Bug #72526 [NEW]: segfault in curl_setopt()
From: lazy at iq dot pl
Operating system: Debian Wheezy
PHP version: 7.0.8
Package: cURL related
Bug Type: Bug
Bug description:segfault in curl_setopt()
Description:
------------
gcc version 4.7.2 (Debian 4.7.2-5)
compiling with O0 "fixes" the problem,
also works fine on centos 7, so it might be some optimization issue
Breakpoint 1, _php_curl_setopt (ch=0x3d61925b780, option=10023,
zvalue=0x3d619213160) at
/usr/src/new/apache2-suexec/work/pri/php-7.0.8/ext/curl/interface.c:2133
2133 {
(gdb) p zvalue
$1 = (zval *) 0x3d619213160
(gdb) list
2128 dupch->res = Z_RES_P(return_value);
2129 }
2130 /* }}} */
2131
2132 static int _php_curl_setopt(php_curl *ch, zend_long option, zval
*zvalue) /* {{{ */
2133 {
2134 CURLcode error = CURLE_OK;
2135 zend_long lval;
2136
2137 ZVAL_DEREF(zvalue);
(gdb) next
2137 ZVAL_DEREF(zvalue);
(gdb)
2133 {
(gdb)
2137 ZVAL_DEREF(zvalue);
(gdb)
2138 switch (option) {
(gdb)
3626 }
(gdb)
2603 ph = HASH_OF(zvalue);
(gdb) next
2604 if (!ph) {
(gdb)
2650 ZEND_HASH_FOREACH_VAL(ph, current) {
(gdb)
2661 if ((*ch->clone) == 1) {
(gdb)
2662 zend_hash_index_update_ptr(ch->to_free->slist, option, slist);
(gdb)
2661 if ((*ch->clone) == 1) {
(gdb)
2662 zend_hash_index_update_ptr(ch->to_free->slist, option, slist);
(gdb)
2822 zval_ptr_dtor(&ch->handlers->progress->func_name);
(gdb)
Program received signal SIGSEGV, Segmentation fault.
_zval_ptr_dtor (zval_ptr=0x4) at
/usr/src/new/apache2-suexec/work/pri/php-7.0.8/Zend/zend_execute_API.c:533
533 i_zval_ptr_dtor(zval_ptr ZEND_FILE_LINE_RELAY_CC);
gdb) bt
#0 _zval_ptr_dtor (zval_ptr=0x4) at
/usr/src/new/apache2-suexec/work/pri/php-7.0.8/Zend/zend_execute_API.c:533
#1 0x00000000005807e5 in _php_curl_setopt (ch=ch@entry=0x2c7a8fe3700,
option=<optimized out>, zvalue=zvalue@entry=0x2c7a8fe3520) at
/usr/src/new/apache2-suexec/work/pri/php-7.0.8/ext/curl/interface.c:2822
#2 0x00000000005814b5 in zif_curl_setopt_array (execute_data=<optimized
out>, return_value=0x2c7a9c16660) at
/usr/src/new/apache2-suexec/work/pri/php-7.0.8/ext/curl/interface.c:3015
#3 0x00000000008f8fed in ZEND_DO_FCALL_SPEC_HANDLER
(execute_data=0x2c7a9c16430) at
/usr/src/new/apache2-suexec/work/pri/php-7.0.8/Zend/zend_vm_execute.h:842
#4 0x00000000008b66a0 in execute_ex (ex=<optimized out>) at
/usr/src/new/apache2-suexec/work/pri/php-7.0.8/Zend/zend_vm_execute.h:417
#5 0x0000000000907097 in zend_execute
(op_array=op_array@entry=0x2c7a9c78000,
return_value=return_value@entry=0x0) at
/usr/src/new/apache2-suexec/work/pri/php-7.0.8/Zend/zend_vm_execute.h:458
#6 0x0000000000878a24 in zend_execute_scripts (type=type@entry=8,
retval=retval@entry=0x0, file_count=file_count@entry=3) at
/usr/src/new/apache2-suexec/work/pri/php-7.0.8/Zend/zend.c:1427
#7 0x000000000081aaa0 in php_execute_script
(primary_file=primary_file@entry=0x3dcd7e2eaa0) at
/usr/src/new/apache2-suexec/work/pri/php-7.0.8/main/main.c:2494
#8 0x00000000004566ca in main (argc=1, argv=0x3dcd7e2ee58) at
/usr/src/new/apache2-suexec/work/pri/php-7.0.8/sapi/cgi/cgi_main.c:2453
Please look at
https://github.com/php/php-src/blob/master/ext/curl/interface.c#L2663-L2672
May it be running ZEND_HASH_FOREACH_VAL() loop on an empty hash
corrupting the stack ?
