff9e359230, num_args=0)
at ~/test/build/src/external/php-7.0.2/Zend/zend_hash.c:1571
idx = 0
p = 0x7fff9e359280
args = {{gp_offset = 8014474, fp_offset = 0, overflow_arg_area = 0x0, reg_save_area =
0x27c3000}}
hash_key = {h = 140735847699328, key = 0x27df3e0}
result = 0
#8 0x0000000000798a7e in zend_check_magic_method_implementation (ce=0x7a5e16
<zend_hash_apply_with_arguments+192>, fptr=0x7fff9e359300, error_type=0)
at ~/test/build/src/external/php-7.0.2/Zend/zend_API.c:2062
lcname = "p\227\065\236\003\000\000\000\000\060|\002\000\000\000"
---Type <return> to continue, or q <return> to quit---
name_len = 14672000
#9 0x000000000078f582 in zend_call_destructors () at
~/test/build/src/external/php-7.0.2/Zend/zend.c:953
__orig_bailout = 0x100000011
__bailout = {{__jmpbuf = {140735847699152, 8014677, 140735847700336, 41693184, 12896159104,
14672000, 17179869167, 0}, __mask_was_saved = -1640656128, __saved_mask = {__val = {
8019478, 140735847699216, 14672000, 15539214192, 41693184, 140735847699216, 7965310,
140735847699296, 7927170, 140735847699312, 4356944, 140735847700336, 0, 0, 0,
140735847699296}}}}
#10 0x00000000006fe1ba in php_execute_script (primary_file=0x0) at
~/test/build/src/external/php-7.0.2/main/main.c:2473
realfile = "@ \222VR\177\000\000\000
\222VR\177\000\000Ð5\236\377\177\000\000\356\252u\000\000\000\000\000\020l\215VR\177",
'\000' <repeats 14 times>, "D\005\000\000\200Å«\000\000\000\000\000\000
\222VR\177\000\000@\000\200VR\177\000\000\020\204\065\236\"\001\000\000\t\000\000\200\000\000\000\000\000
\022\000\000\000\000\000\000\000\200VR\177\000\000\000\204\065\236\377\177\000\000,\324u",
'\000' <repeats 17 times>, "D\005\000\000\200Å«\000\000\000\000\000\000
\222VR\177\000\000@\204\065\236\377\177\000\000\033Xz\000\000\000\000\000@\204\065\236\377\177\000\000\000
\222VR\177\000\000\000\000\000\000\000\000\000\000(\342\220"...
__orig_bailout = 0x0
__bailout = {{__jmpbuf = {140735847695040, 34367460396, 139991616154112, 139991615275072,
139991616154160, 139991616154112, 140735847695136, 7711470},
__mask_was_saved = 1452420832, __saved_mask = {__val = {0, 1129576398848, 11249520,
139991616154112, 139991615275072, 919123001344, 2147483656, 879104, 139991615275008,
140735847695184, 7722028, 0, 1129576398848, 11249520, 40106813952,
139991616462848}}}}
prepend_file_p = 0x0
append_file_p = 0x0
prepend_file = {handle = {fd = 0, fp = 0x0, stream = {handle = 0x0, isatty = 0, mmap = {len
= 0, pos = 0, map = 0x0, buf = 0x0, old_handle = 0x0, old_closer = 0x0}, reader = 0x0,
fsizer = 0x0, closer = 0x31ba}}, filename = 0x800000001 <error: Cannot access
memory at address 0x800000001>, opened_path = 0x7f52568d6910, type = 1451229248,
free_filename = 82 'R'}
append_file = {handle = {fd = 1452108096, fp = 0x7f52568d6940, stream = {handle =
0x7f52568d6940, isatty = 1452108048, mmap = {len = 140735847694992, pos = 7711470, map = 0x13880,
buf = 0x0, old_handle = 0x10700000000, old_closer = 0xaba770}, reader =
0x7f52568d6910, fsizer = 0x7f5256800040, closer = 0xd600000000}},
filename = 0x80000008 <error: Cannot access memory at address 0x80000008>,
opened_path = 0xd6910, type = 1451229184, free_filename = 82 'R'}
---Type <return> to continue, or q <return> to quit---
old_cwd = 0x0
use_heap = 0 '\000'
retval = 0
#11 0x00000000008610e1 in ?? ()
No symbol table info available.
#12 0x0000000000000000 in ?? ()
No symbol table info available.
------------------------------------------------------------------------
The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
https://bugs.php.net/bug.php?id=71482
--
Edit this bug report at https://bugs.php.net/bug.php?id=71482&edit=1