Bug #72140 [Asn]: segfault after calling ERR_free_strings()

Edit report at https://bugs.php.net/bug.php?id=72140&edit=1 ID: 72140 Updated by: bukka@php.net Reported by: mpasinski at gmail dot com Summary: segfault after calling ERR_free_strings() Status: Assigned Type: Bug Package: OpenSSL related Operating System: Linux PHP Version: 5.6.21 Assigned To: bukka Block user comment: N Private report: N New Comment: There shouldn't be a problem with calling ERR_free_strings multiple times as you can see in OpenSSL code: https://github.com/openssl/openssl/blob/ae5c8664e587f2445c8e4eb436cffbb64af4f6b8/crypto/err/err.c#L376 The problem that I see from the backtrace is due to calling the locking function: https://github.com/openssl/openssl/blob/ae5c8664e587f2445c8e4eb436cffbb64af4f6b8/crypto/cryptlib.c#L596 It could be because some ext set locking callback and then it got unloaded without resetting it. Could you try the patch below if it fixes your issue? diff --git a/ext/openssl/openssl.c b/ext/openssl/openssl.c index 88e396c..aeaeeec 100644 --- a/ext/openssl/openssl.c +++ b/ext/openssl/openssl.c @@ -1278,6 +1278,7 @@ PHP_MSHUTDOWN_FUNCTION(openssl) EVP_cleanup(); #if OPENSSL_VERSION_NUMBER >= 0x00090805f + CRYPTO_set_locking_callback(NULL); ERR_free_strings(); #endif Previous Comments: ------------------------------------------------------------------------ [2016-06-03 10:22:53] ab@php.net Jakub, could you please take a look at this? Thanks. ------------------------------------------------------------------------ [2016-05-03 08:34:55] mpasinski at gmail dot com Description: ------------ When using OpenSSL and CURL together PHP crashes after calling ERR_free_strings(). After running Apache in debug mode without forks (gdb --args httpd -X) you can see following backtraces: #0 ERR_free_strings () at err.c:697 #1 0x00007fffe62cf658 in Curl_ossl_cleanup () from libcurl.so.4 #2 0x00007fffe62d2e22 in Curl_ssl_cleanup () from libcurl.so.4 #3 0x00007fffe62b12f5 in curl_global_cleanup () from libcurl.so.4 #4 0x00007fffe5a13a98 in zm_shutdown_curl (type=<value optimized out>, module_number=29) at php-5.6.21/ext/curl/interface.c:1263 #5 0x00007fffee359575 in module_destructor (module=0x7bf100) at php-5.6.21/Zend/zend_API.c:2376 #6 0x00007fffee3604a6 in i_zend_hash_bucket_delete (ht=0x7fffeead5de0, p=0x7bf0a0) at php-5.6.21/Zend/zend_hash.c:182 #7 zend_hash_bucket_delete (ht=0x7fffeead5de0, p=0x7bf0a0) at php-5.6.21/Zend/zend_hash.c:192 #8 0x00007fffee360778 in zend_hash_graceful_reverse_destroy ( ht=0x7fffeead5de0) at php-5.6.21/Zend/zend_hash.c:613 #9 0x00007fffee353a72 in zend_shutdown () at php-5.6.21/Zend/zend.c:836 #10 0x00007fffee2f20ca in php_module_shutdown () at php-5.6.21/main/main.c:2477 #11 0x00007fffee2f2179 in php_module_shutdown_wrapper ( sapi_globals=<value optimized out>) at php-5.6.21/main/main.c:2445 #12 0x00007fffee3f7af1 in php_apache_child_shutdown (tmp=<value optimized out>) at php-5.6.21/sapi/apache2handler/sapi_apache2.c:398 #13 0x00007ffff7534b6e in run_cleanups (pool=0x918f88) at memory/unix/apr_pools.c:2352 #14 apr_pool_destroy (pool=0x918f88) at