Bug #72198 [Com]: PHP built with libconv crashes after iconv() is called

From: Date: Sun, 29 Jan 2017 04:05:06 +0000
Subject: Bug #72198 [Com]: PHP built with libconv crashes after iconv() is called
References: 1  Groups: php.bugs 
Request: Send a blank email to php-bugs+get-206996@lists.php.net to get a copy of this message
Edit report at https://bugs.php.net/bug.php?id=72198&edit=1

 ID:                 72198
 Comment by:         bmueller5 at yahoo dot com
 Reported by:        marcelo at tpn dot com dot br
 Summary:            PHP built with libconv crashes after iconv() is
                     called
 Status:             Open
 Type:               Bug
 Package:            Reproducible crash
 Operating System:   FreeBSD 10.3
 PHP Version:        7.0.6
 Block user comment: N
 Private report:     N

 New Comment:

Same Problem. PHP-FPM crashes on FreeBSD 10.3 with PHP 5.6.30 and 7.0.14 if iconv is called

bus error (core dumped)  /usr/local/php56/bin/php -r 'echo iconv("UTF-8",
"UTF-8", "Hello, world.\n");


Previous Comments:
------------------------------------------------------------------------
[2017-01-16 14:41:22] ypnow at 163 dot com

I have the same problem on my freebsd host, looks like it happend when upgrade system of upgrade
libiconv part. And after this, iconv never return normal..

System: FreeBSD 11.0 amd64/ FreeBSD 10.3 amd64
PHP: 5.6.27-29, 7.0.14, 7.1.0.

------------------------------------------------------------------------
[2016-12-30 23:24:57] david at davidfavor dot com

This PHP5.6 configuration seems to work.

lxd: net12-rmt-si # php --version
PHP 5.6.29-1+deb.sury.org~yakkety+1 (cli) 
Copyright (c) 1997-2016 The PHP Group
Zend Engine v2.6.0, Copyright (c) 1998-2016 Zend Technologies
    with Zend OPcache v7.0.6-dev, Copyright (c) 1999-2016, by Zend Technologies
    with Xdebug v2.5.0, Copyright (c) 2002-2016, by Derick Rethans

lxd: net12-rmt-si # php -i | grep ^iconv
iconv
iconv support => enabled
iconv implementation => glibc
iconv library version => 2.24
iconv.input_encoding => no value => no value
iconv.internal_encoding => no value => no value
iconv.output_encoding => no value => no value

lxd: net12-rmt-si # php -r 'echo iconv("UTF-8", "UTF-8", "Hello,
world.\n");'
Hello, world.

------------------------------------------------------------------------
[2016-05-11 15:01:39] marcelo at tpn dot com dot br

This bug also happens in the latest versions of PHP 5.3, 5.4, 5.5 and 5.6.

------------------------------------------------------------------------
[2016-05-11 14:13:18] marcelo at tpn dot com dot br

https://bugs.php.net/patch-display.php?bug_id=69769&patch=solaris-iconv-patch&revision=latest

I've applied this patch and the problem was fixed to me:

# php -i | grep ^iconv
iconv
iconv support => enabled
iconv implementation => libiconv
iconv library version => OS built-in
iconv.input_encoding => no value => no value
iconv.internal_encoding => no value => no value
iconv.output_encoding => no value => no value

# php -r 'echo iconv("UTF-8", "UTF-8", "Hello, world.\n");'
Hello, world.

------------------------------------------------------------------------
[2016-05-11 13:59:37] marcelo at tpn dot com dot br

Description:
------------
PHP built with libconv crashes after iconv() is called

Here are the test results:

1) Without libiconv installed

# php -i | grep ^iconv
iconv
iconv support => enabled
iconv implementation => unknown
iconv library version => unknown
iconv.input_encoding => no value => no value
iconv.internal_encoding => no value => no value
iconv.output_encoding => no value => no value

# php -r 'echo iconv("UTF-8", "UTF-8", "Hello, world.\n");'
Hello, world.

2) With libiconv installed

# php -i | grep ^iconv
iconv
iconv support => enabled
iconv implementation => libiconv
iconv library version => 1.14
iconv.input_encoding => no value => no value
iconv.internal_encoding => no value => no value
iconv.output_encoding => no value => no value

