Bug #68921 [Fbk->Asn]: segfault

From: Date: Sun, 10 Sep 2017 16:39:13 +0000
Subject: Bug #68921 [Fbk->Asn]: segfault
References: 1  Groups: php.bugs 
Request: Send a blank email to php-bugs+get-211030@lists.php.net to get a copy of this message
Edit report at https://bugs.php.net/bug.php?id=68921&edit=1

 ID:                 68921
 User updated by:    public at grik dot net
 Reported by:        public at grik dot net
 Summary:            segfault
-Status:             Feedback
+Status:             Assigned
 Type:               Bug
 Package:            Reproducible crash
 Operating System:   Cent OS 6
 PHP Version:        5.6.6
 Assigned To:        cmb
 Block user comment: N
 Private report:     N

 New Comment:

Not reproduced in 7.1,9

Nice way to handle errors - just wait till version gets out of support cycle ;)


Previous Comments:
------------------------------------------------------------------------
[2017-09-10 15:01:24] cmb@php.net

PHP 5 does not have active support anymore (only security issues
would be adressed). So, can anybody reproduce this issue with PHP
7?

------------------------------------------------------------------------
[2017-04-04 07:39:20] jboffel at gmail dot com

Confirmed still on 5.6.21

The content-type header criteria is not relevant.

You just need a post request with an empty body using php-fpm.
It does not happen with Apache php mod.

------------------------------------------------------------------------
[2016-01-09 14:21:40] der at internethering dot de

Yet not fixed in 5.6.16:

curl -d '' -H 'Content-Type:' https://le-h.de/t.php

-> Error 503

#0  0x0000000000adcc79 in _zval_dtor_func (zvalue=0x7f03c5b5d268, __zend_filename=0x10cb078
"/tmp/distccd_ghnfGr/var/phpbuild/portage/dev-lang/php-5.6.16/work/sapis-build/fpm/Zend/zend_execute.h",
__zend_lineno=79)
    at /var/phpbuild/portage/dev-lang/php-5.6.16/work/sapis-build/fpm/Zend/zend_variables.c:36
36				CHECK_ZVAL_STRING_REL(zvalue);
(gdb) bt
#0  0x0000000000adcc79 in _zval_dtor_func (zvalue=0x7f03c5b5d268, __zend_filename=0x10cb078
"/tmp/distccd_ghnfGr/var/phpbuild/portage/dev-lang/php-5.6.16/work/sapis-build/fpm/Zend/zend_execute.h",
__zend_lineno=79)
    at /var/phpbuild/portage/dev-lang/php-5.6.16/work/sapis-build/fpm/Zend/zend_variables.c:36
#1  0x0000000000ac4769 in _zval_dtor (zvalue=0x7f03c5b5d268, __zend_filename=0x10cb078
"/tmp/distccd_ghnfGr/var/phpbuild/portage/dev-lang/php-5.6.16/work/sapis-build/fpm/Zend/zend_execute.h",
__zend_lineno=79)
    at
/tmp/distccd_ghnfGr/var/phpbuild/portage/dev-lang/php-5.6.16/work/sapis-build/fpm/Zend/zend_variables.h:35
#2  0x0000000000ac4861 in i_zval_ptr_dtor (zval_ptr=0x7f03c5b5d268, __zend_filename=0x10cd470
"/var/phpbuild/portage/dev-lang/php-5.6.16/work/sapis-build/fpm/Zend/zend_variables.c",
__zend_lineno=188, tsrm_ls=0x2baf0c0)
    at
/tmp/distccd_ghnfGr/var/phpbuild/portage/dev-lang/php-5.6.16/work/sapis-build/fpm/Zend/zend_execute.h:79
#3  0x0000000000ac6aa5 in _zval_ptr_dtor (zval_ptr=0x7f03c5b5d560, __zend_filename=0x10cd470
"/var/phpbuild/portage/dev-lang/php-5.6.16/work/sapis-build/fpm/Zend/zend_variables.c",
__zend_lineno=188)
    at /var/phpbuild/portage/dev-lang/php-5.6.16/work/sapis-build/fpm/Zend/zend_execute_API.c:424
#4  0x0000000000add256 in _zval_ptr_dtor_wrapper (zval_ptr=0x7f03c5b5d560) at
/var/phpbuild/portage/dev-lang/php-5.6.16/work/sapis-build/fpm/Zend/zend_variables.c:188
#5  0x0000000000af589c in i_zend_hash_bucket_delete (ht=0x2bb2928, p=0x7f03c5b5d548) at
/var/phpbuild/portage/dev-lang/php-5.6.16/work/sapis-build/fpm/Zend/zend_hash.c:182
#6  0x0000000000af5976 in zend_hash_bucket_delete (ht=0x2bb2928, p=0x7f03c5b5d548) at
/var/phpbuild/portage/dev-lang/php-5.6.16/work/sapis-build/fpm/Zend/zend_hash.c:192
#7  0x0000000000af783a in zend_hash_graceful_reverse_destroy (ht=0x2bb2928) at
/var/phpbuild/portage/dev-lang/php-5.6.16/work/sapis-build/fpm/Zend/zend_hash.c:613
#8  0x0000000000ac5b27 in shutdown_executor (tsrm_ls=0x2baf0c0) at
/var/phpbuild/portage/dev-lang/php-5.6.16/work/sapis-build/fpm/Zend/zend_execute_API.c:244
#9  0x0000000000ae0893 in zend_deactivate (tsrm_ls=0x2baf0c0) at
/var/phpbuild/portage/dev-lang/php-5.6.16/work/sapis-build/fpm/Zend/zend.c:960
#10 0x0000000000a19882 in php_request_shutdown (dummy=0x0) at
/var/phpbuild/portage/dev-lang/php-5.6.16/work/sapis-build/fpm/main/main.c:1883
#11 0x0000000000bcdba6 in main (argc=4, argv=0x7ffddd839a68) at
/var/phpbuild/portage/dev-lang/php-5.6.16/work/sapis-build/fpm/sapi/fpm/fpm/fpm_main.c:1992

------------------------------------------------------------------------
[2015-06-12 09:47:21] andrey at kostin dot email

Not fixed in 5.6.10:

curl -X POST http://example.com/script.php

WARNING: [pool www] child 12008 exited on signal 11 (SIGSEGV - core dumped) after 1166.718710
seconds from start

------------------------------------------------------------------------
[2015-06-03 21:59:32] andrey at kostin dot email

I experience the same problem with PHP 5.6.9 under Ubuntu 14.04 with no 3rd-party libraries
installed. Test script contains the following code:
<?php
echo 'ok';
?>

Request: curl --data "param1=value1" http://example.com/script.php
Response: ok

Request: curl --data "" http://example.com/script.php
Response:
  <html>
  <head><title>502 Bad Gateway</title></head>
  <body bgcolor="white">
  <center><h1>502 Bad Gateway</h1></center>
  <hr><center>nginx/1.8.0</center>
  </body>
  </html>

PHP log contains the following:
[04-Jun-2015 00:54:07] WARNING: [pool www] child 16781 exited on signal 11 (SIGSEGV - core dumped)
after 45.570352 seconds from start

Setting always_populate_raw_post_data to -1 solves the problem.

------------------------------------------------------------------------


The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at

    https://bugs.php.net/bug.php?id=68921


--
Edit this bug report at https://bugs.php.net/bug.php?id=68921&edit=1


Thread (18 messages)

« previous php.bugs (#211030) next »