Bug #73677 [NEW]: Generating phar.phar core dump with gcc ASAN enabled build

From: ondrej Operating system: Linux PHP version: 7.0.13 Package: PHAR related Bug Type: Bug Bug description:Generating phar.phar core dump with gcc ASAN enabled build Description: ------------ I am trying to find some heap smashing that happens to affect unserialize (different bug) and as a part of that I compiled PHP with gcc -fsanitize=address -fno-omit-frame-pointer -fno-optimize-sibling-calls (and couple of other options). Generating phar.phar aborts in phar module shutdown functions. Generated phar.phar can be executed with standard system PHP 7.0.13: php ext/phar/phar.phar No command given, check ext/phar/phar.phar help So it looks like it was generated correctly. But again it coredumps with ASAN-enabled PHP. Both bt full attached. I would be happy to provide more information. Test script: --------------- Generation: /home/ondrej/Projects/pkg-php/build-area-asan/php7.0-7.0.13/ext-build/sapi/cli/php -n -d opcache.fast_shutdown=0 -d extension_dir=./modules -d extension=phar.so -d 'open_basedir=' -d 'output_buffering=0' -d 'memory_limit=-1' -d phar.readonly=0 -d 'safe_mode=0' ext/phar/phar.php pack -f ext/phar/phar.phar -a pharcommand -c auto -x \\.svn -p 0 -s /home/ondrej/Projects/pkg-php/build-area-asan/php7.0-7.0.13/ext/phar/phar/phar.php -h sha1 -b "/home/ondrej/Projects/pkg-php/build-area-asan/php7.0-7.0.13/ext-build/sapi/cli/php" /home/ondrej/Projects/pkg-php/build-area-asan/php7.0-7.0.13/ext/phar/phar/ Run-time: /home/ondrej/Projects/pkg-php/build-area-asan/php7.0-7.0.13/ext-build/sapi/cli/php -n -d extension_dir=./modules -d extension=phar.so -d 'open_basedir=' -d 'output_buffering=0' -d 'memory_limit=-1' ext/phar/phar.phar Actual result: -------------- == Generation == Program received signal SIGABRT, Aborted. 0x00007ffff557d067 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56 56 ../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory. (gdb) bt full #0 0x00007ffff557d067 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56 resultvar = 0 pid = 136372 selftid = 136372 #1 0x00007ffff557e448 in __GI_abort () at abort.c:89 save_stage = 2 act = {__sigaction_handler = {sa_handler = 0x0, sa_sigaction = 0x0}, sa_mask = {__val = {0, 140737488329520, 140737351949767, 140733193388033, 0, 0, 140737309371688, 66, 140737488329520, 140737339075856, 140737351975653, 0, 140737336725742, 40, 0, 2}}, sa_flags = 66, sa_restorer = 0x1} sigs = {__val = {32, 0 <repeats 15 times>}} #2 0x00007ffff6f66f29 in __sanitizer::Abort () at ../../../../src/libsanitizer/sanitizer_common/sanitizer_posix_libcdep.cc:75 No locals. #3 0x00007ffff6f5eca5 in __asan::AsanDie () at ../../../../src/libsanitizer/asan/asan_rtl.cc:57 num_calls = {val_dont_use = 1} #4 0x00007ffff6f62aa2 in __sanitizer::Die () at ../../../../src/libsanitizer/sanitizer_common/sanitizer_common.cc:61 No locals. #5 0x00007ffff6f673e8 in __sanitizer::RawWrite (buffer=buffer@entry=0x7fffffff9b30 '=' <repeats 65 times>, "\n") at ../../../../src/libsanitizer/sanitizer_common/sanitizer_posix.cc:230 buffer = 0x7fffffff9b30 '=' <repeats 65 times>, "\n" #6 0x00007ffff6f68172 in __sanitizer::SharedPrintfCode(bool, const char *, typedef __va_list_tag __va_list_tag *) (append_pid=append_pid@entry=false, format=0x7ffff6f884d0 '=' <repeats 65 times>, "\n", args=args@entry=0x7fffffff9d08) at ../../../../src/libsanitizer/sanitizer_common/sanitizer_printf.cc:260 args2 = {{gp_offset = 8, fp_offset = 48, overflow_arg_area = 0x7fffffff9de0, reg_save_area = 0x7fffffff9d20}} local_buffer = '=' <repeats 65 times>, "\n\000\377\377\177\000\000@\214\247UUU\000\000\000\235\377\377\377\177\000\000\340\233\377\377\377\177\000\000|\363\377\377\377\017\000\000W\000\000\000\000\000\000\000@\253\377\377\002", '\000' <repeats 