# php -r 'echo iconv("UTF-8", "UTF-8", "Hello, world.\n");'
Bus error (core dumped)

# gdb /usr/local/bin/php /tmp/php.core
GNU gdb 6.1.1 [FreeBSD]
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "amd64-marcel-freebsd"...
Core was generated by `php'.
Program terminated with signal 10, Bus error.
Reading symbols from /lib/libcrypt.so.5...done.
Loaded symbols for /lib/libcrypt.so.5
Reading symbols from /usr/local/lib/libiconv.so.2...done.
Loaded symbols for /usr/local/lib/libiconv.so.2
Reading symbols from /usr/lib/librt.so.1...done.
Loaded symbols for /usr/lib/librt.so.1
Reading symbols from /lib/libm.so.5...done.
Loaded symbols for /lib/libm.so.5
Reading symbols from /usr/local/lib/libxml2.so.2...done.
Loaded symbols for /usr/local/lib/libxml2.so.2
Reading symbols from /lib/libz.so.6...done.
Loaded symbols for /lib/libz.so.6
Reading symbols from /lib/libc.so.7...done.
Loaded symbols for /lib/libc.so.7
Reading symbols from /lib/libthr.so.3...done.
Loaded symbols for /lib/libthr.so.3
Reading symbols from /usr/lib/liblzma.so.5...done.
Loaded symbols for /usr/lib/liblzma.so.5
Reading symbols from /libexec/ld-elf.so.1...done.
Loaded symbols for /libexec/ld-elf.so.1
#0  0x00000008022700d1 in __bsd_iconv () from /lib/libc.so.7
[New Thread 803006400 (LWP 100060/<unknown>)]
(gdb) bt
#0  0x00000008022700d1 in __bsd_iconv () from /lib/libc.so.7
#1  0x00000000006c4c8d in php_iconv_string (in_p=0x8034018d8 "Hello, world.\n", in_len=14,
out=0x7fffffffdce8, out_charset=0x80345eb58 "UTF-8", in_charset=0x80345eb58
"UTF-8") at iconv.c:654
#2  0x00000000006c2f14 in php_if_iconv (execute_data=0x8034130a0, return_value=0x803413090) at
iconv.c:2462
#3  0x0000000000a1eea3 in ZEND_DO_ICALL_SPEC_HANDLER (execute_data=0x803413030) at
zend_vm_execute.h:586
#4  0x00000000009bc0b4 in execute_ex (ex=0x803413030) at zend_vm_execute.h:417
#5  0x00000000009bc223 in zend_execute (op_array=0x80347c000, return_value=0x7fffffffdea0) at
zend_vm_execute.h:458
#6  0x000000000093610a in zend_eval_stringl (str=0x7fffffffed4f "echo
iconv(\"UTF-8\", \"UTF-8\", \"Hello, world.\\n\");", str_len=48,
retval_ptr=0x0, 
    string_name=0xe8bc45 "Command line code") at zend_execute_API.c:1135
#7  0x0000000000936341 in zend_eval_stringl_ex (str=0x7fffffffed4f "echo
iconv(\"UTF-8\", \"UTF-8\", \"Hello, world.\\n\");", str_len=48,
retval_ptr=0x0, 
    string_name=0xe8bc45 "Command line code", handle_exceptions=1) at
zend_execute_API.c:1176
#8  0x00000000009363e3 in zend_eval_string_ex (str=0x7fffffffed4f "echo
iconv(\"UTF-8\", \"UTF-8\", \"Hello, world.\\n\");",
retval_ptr=0x0, string_name=0xe8bc45 "Command line code", 
    handle_exceptions=1) at zend_execute_API.c:1187
#9  0x0000000000a522f6 in do_cli (argc=3, argv=0x7fffffffeae8) at php_cli.c:1005
#10 0x0000000000a51029 in main (argc=3, argv=0x7fffffffeae8) at php_cli.c:1344
(gdb) bt full
#0  0x00000008022700d1 in __bsd_iconv () from /lib/libc.so.7
No symbol table info available.
