Bug #73548 [Com]: Abort on buffer overflow detected with stream_select

Edit report at https://bugs.php.net/bug.php?id=73548&edit=1 ID: 73548 Comment by: sroussey at gmail dot com Reported by: sroussey at gmail dot com Summary: Abort on buffer overflow detected with stream_select Status: Open Type: Bug Package: Apache2 related Operating System: CentOS Linux release 7.2.1511 PHP Version: 7.0.13 Block user comment: N Private report: N New Comment: ldd --version ldd (GNU libc) 2.17 Copyright (C) 2012 Free Software Foundation, Inc. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. Written by Roland McGrath and Ulrich Drepper. Previous Comments: ------------------------------------------------------------------------ [2016-11-16 21:44:30] sroussey at gmail dot com Description: ------------ Using stream_select causes php to abort, but only when using mod_php in apache. On the cli it works fine. Also no issue in 5.6.x Test script: --------------- <?php echo stream_select($r=[fopen("/dev/null","r")], $w=[], $e=[], 0, 0); ?> Expected result: ---------------- echo out a # Actual result: -------------- Nothing, the process aborts. (BTW: xdebug makes no difference, this report includes it, but running without still has the error) Apache error log: [Wed Nov 16 21:29:32.229692 2016] [core:notice] [pid 2207699] AH00052: child pid 2207721 exit signal Aborted (6) *** buffer overflow detected ***: /usr/sbin/httpd terminated ======= Backtrace: ========= /lib64/libc.so.6(__fortify_fail+0x37)[0x7f5ec24c3597] /lib64/libc.so.6(+0x10c750)[0x7f5ec24c1750] /lib64/libc.so.6(+0x10e507)[0x7f5ec24c3507] /etc/httpd/modules/libphp7.so(+0x1dd37d)[0x7f5eb71b137d] /etc/httpd/modules/libphp7.so(+0x1df6ce)[0x7f5eb71b36ce] /etc/httpd/modules/libphp7.so(dtrace_execute_internal+0x2b)[0x7f5eb7208c1b] /usr/lib64/php/modules/xdebug.so(xdebug_execute_internal+0x161)[0x7f5eb499ccc1] /etc/httpd/modules/libphp7.so(+0x2c1ce4)[0x7f5eb7295ce4] /etc/httpd/modules/libphp7.so(execute_ex+0x1b)[0x7f5eb725750b] /etc/httpd/modules/libphp7.so(dtrace_execute_ex+0x79)[0x7f5eb7208af9] /usr/lib64/php/modules/xdebug.so(xdebug_execute_ex+0x2df)[0x7f5eb499c34f] /etc/httpd/modules/libphp7.so(zend_execute+0x1af)[0x7f5eb72a1b5f] /etc/httpd/modules/libphp7.so(zend_execute_scripts+0xc3)[0x7f5eb7218793] /etc/httpd/modules/libphp7.so(php_execute_script+0x2d8)[0x7f5eb71b9538] /etc/httpd/modules/libphp7.so(+0x2cf52d)[0x7f5eb72a352d] /usr/sbin/httpd(ap_run_handler+0x40)[0x7f5ec3ef7290] /usr/sbin/httpd(ap_invoke_handler+0x69)[0x7f5ec3ef77d9] /usr/sbin/httpd(ap_process_async_request+0x20a)[0x7f5ec3f0bbca] /usr/sbin/httpd(ap_process_request+0x14)[0x7f5ec3f0bea4] /usr/sbin/httpd(+0x507f2)[0x7f5ec3f087f2] /usr/sbin/httpd(ap_run_process_connection+0x40)[0x7f5ec3f00890] /etc/httpd/modules/mod_mpm_prefork.so(+0x380f)[0x7f5eba64980f] /etc/httpd/modules/mod_mpm_prefork.so(+0x3a55)[0x7f5eba649a55] /etc/httpd/modules/mod_mpm_prefork.so(+0x3ab6)[0x7f5eba649ab6] /etc/httpd/modules/mod_mpm_prefork.so(+0x47c0)[0x7f5eba64a7c0] /usr/sbin/httpd(ap_run_mpm+0x4e)[0x7f5ec3edd5be] /usr/sbin/httpd(main+0xa86)[0x7f5ec3ed6b46] /lib64/libc.so.6(__libc_start_main+0xf5)[0x7f5ec23d6b15] /usr/sbin/httpd(+0x1ec81)[0x7f5ec3ed6c81] Rewritten php part from gdb: #6 0x00007fffeb2f837d in stream_array_to_fd_set.part.6 () from /etc/httpd/modules/libphp7.so #7 0x00007fffeb2fa6ce in zif_stream_select () from /etc/httpd/modules/libphp7.so #8 0x00007fffeb34fc1b in dtrace_execute_internal () from /etc/httpd/modules/libphp7.so #9 0x00007fffe2475cc1 in xdebug_execute_internal (current_execute_data=0x7fffe8e18120, return_value=0x7fffe8e18110) at /var/tmp/xdebug/xdebug.c:2048 #10 0x00007fffeb3dcce4 in ZEND_DO_FCALL_SPEC_HANDLER () from /etc/httpd/modules/libphp7.so #11 0x00007fffeb39e50b in execute_ex () from /etc/httpd/modules/libphp7.so #12 0x00007fffeb34faf9 in dtrace_execute_ex () from /etc/httpd/modules/libphp7.so #13 0x00007fffe247534f in xdebug_execute_ex (execute_data=0x7fffe8e18030) at /var/tmp/xdebug/xdebug.c:1900 #14 0x00007fffeb3e8b5f in zend_execute () from /etc/httpd/modules/libphp7.so #15 0x00007fffeb35f793 in zend_execute_scripts () from /etc/httpd/modules/libphp7.so #16 0x00007fffeb300538 in php_execute_script () from /etc/httpd/modules/libphp7.so #17 0x00007fffeb3ea52d in php_handler () from /etc/httpd/modules/libphp7.so ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=73548&edit=1