Test script:
---------------
$ch=curl_init();
curl_setopt($ch, CURLOPT_HTTPHEADER, array());
Expected result:
----------------
Normal execution
Actual result:
--------------
Segfault:
gdb) bt
#0 _zval_ptr_dtor (zval_ptr=0x4) at
/usr/src/new/apache2-suexec/work/pri/php-7.0.8/Zend/zend_execute_API.c:533
#1 0x00000000005807e5 in _php_curl_setopt (ch=ch@entry=0x2c7a8fe3700,
option=<optimized out>, zvalue=zvalue@entry=0x2c7a8fe3520) at
/usr/src/new/apache2-suexec/work/pri/php-7.0.8/ext/curl/interface.c:2822
#2 0x00000000005814b5 in zif_curl_setopt_array (execute_data=<optimized
out>, return_value=0x2c7a9c16660) at
/usr/src/new/apache2-suexec/work/pri/php-7.0.8/ext/curl/interface.c:3015
#3 0x00000000008f8fed in ZEND_DO_FCALL_SPEC_HANDLER
(execute_data=0x2c7a9c16430) at
/usr/src/new/apache2-suexec/work/pri/php-7.0.8/Zend/zend_vm_execute.h:842
#4 0x00000000008b66a0 in execute_ex (ex=<optimized out>) at
/usr/src/new/apache2-suexec/work/pri/php-7.0.8/Zend/zend_vm_execute.h:417
#5 0x0000000000907097 in zend_execute
(op_array=op_array@entry=0x2c7a9c78000,
return_value=return_value@entry=0x0) at
/usr/src/new/apache2-suexec/work/pri/php-7.0.8/Zend/zend_vm_execute.h:458
#6 0x0000000000878a24 in zend_execute_scripts (type=type@entry=8,
retval=retval@entry=0x0, file_count=file_count@entry=3) at
/usr/src/new/apache2-suexec/work/pri/php-7.0.8/Zend/zend.c:1427
#7 0x000000000081aaa0 in php_execute_script
(primary_file=primary_file@entry=0x3dcd7e2eaa0) at
/usr/src/new/apache2-suexec/work/pri/php-7.0.8/main/main.c:2494
#8 0x00000000004566ca in main (argc=1, argv=0x3dcd7e2ee58) at
/usr/src/new/apache2-suexec/work/pri/php-7.0.8/sapi/cgi/cgi_main.c:2453
--
Edit bug report at https://bugs.php.net/bug.php?id=72526&edit=1
--
Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=72526&r=trysnapshot54
Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=72526&r=trysnapshot55
Try a snapshot (trunk): https://bugs.php.net/fix.php?id=72526&r=trysnapshottrunk
Fixed in SVN: https://bugs.php.net/fix.php?id=72526&r=fixed
Fixed in release: https://bugs.php.net/fix.php?id=72526&r=alreadyfixed
Need backtrace: https://bugs.php.net/fix.php?id=72526&r=needtrace
Need Reproduce Script: https://bugs.php.net/fix.php?id=72526&r=needscript
Try newer version: https://bugs.php.net/fix.php?id=72526&r=oldversion
Not developer issue: https://bugs.php.net/fix.php?id=72526&r=support
Expected behavior: https://bugs.php.net/fix.php?id=72526&r=notwrong
Not enough info: https://bugs.php.net/fix.php?id=72526&r=notenoughinfo
Submitted twice: https://bugs.php.net/fix.php?id=72526&r=submittedtwice
register_globals: https://bugs.php.net/fix.php?id=72526&r=globals
PHP 4 support discontinued: https://bugs.php.net/fix.php?id=72526&r=php4
Daylight Savings: https://bugs.php.net/fix.php?id=72526&r=dst
IIS Stability: https://bugs.php.net/fix.php?id=72526&r=isapi
Install GNU Sed: https://bugs.php.net/fix.php?id=72526&r=gnused
Floating point limitations: https://bugs.php.net/fix.php?id=72526&r=float
No Zend Extensions: https://bugs.php.net/fix.php?id=72526&r=nozend
MySQL Configuration Error: https://bugs.php.net/fix.php?id=72526&r=mysqlcfg
Thread (7 messages)
- lazy at iq dot pl