#1  0x00000000006c4c8d in php_iconv_string (in_p=0x8034018d8 "Hello, world.\n", in_len=14,
out=0x7fffffffdce8, out_charset=0x80345eb58 "UTF-8", in_charset=0x80345eb58
"UTF-8") at iconv.c:654
	cd = 0x8031140c0
	in_left = 14
	out_size = 0
	out_left = 46
	out_p = 0x8034720f8 ""
	bsz = 46
	result = 0
	retval = PHP_ICONV_ERR_SUCCESS
	out_buf = (zend_string *) 0x8034720e0
	ignore_ilseq = 0
#2  0x00000000006c2f14 in php_if_iconv (execute_data=0x8034130a0, return_value=0x803413090) at
iconv.c:2462
	in_charset = 0x80345eb58 "UTF-8"
	out_charset = 0x80345eb58 "UTF-8"
	in_buffer = (zend_string *) 0x8034018c0
	in_charset_len = 5
	out_charset_len = 5
	err = PHP_ICONV_ERR_ALLOC
	out_buffer = (zend_string *) 0x0
#3  0x0000000000a1eea3 in ZEND_DO_ICALL_SPEC_HANDLER (execute_data=0x803413030) at
zend_vm_execute.h:586
	opline = (const zend_op *) 0x80347c180
	call = (zend_execute_data *) 0x8034130a0
	fbc = (zend_function *) 0x8030c1dc0
	ret = (zval *) 0x803413090
#4  0x00000000009bc0b4 in execute_ex (ex=0x803413030) at zend_vm_execute.h:417
	ret = 0
	execute_data = (zend_execute_data *) 0x803413030
#5  0x00000000009bc223 in zend_execute (op_array=0x80347c000, return_value=0x7fffffffdea0) at
zend_vm_execute.h:458
	execute_data = (zend_execute_data *) 0x803413030
#6  0x000000000093610a in zend_eval_stringl (str=0x7fffffffed4f "echo
iconv(\"UTF-8\", \"UTF-8\", \"Hello, world.\\n\");", str_len=48,
retval_ptr=0x0, 
    string_name=0xe8bc45 "Command line code") at zend_execute_API.c:1135
	__orig_bailout = (sigjmp_buf *) 0x7fffffffe7c0
	__bailout = {{_sjb = {9658598, 0, 140737488346616, 140737488346896, 140737488349920,
140737488349960, 140737488349928, 3, 140737488290431, 4436701216774, 34414620728, 
      140733193388032}}}
	local_retval = {value = {lval = 34414620672, dval = 1.7003081788693194e-313, counted = 0x803457000,
str = 0x803457000, arr = 0x803457000, obj = 0x803457000, res = 0x803457000, 
    ref = 0x803457000, ast = 0x803457000, zv = 0x803457000, ptr = 0x803457000, ce = 0x803457000,
func = 0x803457000, ww = {w1 = 54882304, w2 = 8}}, u1 = {v = {type = 0 '\0', 
      type_flags = 0 '\0', const_flags = 0 '\0', reserved = 0 '\0'},
type_info = 0}, u2 = {var_flags = 32767, next = 32767, cache_slot = 32767, lineno = 32767, num_args
= 32767, 
    fe_pos = 32767, fe_iter_idx = 32767}}
	pv = {value = {lval = 34414731264, dval = 1.7003136428401099e-313, counted = 0x803472000, str =
0x803472000, arr = 0x803472000, obj = 0x803472000, res = 0x803472000, 
    ref = 0x803472000, ast = 0x803472000, zv = 0x803472000, ptr = 0x803472000, ce = 0x803472000,
func = 0x803472000, ww = {w1 = 54992896, w2 = 8}}, u1 = {v = {type = 6 '\006', 
      type_flags = 20 '\024', const_flags = 0 '\0', reserved = 0
'\0'}, type_info = 5126}, u2 = {var_flags = 0, next = 0, cache_slot = 0, lineno = 0,
num_args = 0, fe_pos = 0, 
    fe_iter_idx = 0}}
	new_op_array = (zend_op_array *) 0x80347c000
	original_compiler_options = 2
	retval = 54882416
#7  0x0000000000936341 in zend_eval_stringl_ex (str=0x7fffffffed4f "echo
