From: sroussey at gmail dot com
Operating system: CentOS Linux release 7.2.1511
PHP version: 7.0.13
Package: Apache2 related
Bug Type: Bug
Bug description:Abort on buffer overflow detected with stream_select
Description:
------------
Using stream_select causes php to abort, but only when using mod_php in
apache. On the cli it works fine. Also no issue in 5.6.x
Test script:
---------------
<?php echo stream_select($r=[fopen("/dev/null","r")], $w=[], $e=[], 0,
0); ?>
Expected result:
----------------
echo out a #
Actual result:
--------------
Nothing, the process aborts. (BTW: xdebug makes no difference, this
report includes it, but running without still has the error)
Apache error log:
[Wed Nov 16 21:29:32.229692 2016] [core:notice] [pid 2207699] AH00052:
child pid 2207721 exit signal Aborted (6)
*** buffer overflow detected ***: /usr/sbin/httpd terminated
======= Backtrace: =========
/lib64/libc.so.6(__fortify_fail+0x37)[0x7f5ec24c3597]
/lib64/libc.so.6(+0x10c750)[0x7f5ec24c1750]
/lib64/libc.so.6(+0x10e507)[0x7f5ec24c3507]
/etc/httpd/modules/libphp7.so(+0x1dd37d)[0x7f5eb71b137d]
/etc/httpd/modules/libphp7.so(+0x1df6ce)[0x7f5eb71b36ce]
/etc/httpd/modules/libphp7.so(dtrace_execute_internal+0x2b)[0x7f5eb7208c1b]
/usr/lib64/php/modules/xdebug.so(xdebug_execute_internal+0x161)[0x7f5eb499ccc1]
/etc/httpd/modules/libphp7.so(+0x2c1ce4)[0x7f5eb7295ce4]
/etc/httpd/modules/libphp7.so(execute_ex+0x1b)[0x7f5eb725750b]
/etc/httpd/modules/libphp7.so(dtrace_execute_ex+0x79)[0x7f5eb7208af9]
/usr/lib64/php/modules/xdebug.so(xdebug_execute_ex+0x2df)[0x7f5eb499c34f]
/etc/httpd/modules/libphp7.so(zend_execute+0x1af)[0x7f5eb72a1b5f]
/etc/httpd/modules/libphp7.so(zend_execute_scripts+0xc3)[0x7f5eb7218793]
/etc/httpd/modules/libphp7.so(php_execute_script+0x2d8)[0x7f5eb71b9538]
/etc/httpd/modules/libphp7.so(+0x2cf52d)[0x7f5eb72a352d]
/usr/sbin/httpd(ap_run_handler+0x40)[0x7f5ec3ef7290]
/usr/sbin/httpd(ap_invoke_handler+0x69)[0x7f5ec3ef77d9]
/usr/sbin/httpd(ap_process_async_request+0x20a)[0x7f5ec3f0bbca]
/usr/sbin/httpd(ap_process_request+0x14)[0x7f5ec3f0bea4]
/usr/sbin/httpd(+0x507f2)[0x7f5ec3f087f2]
/usr/sbin/httpd(ap_run_process_connection+0x40)[0x7f5ec3f00890]
/etc/httpd/modules/mod_mpm_prefork.so(+0x380f)[0x7f5eba64980f]
/etc/httpd/modules/mod_mpm_prefork.so(+0x3a55)[0x7f5eba649a55]
/etc/httpd/modules/mod_mpm_prefork.so(+0x3ab6)[0x7f5eba649ab6]
/etc/httpd/modules/mod_mpm_prefork.so(+0x47c0)[0x7f5eba64a7c0]
/usr/sbin/httpd(ap_run_mpm+0x4e)[0x7f5ec3edd5be]
/usr/sbin/httpd(main+0xa86)[0x7f5ec3ed6b46]
/lib64/libc.so.6(__libc_start_main+0xf5)[0x7f5ec23d6b15]
/usr/sbin/httpd(+0x1ec81)[0x7f5ec3ed6c81]
Rewritten php part from gdb:
#6 0x00007fffeb2f837d in stream_array_to_fd_set.part.6 () from
/etc/httpd/modules/libphp7.so
#7 0x00007fffeb2fa6ce in zif_stream_select () from
/etc/httpd/modules/libphp7.so
#8 0x00007fffeb34fc1b in dtrace_execute_internal () from
/etc/httpd/modules/libphp7.so
#9 0x00007fffe2475cc1 in xdebug_execute_internal
(current_execute_data=0x7fffe8e18120, return_value=0x7fffe8e18110) at
/var/tmp/xdebug/xdebug.c:2048
#10 0x00007fffeb3dcce4 in ZEND_DO_FCALL_SPEC_HANDLER () from
/etc/httpd/modules/libphp7.so
#11 0x00007fffeb39e50b in execute_ex () from
/etc/httpd/modules/libphp7.so
#12 0x00007fffeb34faf9 in dtrace_execute_ex () from
/etc/httpd/modules/libphp7.so
#13 0x00007fffe247534f in xdebug_execute_ex
(execute_data=0x7fffe8e18030) at /var/tmp/xdebug/xdebug.c:1900
#14 0x00007fffeb3e8b5f in zend_execute () from
/etc/httpd/modules/libphp7.so
#15 0x00007fffeb35f793 in zend_execute_scripts () from
/etc/httpd/modules/libphp7.so
#16 0x00007fffeb300538 in php_execute_script () from
/etc/httpd/modules/libphp7.so
#17 0x00007fffeb3ea52d in php_handler () from
/etc/httpd/modules/libphp7.so
--
Edit bug report at https://bugs.php.net/bug.php?id=73548&edit=1
--
Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=73548&r=trysnapshot54
Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=73548&r=trysnapshot55
Try a snapshot (trunk): https://bugs.php.net/fix.php?id=73548&r=trysnapshottrunk
Fixed in SVN: https://bugs.php.net/fix.php?id=73548&r=fixed
Fixed in release: https://bugs.php.net/fix.php?id=73548&r=alreadyfixed
Need backtrace: https://bugs.php.net/fix.php?id=73548&r=needtrace
Need Reproduce Script: https://bugs.php.net/fix.php?id=73548&r=needscript
Try newer version: https://bugs.php.net/fix.php?id=73548&r=oldversion
Not developer issue: https://bugs.php.net/fix.php?id=73548&r=support
Expected behavior: https://bugs.php.net/fix.php?id=73548&r=notwrong
Not enough info: https://bugs.php.net/fix.php?id=73548&r=notenoughinfo
Submitted twice: https://bugs.php.net/fix.php?id=73548&r=submittedtwice
register_globals: https://bugs.php.net/fix.php?id=73548&r=globals
PHP 4 support discontinued: https://bugs.php.net/fix.php?id=73548&r=php4
Daylight Savings: https://bugs.php.net/fix.php?id=73548&r=dst
IIS Stability: https://bugs.php.net/fix.php?id=73548&r=isapi
Install GNU Sed: https://bugs.php.net/fix.php?id=73548&r=gnused
Floating point limitations: https://bugs.php.net/fix.php?id=73548&r=float
No Zend Extensions: https://bugs.php.net/fix.php?id=73548&r=nozend
MySQL Configuration Error: https://bugs.php.net/fix.php?id=73548&r=mysqlcfg