11 times>, "u0HX\000\000\000\000\220\000\000\000\000\000\000\000e\221Æ«\022\361c\252\340\233\377\377\377\177\000\000\060\314\000\000\320`\000\000\001\000\000\000W\000\000\000\263\212\265A\000\000\000\000\020\260\354UUU\000\000?m\301UUU\000\000@"... buffer = 0x7fffffff9b30 '=' <repeats 65 times>, "\n" needed_length = <optimized out> buffer_size = <optimized out> #7 0x00007ffff6f68301 in __sanitizer::Printf (format=<optimized out>) at ../../../../src/libsanitizer/sanitizer_common/sanitizer_printf.cc:271 args = {{gp_offset = 8, fp_offset = 48, overflow_arg_area = 0x7fffffff9de0, reg_save_area = 0x7fffffff9d20}} #8 0x00007ffff6f5dde9 in ScopedInErrorReport (this=<optimized out>) at ../../../../src/libsanitizer/asan/asan_report.cc:536 num_calls = {val_dont_use = 1} reporting_thread_tid = 0 #9 __asan_report_error (pc=93824997881664, bp=136372, sp=140737488332504, addr=106721347469152, is_write=66, access_size=8) at ../../../../src/libsanitizer/asan/asan_report.cc:712 curr_tid = 1 tname = "@m\000\000\311\\\241\036\022\000\200\n\000\000\000\000\200\236\377\377\377\177\000\000\060\370\001\000 a\000\000@\370\001\000 a\000\000)\r\366\366\377\177\000\000\240\236\377\377\377\177\000\000\251\002\366\366\377\177\000\000\000\360\177\377\377\177\000\000\071\070\362\366\377\177\000\000\000\020\216\364\377\177\000\000\240\236\377\377\377\177\000\000\340\246\377\377\377\177\000\000@\370\001\000 a\000\000\000\020\216\364\377\177\000\000\001\000\000\000\000\000\000" bug_descr = 0x3 <error: Cannot access memory at address 0x3> stack = {top_frame_bp = 140737479962624, size = 140737336677590, trace = {140737336677672, 140737488351232, 140737488332512, 14, 140737336677672, 93824998293578, 93824998988354, 140737260296090, 140737260297413, 140737260407727, 93824996037755, 93824999517223, 93824998538929, 93824998731069, 93824997615377, 93825000948019, 93825000952938, 140737309481797, 93824999517223, 93824998538929, 93824998731069, 93824997615377, 93825000948019, 93825000952938, 140737309481797, 10, 140737336677672, 93824998293578, 93824996037858, 93824999517223, 93824998538929, 93824998731069, 93824997615377, 93825000948019, 93825000952938, 140737309481797, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 7957631179261175855, 8030569250133733988, 7741739932370298218, 8458375209990237543, 7018141356025736297, 7525567128463958317, 3471773029970622320, 3275375204984107310, 7022008352362820962, 8083795770394765680, 28776, 0 <repeats 68 times>, 140737336739617, 0, 0, 1154619927949213696, 805306369, 0, 56, 40, 140737336708393, 140737488331648, 140737336705705, 140737336758880, 140737336449116, 0, 140737336739617, 72057594037927936, 0, 12905557468058222584, 1308622850, 7355902136086953984, 105965433185008, 105965433185024, 140737336708393, 140737488331680, 140737336705705, 140737479962624, 140737336457273, 140737296338944, 140737488331680, 140737488333792, 105965433185024, 140737296338944, 1, 140737479962624, 140737336677590, 140737336678208, 140737488351232, 140737488333792, 10, 140737336677672, 93824998293578, 93824998709206, 93824998210871, 93824998208979, 93824997704690, 93824997619934, 93825000935172, 93825000952746, 140737309481797, 140737488333888, 8, 140737336678208, 93824998260091, 93825000935726, 3278577354, 1, 17, 106721347411712, 140737351931278, 0, 140737488331920, 140737336343032, 140737336358680, 140737488332192, 51227771, 140737488332176, 140737336739617, 0, 0, 140737354101960, 140737336375894, 140737336374904, 140737336358680, 4294967296, 4294967948, 140737488332096, 0, 140737488332336, 140737354102816, 140737488332376, 140737354101960, 1, 140737351931709, 0, 0, 140733193388033, 0, 140733193388033, 140737354101960, 140737488334208, 