Bug #71754 [Opn->Csd]: Regression in PHP7.0: trivial script segfaults php-cgi
Edit report at https://bugs.php.net/bug.php?id=71754&edit=1
ID: 71754
Updated by: laruence@php.net
Reported by: phpbug at wisl dot de
Summary: Regression in PHP7.0: trivial script segfaults
php-cgi
-Status: Open
+Status: Closed
Type: Bug
Package: Reproducible crash
Operating System: Linux
PHP Version: 7.0.4
Block user comment: N
Private report: N
New Comment:
Automatic comment on behalf of laruence@gmail.com
Revision: http://git.php.net/?p=php-src.git;a=commit;h=98c625a31cc329aa45c48d9c376c6197e278a3a5
Log: Fixed bug #71754 (Regression in PHP7.0: trivial script segfaults php-cgi)
Previous Comments:
------------------------------------------------------------------------
[2016-03-09 13:33:07] phpbug at wisl dot de
Description:
------------
The included trivial 2-line-script crashed php-cgi with the following backtrace:
(gdb) run bugtest2.php
Starting program: /usr/bin/php-cgi7.0 bugtest2.php
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".
Program received signal SIGSEGV, Segmentation fault.
zend_hash_str_find (ht=0x0, str=str@entry=0xd33ece "REQUEST_URI", len=len@entry=11)
at /var/tmp/portage/dev-lang/php-7.0.4/work/sapis-build/cgi/Zend/zend_hash.c:1959
1959 /var/tmp/portage/dev-lang/php-7.0.4/work/sapis-build/cgi/Zend/zend_hash.c: No such file or
directory.
(gdb) bt
#0 zend_hash_str_find (ht=0x0, str=str@entry=0xd33ece "REQUEST_URI", len=len@entry=11)
at /var/tmp/portage/dev-lang/php-7.0.4/work/sapis-build/cgi/Zend/zend_hash.c:1959
#1 0x0000000000640aeb in php_session_start ()
at /var/tmp/portage/dev-lang/php-7.0.4/work/sapis-build/cgi/ext/session/session.c:1613
#2 0x0000000000641cd5 in zif_session_start (execute_data=<optimized out>,
return_value=0x7ffff0612090)
at /var/tmp/portage/dev-lang/php-7.0.4/work/sapis-build/cgi/ext/session/session.c:2312
#3 0x000000000083c39e in ZEND_DO_ICALL_SPEC_HANDLER ()
at /var/tmp/portage/dev-lang/php-7.0.4/work/sapis-build/cgi/Zend/zend_vm_execute.h:586
#4 0x000000000082c83b in execute_ex (ex=<optimized out>)
at /var/tmp/portage/dev-lang/php-7.0.4/work/sapis-build/cgi/Zend/zend_vm_execute.h:414
#5 0x0000000000888689 in zend_execute (op_array=<optimized out>,
return_value=<optimized out>)
at /var/tmp/portage/dev-lang/php-7.0.4/work/sapis-build/cgi/Zend/zend_vm_execute.h:458
#6 0x00000000007e9537 in zend_execute_scripts (type=type@entry=8,
retval=retval@entry=0x0, file_count=file_count@entry=3)
at /var/tmp/portage/dev-lang/php-7.0.4/work/sapis-build/cgi/Zend/zend.c:1427
#7 0x000000000077c0a8 in php_execute_script (
primary_file=primary_file@entry=0x7fffffffd390)
at /var/tmp/portage/dev-lang/php-7.0.4/work/sapis-build/cgi/main/main.c:2484
#8 0x000000000048d5f7 in main (argc=2, argv=0x7fffffffd818)
at /var/tmp/portage/dev-lang/php-7.0.4/work/sapis-build/cgi/sapi/cgi/cgi_main.c:2453
Test script:
---------------
<?php
ini_set("session.use_only_cookies","0");
session_start();
?>
Expected result:
----------------
Just an empty page, because while the script does start a session it does nothing else. Instead I
get an 500 internal server error, because the cgi process was aborted with a segfault.
I'm fileing this seperate bug in addition zu #71599, because nobody seems to care that the
transparend session id feature is broken. I hope this trivial triggereble segfault gets some
attention.
The cause seems to be the following commit:
https://github.com/php/php-src/commit/f248df900300c5b2201d4cf634d58d413399e2eb
Please revert this commit because of the following reasons:
* Its description ("Behavior is unchanged.") is plain wrong: The change causes PHPSESSID
parameters added to all URLs even if the user has cookies enabled. That is a behavior change.
* Its contains bugs, because on multiple occasions I have seen it adding multiple PHPSESSID
parameters.
* It removes a validation check (Z_ISUNDEF(PG(http_globals)[TRACK_VARS_SERVER])) and because of that
the option session.use_only_cookie=0 now triggers a segfault when calling session_start(). (At least
when using the cgi variant of php.)
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=71754&edit=1
Thread (2 messages)