memory/unix/apr_pools.c:814 #15 0x000000000046b8fe in clean_child_exit (code=0) at prefork.c:227 #16 0x000000000046bdfb in child_main (child_num_arg=<value optimized out>, child_bucket=<value optimized out>) at prefork.c:744 #17 0x000000000046c239 in make_child (s=0x6c6618, slot=0, bucket=0) at prefork.c:767 #18 0x000000000046d1db in prefork_run (_pconf=<value optimized out>, plog=0x6c8378, s=0x6c6618) at prefork.c:979 #19 0x000000000043246e in ap_run_mpm (pconf=0x69b138, plog=0x6c8378, s=0x6c6618) at mpm_common.c:96 #20 0x000000000042c4c4 in main (argc=2, argv=0x7fffffffe4b8) at main.c:778 So far everything works well, but then ERR_free_strings() is hit for the second time, followed by crash (this time OpenSSL cleanup is performed, after CURL cleanup was done above): #0 0x00007eff7d6905f9 in ?? () #1 0x00007eff8021632f in CRYPTO_lock (mode=9, type=1, file=0x7eff8030a4bb "err.c", line=375) at cryptlib.c:596 #2 0x00007eff80285fd8 in int_err_del () at err.c:375 #3 ERR_free_strings () at err.c:697 #4 0x00007fffe53b853d in zm_shutdown_openssl (type=<value optimized out>, module_number=31) at php-5.6.21/ext/openssl/openssl.c:1281 #5 0x00007fffee359575 in module_destructor (module=0x7c6000) at php-5.6.21/Zend/zend_API.c:2376 #6 0x00007fffee3604a6 in i_zend_hash_bucket_delete (ht=0x7fffeead5de0, p=0x7c5fa0) at php-5.6.21/Zend/zend_hash.c:182 #7 zend_hash_bucket_delete (ht=0x7fffeead5de0, p=0x7c5fa0) at php-5.6.21/Zend/zend_hash.c:192 #8 0x00007fffee360778 in zend_hash_graceful_reverse_destroy ( ht=0x7fffeead5de0) at php-5.6.21/Zend/zend_hash.c:613 #9 0x00007fffee353a72 in zend_shutdown () at php-5.6.21/Zend/zend.c:836 #10 0x00007fffee2f20ca in php_module_shutdown () at php-5.6.21/main/main.c:2477 #11 0x00007fffee2f2179 in php_module_shutdown_wrapper ( sapi_globals=<value optimized out>) at php-5.6.21/main/main.c:2445 #12 0x00007fffee3f7af1 in php_apache_child_shutdown (tmp=<value optimized out>) at php-5.6.21/sapi/apache2handler/sapi_apache2.c:398 #13 0x00007ffff7534b6e in run_cleanups (pool=0x918f88) at memory/unix/apr_pools.c:2352 #14 apr_pool_destroy (pool=0x918f88) at memory/unix/apr_pools.c:814 #15 0x000000000046b8fe in clean_child_exit (code=0) at prefork.c:227 #16 0x000000000046bdfb in child_main (child_num_arg=<value optimized out>, child_bucket=<value optimized out>) at prefork.c:744 #17 0x000000000046c239 in make_child (s=0x6c6618, slot=0, bucket=0) at prefork.c:767 #18 0x000000000046d1db in prefork_run (_pconf=<value optimized out>, plog=0x6c8378, s=0x6c6618) at prefork.c:979 #19 0x000000000043246e in ap_run_mpm (pconf=0x69b138, plog=0x6c8378, s=0x6c6618) at mpm_common.c:96 #20 0x000000000042c4c4 in main (argc=2, argv=0x7fffffffe4b8) at main.c:778 It looks like it is legal to call ERR_free_strings() once, whereas while using OpenSSL and CURL this code is called twice. All versions since 5.6.19 are affected. The commit causing the issue is: commit a63d0f55da87fc620c66f1b909d752d7c8b1159c Author: Jakub Zelenka <bukka@php.net> Date: Mon Jan 25 17:50:16 2016 Fix memory leak with not freeing OpenSSL errors ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=72140&edit=1