Bug #67174 [Fbk->NoF]: cli/TSRM/tsrm_virtual_cwd.c:578 - Program received signal SIGSEGV

Edit report at https://bugs.php.net/bug.php?id=67174&edit=1 ID: 67174 Updated by: php-bugs@lists.php.net Reported by: beber at meleeweb dot net Summary: cli/TSRM/tsrm_virtual_cwd.c:578 - Program received signal SIGSEGV -Status: Feedback +Status: No Feedback Type: Bug Package: Reproducible crash Operating System: Gentoo GNU/Linux PHP Version: 5.4.27 Private report: N New Comment: No feedback was provided. The bug is being suspended because we assume that you are no longer experiencing the problem. If this is not the case and you are able to provide the information that was requested earlier, please do so and change the status of the bug back to "Re-Opened". Thank you. Previous Comments: ------------------------------------------------------------------------ [2017-07-23 02:06:21] kalle@php.net Thank you for this bug report. To properly diagnose the problem, we need a short but complete example script to be able to reproduce this bug ourselves. A proper reproducing script starts with <?php and ends with ?>, is max. 10-20 lines long and does not require any external resources such as databases, etc. If the script requires a database to demonstrate the issue, please make sure it creates all necessary tables, stored procedures etc. Please avoid embedding huge scripts into the report. ------------------------------------------------------------------------ [2014-05-01 23:07:48] beber at meleeweb dot net Description: ------------ I'm getting a SIGSEGV using the following php : # php -v PHP 5.4.27-pl0-gentoo (cli) (built: May 2 2014 00:33:46) (DEBUG) Copyright (c) 1997-2014 The PHP Group Zend Engine v2.4.0, Copyright (c) 1998-2014 Zend Technologies Build options : ./configure --prefix=/usr --build=x86_64-pc-linux-gnu --host=x86_64-pc-linux-gnu --mandir=/usr/share/man --infodir=/usr/share/info --datadir=/usr/share --sysconfdir=/etc --localstatedir=/var/lib --prefix=/usr/lib64/php5.4 --mandir=/usr/lib64/php5.4/man --infodir=/usr/lib64/php5.4/info --libdir=/usr/lib64/php5.4/lib --with-libdir=lib64 --without-pear --disable-maintainer-zts --disable-bcmath --with-bz2=/usr --disable-calendar --enable-ctype --with-curl=/usr --without-curlwrappers --enable-dom --without-enchant --enable-exif --enable-fileinfo --enable-filter --disable-ftp --without-gettext --without-gmp --enable-hash --without-mhash --with-iconv --disable-intl --enable-ipv6 --enable-json --without-kerberos --enable-libxml --with-libxml-dir=/usr --enable-mbstring --with-mcrypt=/usr --without-mssql --with-onig=/usr --with-openssl=/usr --with-openssl-dir=/usr --enable-pcntl --enable-phar --enable-pdo --without-pgsql --enable-posix --without-pspell --without-recode --enable-simple! xml --disable-shmop --without-snmp --disable-soap --disable-sockets --with-sqlite3=/usr --without-sybase-ct --disable-sysvmsg --disable-sysvsem --disable-sysvshm --without-fpm-systemd --without-tidy --enable-tokenizer --disable-wddx --enable-xml --enable-xmlreader --enable-xmlwriter --with-xmlrpc --with-xsl=/usr --disable-zip --with-zlib=/usr --enable-debug --without-cdb --without-db4 --disable-flatfile --without-gdbm --disable-inifile --without-qdbm --with-freetype-dir=/usr --with-t1lib=/usr --disable-gd-jis-conv --with-jpeg-dir=/usr --with-png-dir=/usr --without-xpm-dir --with-gd --with-mysql=mysqlnd --with-mysql-sock=/var/run/mysqld/mysqld.sock --with-mysqli=mysqlnd --without-pdo-dblib --with-pdo-mysql=mysqlnd --without-pdo-pgsql --with-pdo-sqlite=/usr --without-pdo-odbc --with-readline=/usr --without-libedit --without-mm --with-pic --with-pcre-regex=/usr --with-pcre-dir=/usr --with-config-file-path=/etc/php/cli-php5.4 --with-config-file-scan-dir=/etc/php/cli-php5.4/ext-! active --disable-embed --enable-cli --disable-cgi --disable-fp! m --without-apxs2 Using drupal 7.23, 7.x-1.5 entity module. Program received signal SIGSEGV, Segmentation fault. 0x0000555555a5b673 in realpath_cache_key (path=<error reading variable: Cannot access memory at address 0x7fffff7feff8>, path_len=<error reading variable: Cannot access memory at address 0x7fffff7feff4>) at /usr/src/debug/dev-lang/php-5.4.27/sapis-build/cli/TSRM/tsrm_virtual_cwd.c:578 578 { #0 0x0000555555a5b673 in realpath_cache_key (path=<error reading variable: Cannot access memory at address 0x7fffff7feff8>, path_len=<error reading variable: Cannot access memory at address 0x7fffff7feff4>) at /usr/src/debug/dev-lang/php-5.4.27/sapis-build/cli/TSRM/tsrm_virtual_cwd.c:578 h = 44424 e = 0x0 Expected result: ---------------- I should expect a 'Allowed memory size exhausted' or another error, but a SEGV. Actual result: -------------- Full backtrace can be found here (25MB) : http://people.meleeweb.net/~beber/triskel/wwwdev.gdb.txt This is reproducible using apache or cli SAPI with php 5.4.27 and 5.5.10 I seems that an infinite loop is present that lead to memory exhausting. gdb backtrace has 48350 frames. # grep '^#' gdb.txt | awk '{print $4}' | sort | uniq -c | sort -bg 1 ZEND_INCLUDE_OR_EVAL_SPEC_CV_HANDLER 1 do_cli 1 main 1 phar_find_in_include_path 1 phar_resolve_path 1 php_execute_script 1 php_resolve_path 1 php_resolve_path_for_zend 1 realpath_cache_find 1 realpath_cache_key 1 tsrm_realpath 1 virtual_file_ex 1 zend_execute_scripts 2 tsrm_realpath_r 9667 ZEND_DO_FCALL_SPEC_CONST_HANDLER 9667 zend_call_function 9667 zend_do_fcall_common_helper_SPEC 9667 zif_call_user_func_array 9668 execute # grep '^#' gdb.txt | awk '{if ($6 == "at") {print $7}}' | sort | uniq -c | sort -bg 1 /usr/src/debug/dev-lang/php-5.4.27/sapis-build/cli/main/main.c:2502 9668 /usr/src/debug/dev-lang/php-5.4.27/sapis-build/cli/Zend/zend_vm_execute.h:410 ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=67174&edit=1