Bug #71936 [Opn->Csd]: Segmentation fault destroying HTTP_RAW_POST_DATA

Edit report at https://bugs.php.net/bug.php?id=71936&edit=1 ID: 71936 Updated by: remi@php.net Reported by: mike dot laspina at gmail dot com Summary: Segmentation fault destroying HTTP_RAW_POST_DATA -Status: Open +Status: Closed Type: Bug Package: Reproducible crash PHP Version: 5.6.20 Block user comment: N Private report: N New Comment: Automatic comment on behalf of remi Revision: http://git.php.net/?p=php-src.git;a=commit;h=1b4570b79fa9810b171d3fb074c405f2f429ecad Log: Fix bug #71936 (Segmentation fault destroying HTTP_RAW_POST_DATA) Previous Comments: ------------------------------------------------------------------------ [2016-04-01 00:33:35] mike dot laspina at gmail dot com Description: ------------ With --enable-debug, shutdown_executor segfaults trying to destroy the HTTP_RAW_POST_DATA global if the POST body length is zero. The cause is the use of php_stream_copy_to_mem in php_default_post_reader (php_content_types.c:64), which sets the buf parameter to NULL when no data is read. This results in a zval string where Z_STRVAL == NULL. When Zend debugging is disabled, this is harmless, only resulting in a call to _efree(NULL). When Zend debugging is enabled, the string value is dereferenced by a call to CHECK_ZVAL_STRING_REL. This bug was introduced by https://github.com/php/php-src/commit/3641507fc1a854ec56135740f528d5d428920833 Test script: --------------- env REDIRECT_STATUS=200 REQUEST_METHOD=POST CONTENT_LENGTH= GATEWAY_INTERFACE=CGI/1.1 SCRIPT_NAME=/some_script.php SCRIPT_FILENAME=/some_script.php php-cgi Actual result: -------------- Process 45704 stopped * thread #1: tid = 0xffcfb9, 0x00000001007e0393 php-cgi`_zval_dtor_func(zvalue=0x0000000104b447a0, __zend_filename="Zend/zend_execute.h", __zend_lineno=79) + 83 at zend_variables.c:36, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x0) frame #0: 0x00000001007e0393 php-cgi`_zval_dtor_func(zvalue=0x0000000104b447a0, __zend_filename="Zend/zend_execute.h", __zend_lineno=79) + 83 at zend_variables.c:36 33 switch (Z_TYPE_P(zvalue) & IS_CONSTANT_TYPE_MASK) { 34 case IS_STRING: 35 case IS_CONSTANT: -> 36 CHECK_ZVAL_STRING_REL(zvalue); 37 str_efree_rel(zvalue->value.str.val); 38 break; 39 case IS_ARRAY: { (lldb) bt * thread #1: tid = 0xffcfb9, 0x00000001007e0393 php-cgi`_zval_dtor_func(zvalue=0x0000000104b447a0, __zend_filename="Zend/zend_execute.h", __zend_lineno=79) + 83 at zend_variables.c:36, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x0) * frame #0: 0x00000001007e0393 php-cgi`_zval_dtor_func(zvalue=0x0000000104b447a0, __zend_filename="Zend/zend_execute.h", __zend_lineno=79) + 83 at zend_variables.c:36 frame #1: 0x00000001007cd06c php-cgi`_zval_dtor(zvalue=0x0000000104b447a0, __zend_filename="Zend/zend_execute.h", __zend_lineno=79) + 60 at zend_variables.h:35 frame #2: 0x00000001007c979f php-cgi`i_zval_ptr_dtor(zval_ptr=0x0000000104b447a0, __zend_filename="/opt/nr/src/php-5.6.16/Zend/zend_variables.c", __zend_lineno=188) + 175 at zend_execute.h:79 frame #3: 0x00000001007c92a6 php-cgi`_zval_ptr_dtor(zval_ptr=0x0000000104b44f78, __zend_filename="/opt/nr/src/php-5.6.16/Zend/zend_variables.c", __zend_lineno=188) + 38 at zend_execute_API.c:424 frame #4: 0x00000001007e0901 php-cgi`_zval_ptr_dtor_wrapper(zval_ptr=0x0000000104b44f78) + 33 at zend_variables.c:188 frame #5: 0x00000001007fa451 php-cgi`i_zend_hash_bucket_delete(ht=0x0000000100ec0df8, p=0x0000000104b44f60) + 369 at zend_hash.c:182 frame #6: 0x00000001007fa93d php-cgi`zend_hash_bucket_delete(ht=0x0000000100ec0df8, p=0x0000000104b44f60) + 29 at zend_hash.c:192 frame #7: 0x00000001007fa994 php-cgi`zend_hash_graceful_reverse_destroy(ht=0x0000000100ec0df8) + 68 at zend_hash.c:613 frame #8: 0x00000001007c8cfc php-cgi`shutdown_executor + 124 at zend_execute_API.c:244 frame #9: 0x00000001007e4506 php-cgi`zend_deactivate + 134 at zend.c:960 frame #10: 0x0000000100730621 php-cgi`php_request_shutdown(dummy=0x0000000000000000) + 961 at main.c:1883 frame #11: 0x00000001008b093b php-cgi`main(argc=1, argv=0x00007fff5fbff9a0) + 9707 at cgi_main.c:2517 frame #12: 0x00007fff99a815ad libdyld.dylib`start + 1 (lldb) p *zvalue (zval) $0 = { value = { lval = 0 dval = 0 str = (val = <no value available>, len = 0) ht = 0x0000000000000000 obj = { handle = 0 handlers = 0x0000000000000000 } ast = 0x0000000000000000 } refcount__gc = 0 type = '\x06' is_ref__gc = '\0' } ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=71936&edit=1