Edit report at https://bugs.php.net/bug.php?id=74877&edit=1
ID: 74877
User updated by: mcfedr at gmail dot com
Reported by: mcfedr at gmail dot com
Summary: Segmentation fault in zend_mm_alloc_small
Status: Open
Type: Bug
Package: Reproducible crash
Operating System: linux/macos
-PHP Version: 7.1.7
+PHP Version: 7.2.0-beta1
Block user comment: N
Private report: N
New Comment:
Still reproduces with 7.2.0-beta1
Previous Comments:
------------------------------------------------------------------------
[2017-07-18 14:43:37] mcfedr at gmail dot com
Interesting idea that I meant to try, and now have. Exactly the same result. Seg fault in the same
place in the same test.
Clearly and issue with memory management, gc_disable and memory_limit=2G and all is fine
------------------------------------------------------------------------
[2017-07-18 13:32:55] schacht at kaliber5 dot de
Had exatly the same issue. Updating PHPUnit 4.x to 6.x (and dependent packages) solved this for me.
------------------------------------------------------------------------
[2017-07-10 10:44:06] mcfedr at gmail dot com
There were no third party extensions installed. I have tried again, with only pdo_sqlite extension
installed (its required to run the tests) and the result is exactly the same. Crashes on the same
line of php code, the php backtrace is the same
Having disabled all other extensions the c backtrace is slightly different, but the top is the same,
crashes on a access-after-free in zend_mm_alloc_small
New result
----------
Core was generated by `php ./vendor/bin/phpunit'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0 0x0000564c35fdd6ae in zend_mm_alloc_small (heap=0x7f4d7ae00040, size=200, bin_num=14,
__zend_filename=0x564c3662df28 "/usr/src/php/Zend/zend_string.h", __zend_lineno=122,
__zend_orig_filename=0x0, __zend_orig_lineno=0)
at /usr/src/php/Zend/zend_alloc.c:1261
1261 heap->free_slot[bin_num] = p->next_free_slot;
(gdb) bt
#0 0x0000564c35fdd6ae in zend_mm_alloc_small (heap=0x7f4d7ae00040, size=200, bin_num=14,
__zend_filename=0x564c3662df28 "/usr/src/php/Zend/zend_string.h", __zend_lineno=122,
__zend_orig_filename=0x0, __zend_orig_lineno=0)
at /usr/src/php/Zend/zend_alloc.c:1261
#1 0x0000564c35fdd950 in zend_mm_alloc_heap (heap=0x7f4d7ae00040, size=200,
__zend_filename=0x564c3662df28 "/usr/src/php/Zend/zend_string.h", __zend_lineno=122,
__zend_orig_filename=0x0, __zend_orig_lineno=0)
at /usr/src/php/Zend/zend_alloc.c:1332
#2 0x0000564c35fe0397 in _emalloc (size=168, __zend_filename=0x564c3662df28
"/usr/src/php/Zend/zend_string.h", __zend_lineno=122, __zend_orig_filename=0x0,
__zend_orig_lineno=0) at /usr/src/php/Zend/zend_alloc.c:2417
#3 0x0000564c35e7ee0c in zend_string_alloc (len=137, persistent=0) at
/usr/src/php/Zend/zend_string.h:122
#4 0x0000564c35e7ee75 in zend_string_init (str=0x7f4d75384780
"%255B%255BC%255DKidslox%255CDevice%255CProfileBundle%255CEntity%255CWebFilterCategoryGroup%2524count%2540%255BAnnot%255D%255D%255B1%255D\n",
len=137, persistent=0)
at /usr/src/php/Zend/zend_string.h:158
#5 0x0000564c35e82db1 in zif_fgets (execute_data=0x7f4d7ae1f990, return_value=0x7f4d7ae1f830) at
/usr/src/php/ext/standard/file.c:1018
#6 0x0000564c3607d1ec in ZEND_DO_FCALL_BY_NAME_SPEC_RETVAL_USED_HANDLER () at
/usr/src/php/Zend/zend_vm_execute.h:876
#7 0x0000564c3607bfd2 in execute_ex (ex=0x7f4d7ae18c60) at /usr/src/php/Zend/zend_vm_execute.h:429
#8 0x0000564c35fff80c in zend_call_function (fci=0x7ffcb65fe4d0, fci_cache=0x7ffcb65fe4a0) at
/usr/src/php/Zend/zend_execute_API.c:855
#9 0x0000564c35df1599 in reflection_method_invoke (execute_data=0x7f4d7ae18bf0,
return_value=0x7f4d7ae18880, variadic=0) at /usr/src/php/ext/reflection/php_reflection.c:3331
#10 0x0000564c35df1762 in zim_reflection_method_invokeArgs (execute_data=0x7f4d7ae18bf0,
return_value=0x7f4d7ae18880) at /usr/src/php/ext/reflection/php_reflection.c:3367
#11 0x0000564c3607dc2e in ZEND_DO_FCALL_SPEC_RETVAL_USED_HANDLER () at
/usr/src/php/Zend/zend_vm_execute.h:1097
#12 0x0000564c3607bfd2 in execute_ex (ex=0x7f4d7ae14030) at /usr/src/php/Zend/zend_vm_execute.h:429
#13 0x0000564c3607c0e7 in zend_execute (op_array=0x7f4d7ae7e000, return_value=0x0) at
/usr/src/php/Zend/zend_vm_execute.h:474
#14 0x0000564c36019368 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at
/usr/src/php/Zend/zend.c:1476
#15 0x0000564c35f7dfbb in php_execute_script (primary_file=0x7ffcb6600c20) at
/usr/src/php/main/main.c:2537
#16 0x0000564c36102c03 in do_cli (argc=2, argv=0x564c388bd090) at
/usr/src/php/sapi/cli/php_cli.c:993
#17 0x0000564c36103db8 in main (argc=2, argv=0x564c388bd090) at /usr/src/php/sapi/cli/php_cli.c:1381
------------------------------------------------------------------------
[2017-07-10 10:13:05] laruence@php.net
do you use any third-part extensions?
to me, this backtrace seems like a write-after-free side-affect.
thanks
------------------------------------------------------------------------
[2017-07-07 20:22:49] mcfedr at gmail dot com
Confirmed on 7.1.0, 7.1.7 and 7.2.0alhpa3
------------------------------------------------------------------------
The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
https://bugs.php.net/bug.php?id=74877
--
Edit this bug report at https://bugs.php.net/bug.php?id=74877&edit=1