13, 140737336677672, 107545981468736, 0, 140737354102816, 140737488332192, 140737488332176, 3278577354, 140737336375894, 4294967295, 106652627926848, 140737336358680, 140737354101960, 106652627926872, 0, 140737488332240, 106721347410752, 11, 106721347410852, 106721347410880, 0, 140737488332288, 93824998293578, 140737488332368, 140737339075528, 0, 107820859040000, 93825002196288, 93825002199236, 140737488332512, 140737351949767, 17587891077121, 0, 140737488332384, 140737336358680, 106721347468992, 140737488332512, 3, 140737351975653, 13340168433644, 106721347469152}} #10 0x00007ffff6f5f014 in __asan::__asan_report_load8 (addr=addr@entry=106721347469152) at ../../../../src/libsanitizer/asan/asan_rtl.cc:253 bp = 140737488332512 pc = <optimized out> local_stack = 13357348296855 sp = 140737488332504 #11 0x0000555555ab7740 in _php_stream_free (stream=0x611000017ec0, close_options=close_options@entry=3) at /home/ondrej/Projects/pkg-php/build-area-asan/php7.0-7.0.13/main/streams/streams.c:371 ret = 1 preserve_handle = 0 release_cast = 1 context = 0x0 #12 0x00007ffff2681a05 in phar_destroy_phar_data (phar=phar@entry=0x61300000c440) at /home/ondrej/Projects/pkg-php/build-area-asan/php7.0-7.0.13/ext/phar/phar.c:254 No locals. #13 0x00007ffff2681cc5 in phar_archive_delref (phar=0x61300000c440) at /home/ondrej/Projects/pkg-php/build-area-asan/php7.0-7.0.13/ext/phar/phar.c:279 No locals. #14 0x00007ffff269cbaf in phar_spl_foreign_dtor (object=0x62100000a100) at /home/ondrej/Projects/pkg-php/build-area-asan/php7.0-7.0.13/ext/phar/phar_object.c:1083 phar = <optimized out> #15 0x00005555558f547b in spl_filesystem_object_free_storage (object=0x62100000b190) at /home/ondrej/Projects/pkg-php/build-area-asan/php7.0-7.0.13/ext/spl/spl_directory.c:80 No locals. #16 0x0000555555c46c27 in zend_objects_store_free_object_storage (objects=objects@entry=0x5555562c75b0 <executor_globals+816>) at /home/ondrej/Projects/pkg-php/build-area-asan/php7.0-7.0.13/Zend/zend_objects_API.c:99 obj_ptr = 0x625000005118 end = 0x625000005108 obj = 0x62100000b190 #17 0x0000555555b57eb1 in shutdown_executor () at /home/ondrej/Projects/pkg-php/build-area-asan/php7.0-7.0.13/Zend/zend_execute_API.c:357 __orig_bailout = <optimized out> func = <optimized out> ce = <optimized out> #18 0x0000555555b86d3d in zend_deactivate () at /home/ondrej/Projects/pkg-php/build-area-asan/php7.0-7.0.13/Zend/zend.c:967 No locals. #19 0x0000555555a76711 in php_request_shutdown (dummy=<optimized out>) at /home/ondrej/Projects/pkg-php/build-area-asan/php7.0-7.0.13/main/main.c:1833 report_memleaks = 1 '\001' #20 0x0000555555da4133 in do_cli (argc=<optimized out>, argv=<optimized out>) at /home/ondrej/Projects/pkg-php/build-area-asan/php7.0-7.0.13/sapi/cli/php_cli.c:1141 c = <optimized out> behavior = <optimized out> reflection_what = <optimized out> exec_direct = <optimized out> exec_run = <optimized out> exec_begin = <optimized out> exec_end = <optimized out> arg_free = <optimized out> arg_excp = <optimized out> script_file = <optimized out> translated_path = 0x60800005a320 "/home/ondrej/Projects/pkg-php/build-area-asan/php7.0-7.0.13/ext-build/ext/phar/phar.php" param_error = <optimized out> #21 0x0000555555da546a in main (argc=<optimized out>, argv=0x61200000bd40) at /home/ondrej/Projects/pkg-php/build-area-asan/php7.0-7.0.13/sapi/cli/php_cli.c:1344 __orig_bailout = 0x0 __bailout = {{__jmpbuf = {105759274745344, -4294967279, -9223142581604977250, 105759274745392, 105759274745248, -4294967279, -9223142580990550501, 105759274745296}, __mask_was_saved = 48448, __saved_mask = {__val = { 18446744069414584337, 9223372043239708525, 105759274745200, 105759274745104, 21474836497, 9230944079081521229, 105827994212880, 105759274745008, 18446744069414584337, 