iconv(\"UTF-8\", \"UTF-8\", \"Hello, world.\\n\");", str_len=48,
retval_ptr=0x0, 
    string_name=0xe8bc45 "Command line code", handle_exceptions=1) at
zend_execute_API.c:1176
	result = 1
#8  0x00000000009363e3 in zend_eval_string_ex (str=0x7fffffffed4f "echo
iconv(\"UTF-8\", \"UTF-8\", \"Hello, world.\\n\");",
retval_ptr=0x0, string_name=0xe8bc45 "Command line code", 
    handle_exceptions=1) at zend_execute_API.c:1187
No locals.
#9  0x0000000000a522f6 in do_cli (argc=3, argv=0x7fffffffeae8) at php_cli.c:1005
	__orig_bailout = (sigjmp_buf *) 0x7fffffffe9b0
	__bailout = {{_sjb = {10818544, 0, 140737488347032, 140737488349520, 140737488349920,
140737488349960, 140737488349928, 3, 15139711, 15150210, 15150224, 0}}}
	c = -1
	file_handle = {handle = {fd = 39419280, fp = 0x802597d90, stream = {handle = 0x802597d90, isatty =
9032672, mmap = {len = 9046320, pos = 9071088, map = 0x8a9ea0, 
        buf = 0x8b2b40 "UH\211?H\203?`H\213\005??\214", old_handle = 0x8a0960, old_closer
= 0x11934a0 <cli_sapi_module>}, reader = 0, fsizer = 0x11934a0 <cli_sapi_module>, 
      closer = 0xe73711 <php_init_config.paths_separator+2>}}, filename = 0xe71b48
"-", opened_path = 0x0, type = ZEND_HANDLE_FP, free_filename = 0 '\0'}
	behavior = 6
	reflection_what = 0x0
	request_started = 1
	exit_status = 0
	php_optarg = 0x7fffffffed4f "echo iconv(\"UTF-8\", \"UTF-8\",
\"Hello, world.\\n\");"
	orig_optarg = 0x0
	php_optind = 3
	orig_optind = 1
	exec_direct = 0x7fffffffed4f "echo iconv(\"UTF-8\", \"UTF-8\",
\"Hello, world.\\n\");"
	exec_run = 0x0
	exec_begin = 0x0
	exec_end = 0x0
	arg_free = 0x7fffffffed4f "echo iconv(\"UTF-8\", \"UTF-8\", \"Hello,
world.\\n\");"
	arg_excp = (char **) 0x7fffffffeaf8
	script_file = 0x0
	translated_path = 0x0
	interactive = 0
	lineno = 0
	param_error = 0x0
	hide_argv = 0
#10 0x0000000000a51029 in main (argc=3, argv=0x7fffffffeae8) at php_cli.c:1344
	__orig_bailout = (sigjmp_buf *) 0x0
	__bailout = {{_sjb = {10817537, 0, 140737488349528, 140737488349824, 140737488349920,
140737488349960, 140737488349928, 3, 140737488290687, 140737488349960, 140737488349928, 0}}}
	c = -1
	exit_status = 0
	module_started = 1
	sapi_started = 1
	php_optarg = 0x7fffffffed4f "echo iconv(\"UTF-8\", \"UTF-8\",
\"Hello, world.\\n\");"
	php_optind = 3
	use_extended_info = 0
	ini_path_override = 0x0
	ini_entries = 0x80301e080
"html_errors=0\nregister_argc_argv=1\nimplicit_flush=1\noutput_buffering=0\nmax_execution_time=0\nmax_input_time=-1\n"
	ini_entries_len = 110
	ini_ignore = 0
	sapi_module = (sapi_module_struct *) 0x11934a0
(gdb) quit


Test script:
---------------
# php -r 'echo iconv("UTF-8", "UTF-8", "Hello, world.\n");'

Expected result:
----------------
Hello, world.

Actual result:
--------------
Bus error (core dumped)


------------------------------------------------------------------------



--
Edit this bug report at https://bugs.php.net/bug.php?id=72198&edit=1


Thread (10 messages)

« previous php.bugs (#206996) next »