Bug #72526 [Opn]: segfault in curl_setopt()
Edit report at https://bugs.php.net/bug.php?id=72526&edit=1
ID: 72526
Updated by: laruence@php.net
Reported by: lazy at iq dot pl
Summary: segfault in curl_setopt()
Status: Open
Type: Bug
Package: cURL related
Operating System: Debian Wheezy
PHP Version: 7.0.8
Block user comment: N
Private report: N
New Comment:
I can not reproduce this on ubuntu
Previous Comments:
------------------------------------------------------------------------
[2016-06-30 13:48:01] lazy at iq dot pl
Description:
------------
gcc version 4.7.2 (Debian 4.7.2-5)
compiling with O0 "fixes" the problem,
also works fine on centos 7, so it might be some optimization issue
Breakpoint 1, _php_curl_setopt (ch=0x3d61925b780, option=10023, zvalue=0x3d619213160) at
/usr/src/new/apache2-suexec/work/pri/php-7.0.8/ext/curl/interface.c:2133
2133 {
(gdb) p zvalue
$1 = (zval *) 0x3d619213160
(gdb) list
2128 dupch->res = Z_RES_P(return_value);
2129 }
2130 /* }}} */
2131
2132 static int _php_curl_setopt(php_curl *ch, zend_long option, zval *zvalue) /* {{{ */
2133 {
2134 CURLcode error = CURLE_OK;
2135 zend_long lval;
2136
2137 ZVAL_DEREF(zvalue);
(gdb) next
2137 ZVAL_DEREF(zvalue);
(gdb)
2133 {
(gdb)
2137 ZVAL_DEREF(zvalue);
(gdb)
2138 switch (option) {
(gdb)
3626 }
(gdb)
2603 ph = HASH_OF(zvalue);
(gdb) next
2604 if (!ph) {
(gdb)
2650 ZEND_HASH_FOREACH_VAL(ph, current) {
(gdb)
2661 if ((*ch->clone) == 1) {
(gdb)
2662 zend_hash_index_update_ptr(ch->to_free->slist, option, slist);
(gdb)
2661 if ((*ch->clone) == 1) {
(gdb)
2662 zend_hash_index_update_ptr(ch->to_free->slist, option, slist);
(gdb)
2822 zval_ptr_dtor(&ch->handlers->progress->func_name);
(gdb)
Program received signal SIGSEGV, Segmentation fault.
_zval_ptr_dtor (zval_ptr=0x4) at
/usr/src/new/apache2-suexec/work/pri/php-7.0.8/Zend/zend_execute_API.c:533
533 i_zval_ptr_dtor(zval_ptr ZEND_FILE_LINE_RELAY_CC);
gdb) bt
#0 _zval_ptr_dtor (zval_ptr=0x4) at
/usr/src/new/apache2-suexec/work/pri/php-7.0.8/Zend/zend_execute_API.c:533
#1 0x00000000005807e5 in _php_curl_setopt (ch=ch@entry=0x2c7a8fe3700, option=<optimized out>,
zvalue=zvalue@entry=0x2c7a8fe3520) at
/usr/src/new/apache2-suexec/work/pri/php-7.0.8/ext/curl/interface.c:2822
#2 0x00000000005814b5 in zif_curl_setopt_array (execute_data=<optimized out>,
return_value=0x2c7a9c16660) at
/usr/src/new/apache2-suexec/work/pri/php-7.0.8/ext/curl/interface.c:3015
#3 0x00000000008f8fed in ZEND_DO_FCALL_SPEC_HANDLER (execute_data=0x2c7a9c16430) at
/usr/src/new/apache2-suexec/work/pri/php-7.0.8/Zend/zend_vm_execute.h:842
#4 0x00000000008b66a0 in execute_ex (ex=<optimized out>) at
/usr/src/new/apache2-suexec/work/pri/php-7.0.8/Zend/zend_vm_execute.h:417
#5 0x0000000000907097 in zend_execute (op_array=op_array@entry=0x2c7a9c78000,
return_value=return_value@entry=0x0) at
/usr/src/new/apache2-suexec/work/pri/php-7.0.8/Zend/zend_vm_execute.h:458
#6 0x0000000000878a24 in zend_execute_scripts (type=type@entry=8, retval=retval@entry=0x0,
file_count=file_count@entry=3) at /usr/src/new/apache2-suexec/work/pri/php-7.0.8/Zend/zend.c:1427
#7 0x000000000081aaa0 in php_execute_script (primary_file=primary_file@entry=0x3dcd7e2eaa0) at
/usr/src/new/apache2-suexec/work/pri/php-7.0.8/main/main.c:2494
#8 0x00000000004566ca in main (argc=1, argv=0x3dcd7e2ee58) at
/usr/src/new/apache2-suexec/work/pri/php-7.0.8/sapi/cgi/cgi_main.c:2453
Please look at
https://github.com/php/php-src/blob/master/ext/curl/interface.c#L2663-L2672
May it be running ZEND_HASH_FOREACH_VAL() loop on an empty hash corrupting the stack ?
Test script:
---------------
$ch=curl_init();
curl_setopt($ch, CURLOPT_HTTPHEADER, array());
Expected result:
----------------
Normal execution
Actual result:
--------------
Segfault:
gdb) bt
#0 _zval_ptr_dtor (zval_ptr=0x4) at
/usr/src/new/apache2-suexec/work/pri/php-7.0.8/Zend/zend_execute_API.c:533
#1 0x00000000005807e5 in _php_curl_setopt (ch=ch@entry=0x2c7a8fe3700, option=<optimized out>,
zvalue=zvalue@entry=0x2c7a8fe3520) at
/usr/src/new/apache2-suexec/work/pri/php-7.0.8/ext/curl/interface.c:2822
#2 0x00000000005814b5 in zif_curl_setopt_array (execute_data=<optimized out>,
return_value=0x2c7a9c16660) at
/usr/src/new/apache2-suexec/work/pri/php-7.0.8/ext/curl/interface.c:3015
#3 0x00000000008f8fed in ZEND_DO_FCALL_SPEC_HANDLER (execute_data=0x2c7a9c16430) at
/usr/src/new/apache2-suexec/work/pri/php-7.0.8/Zend/zend_vm_execute.h:842
#4 0x00000000008b66a0 in execute_ex (ex=<optimized out>) at
/usr/src/new/apache2-suexec/work/pri/php-7.0.8/Zend/zend_vm_execute.h:417
#5 0x0000000000907097 in zend_execute (op_array=op_array@entry=0x2c7a9c78000,
return_value=return_value@entry=0x0) at
/usr/src/new/apache2-suexec/work/pri/php-7.0.8/Zend/zend_vm_execute.h:458
#6 0x0000000000878a24 in zend_execute_scripts (type=type@entry=8, retval=retval@entry=0x0,
file_count=file_count@entry=3) at /usr/src/new/apache2-suexec/work/pri/php-7.0.8/Zend/zend.c:1427
#7 0x000000000081aaa0 in php_execute_script (primary_file=primary_file@entry=0x3dcd7e2eaa0) at
/usr/src/new/apache2-suexec/work/pri/php-7.0.8/main/main.c:2494
#8 0x00000000004566ca in main (argc=1, argv=0x3dcd7e2ee58) at
/usr/src/new/apache2-suexec/work/pri/php-7.0.8/sapi/cgi/cgi_main.c:2453
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=72526&edit=1
Thread (7 messages)