9223378990047502327, 105759274745056, 0, 0, 0, 0, 3429799609}}}} c = <optimized out> exit_status = 0 module_started = 1 sapi_started = 1 php_optarg = 0x60300000bec0 <incomplete sequence \360\276> php_optind = 964689930 use_extended_info = 0 ini_path_override = 0x0 ini_entries = 0x61200000ba40 "html_errors=0\nregister_argc_argv=1\nimplicit_flush=1\noutput_buffering=0\nmax_execution_time=0\nmax_input_time=-1\nopcache.fast_shutdown=0\nextension_dir=\"./modules\"\nextension=phar.so\nopen_basedir=\noutput_b"... ini_entries_len = 147 ini_ignore = 1 sapi_module = <optimized out> == Runtime == Program received signal SIGSEGV, Segmentation fault. _int_free (av=0x7ffff58ed620 <main_arena>, p=0x60200000d500, have_lock=0) at malloc.c:3960 3960 malloc.c: No such file or directory. (gdb) bt full #0 _int_free (av=0x7ffff58ed620 <main_arena>, p=0x60200000d500, have_lock=0) at malloc.c:3960 size = 4935945256022573072 fb = <optimized out> nextchunk = 0x4480602f0000d510 nextsize = <optimized out> nextinuse = <optimized out> prevsize = <optimized out> bck = <optimized out> fwd = <optimized out> errstr = 0x0 locked = 1 __func__ = "_int_free" #1 0x00007ffff267c7ff in mime_type_dtor (zv=<optimized out>) at /home/ondrej/Projects/pkg-php/build-area-asan/php7.0-7.0.13/ext/phar/phar.c:3345 No locals. #2 0x0000555555bc564b in zend_hash_destroy (ht=0x7ffff28e0ae0 <phar_globals+480>) at /home/ondrej/Projects/pkg-php/build-area-asan/php7.0-7.0.13/Zend/zend_hash.c:1276 p = 0x61d000013780 end = 0x61d000013c80 #3 0x00007ffff267c7dc in zm_globals_dtor_phar (phar_globals=<optimized out>) at /home/ondrej/Projects/pkg-php/build-area-asan/php7.0-7.0.13/ext/phar/phar.c:3413 No locals. #4 0x0000555555b9f5e1 in module_destructor (module=module@entry=0x60f00000e320) at /home/ondrej/Projects/pkg-php/build-area-asan/php7.0-7.0.13/Zend/zend_API.c:2514 No locals. #5 0x0000555555b8378e in module_destructor_zval (zv=<optimized out>) at /home/ondrej/Projects/pkg-php/build-area-asan/php7.0-7.0.13/Zend/zend.c:615 module = 0x60f00000e320 #6 0x0000555555bc823b in _zend_hash_del_el_ex (prev=<optimized out>, p=<optimized out>, idx=<optimized out>, ht=<optimized out>) at /home/ondrej/Projects/pkg-php/build-area-asan/php7.0-7.0.13/Zend/zend_hash.c:1026 No locals. #7 _zend_hash_del_el (p=0x619000003980, idx=12, ht=0x5555562c83a0 <module_registry>) at /home/ondrej/Projects/pkg-php/build-area-asan/php7.0-7.0.13/Zend/zend_hash.c:1050 prev = <optimized out> #8 zend_hash_graceful_reverse_destroy (ht=ht@entry=0x5555562c83a0 <module_registry>) at /home/ondrej/Projects/pkg-php/build-area-asan/php7.0-7.0.13/Zend/zend_hash.c:1506 idx = 12 p = 0x619000003980 #9 0x0000555555b99b64 in zend_destroy_modules () at /home/ondrej/Projects/pkg-php/build-area-asan/php7.0-7.0.13/Zend/zend_API.c:1982 No locals. #10 0x0000555555b8646e in zend_shutdown () at /home/ondrej/Projects/pkg-php/build-area-asan/php7.0-7.0.13/Zend/zend.c:840 No locals. #11 0x0000555555a782c0 in php_module_shutdown () at /home/ondrej/Projects/pkg-php/build-area-asan/php7.0-7.0.13/main/main.c:2362 No locals. #12 0x0000555555da5501 in main (argc=<optimized out>, argv=0x60b00000af90) at /home/ondrej/Projects/pkg-php/build-area-asan/php7.0-7.0.13/sapi/cli/php_cli.c:1359 c = <optimized out> exit_status = 1 module_started = 1 sapi_started = 1 php_optarg = 0x7ffff7ffe1a8 "" php_optind = -865167687 use_extended_info = 0 ini_path_override = 0x0 ini_entries = 0x611000009f00 "\021" ini_entries_len = 95 ini_ignore = 1 sapi_module = <optimized out> #0 _int_free (av=0x7ffff58ed620 <main_arena>, p=0x60200000d500, have_lock=0) at malloc.c:3960 size = 4935945256022573072 fb = <optimized out> nextchunk = 0x4480602f0000d510 nextsize = <optimized out> nextinuse = <optimized out> prevsize = <optimized out> bck = <optimized out> fwd = <optimized out> errstr = 0x0 locked = 1 __func__ = "_int_free" #1 0x00007ffff267c7ff in mime_type_dtor (zv=<optimized out>) at /home/ondrej/Projects/pkg-php/build-area-asan/php7.0-7.0.13/ext/phar/phar.c:3345 No locals. #2 0x0000555555bc564b in zend_hash_destroy (ht=0x7ffff28e0ae0 <phar_globals+480>) at /home/ondrej/Projects/pkg-php/build-area-asan/php7.0-7.0.13/Zend/zend_hash.c:1276 p = 0x61d000013780 end = 0x61d000013c80 #3 0x00007ffff267c7dc in zm_globals_dtor_phar (phar_globals=<optimized out>) at /home/ondrej/Projects/pkg-php/build-area-asan/php7.0-7.0.13/ext/phar/phar.c:3413 No locals. #4 0x0000555555b9f5e1 in module_destructor (module=module@entry=0x60f00000e320) at /home/ondrej/Projects/pkg-php/build-area-asan/php7.0-7.0.13/Zend/zend_API.c:2514 No locals. #5 0x0000555555b8378e in module_destructor_zval (zv=<optimized out>) at /home/ondrej/Projects/pkg-php/build-area-asan/php7.0-7.0.13/Zend/zend.c:615 module = 0x60f00000e320 #6 0x0000555555bc823b in _zend_hash_del_el_ex (prev=<optimized out>, p=<optimized out>, idx=<optimized out>, ht=<optimized out>) at /home/ondrej/Projects/pkg-php/build-area-asan/php7.0-7.0.13/Zend/zend_hash.c:1026 No locals. #7 _zend_hash_del_el (p=0x619000003980, idx=12, ht=0x5555562c83a0 <module_registry>) at /home/ondrej/Projects/pkg-php/build-area-asan/php7.0-7.0.13/Zend/zend_hash.c:1050 prev = <optimized out> #8 zend_hash_graceful_reverse_destroy (ht=ht@entry=0x5555562c83a0 <module_registry>) at /home/ondrej/Projects/pkg-php/build-area-asan/php7.0-7.0.13/Zend/zend_hash.c:1506 idx = 12 p = 0x619000003980 #9 0x0000555555b99b64 in zend_destroy_modules () at /home/ondrej/Projects/pkg-php/build-area-asan/php7.0-7.0.13/Zend/zend_API.c:1982 No locals. #10 0x0000555555b8646e in zend_shutdown () at /home/ondrej/Projects/pkg-php/build-area-asan/php7.0-7.0.13/Zend/zend.c:840 No locals. #11 0x0000555555a782c0 in php_module_shutdown () at /home/ondrej/Projects/pkg-php/build-area-asan/php7.0-7.0.13/main/main.c:2362 No locals. #12 0x0000555555da5501 in main (argc=<optimized out>, argv=0x60b00000af90) at /home/ondrej/Projects/pkg-php/build-area-asan/php7.0-7.0.13/sapi/cli/php_cli.c:1359 c = <optimized out> exit_status = 1 module_started = 1 sapi_started = 1 php_optarg = 0x7ffff7ffe1a8 "" php_optind = -865167687 use_extended_info = 0 ini_path_override = 0x0 ini_entries = 0x611000009f00 "\021" ini_entries_len = 95 ini_ignore = 1 sapi_module = <optimized out> -- Edit bug report at https://bugs.php.net/bug.php?id=73677&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=73677&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=73677&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=73677&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=73677&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=73677&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=73677&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=73677&r=needscript Try newer version: https://bugs.php.net/fix.php?id=73677&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=73677&r=support Expected behavior: https://bugs.php.net/fix.php?id=73677&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=73677&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=73677&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=73677&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=73677&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=73677&r=dst IIS Stability: https://bugs.php.net/fix.php?id=73677&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=73677&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=73677&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=73677&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=73677&r=mysqlcfg