Bug #75735 [Com]: [embed SAPI] Segmentation fault in sapi_register_post_entry

From: Date: Tue, 26 Dec 2017 17:10:34 +0000
Subject: Bug #75735 [Com]: [embed SAPI] Segmentation fault in sapi_register_post_entry
References: 1  Groups: php.bugs 
Request: Send a blank email to php-bugs+get-213285@lists.php.net to get a copy of this message 
Edit report at https://bugs.php.net/bug.php?id=75735&edit=1

 ID:                 75735
 Comment by:         volodymyr at wildwolf dot name
 Reported by:        volodymyr at wildwolf dot name
 Summary:            [embed SAPI] Segmentation fault in
                     sapi_register_post_entry
 Status:             Open
 Type:               Bug
 Package:            Reproducible crash
 Operating System:   Ubuntu 17.04 x64
 PHP Version:        7.1.12
 Block user comment: N
 Private report:     N

 New Comment:

Added three lines to the beginning of sapi_register_post_entry():

printf("SG=%p\n", TSRMG_BULK(sapi_globals_id, sapi_globals_struct*)); // Line 951
printf("SG(sapi_started)=%d\n", (int)SG(sapi_started)); // Line 952
printf("EG=%p\n\n", TSRMG_BULK(executor_globals_id, zend_executor_globals *)); // Line 953

Modified the test script a bit:

int main(int argc, char** argv)
{
        printf("First block\n");
        PHP_EMBED_START_BLOCK(argc, argv)
        PHP_EMBED_END_BLOCK();

        printf("Second block\n");
        PHP_EMBED_START_BLOCK(argc, argv)
        PHP_EMBED_END_BLOCK();
}

Compiled and run:

First block
SG=0x55c1cdb6c190
SG(sapi_started)=0
EG=0x21

SG=0x55c1cdb6c190
SG(sapi_started)=0
EG=0x21

SG=0x55c1cdb6c190
SG(sapi_started)=0
EG=0x55c1cdb6f9b0

SG=0x55c1cdb6c190
SG(sapi_started)=0
EG=0x55c1cdb6f9b0

Second block
SG=0x55c1cdbf8d30
Помилка адресування
(збережено знімок
оперативної пам’яті)

Looks like this has something to do with SG(sapi_started).

Running under valgrind:

$ USE_ZEND_ALLOC=0 valgrind ./test
==16297== Memcheck, a memory error detector
==16297== Copyright (C) 2002-2015, and GNU GPL'd, by Julian Seward et al.
==16297== Using Valgrind-3.12.0 and LibVEX; rerun with -h for copyright info
==16297== Command: ./test
==16297== 
First block
SG=0x100adf70
SG(sapi_started)=0
==16297== Invalid read of size 8
==16297==    at 0x53462D3: printf (stdio2.h:104)
==16297==    by 0x53462D3: sapi_register_post_entry (SAPI.c:953)
==16297==    by 0x53463E1: sapi_register_post_entries (SAPI.c:940)
==16297==    by 0x534964F: php_setup_sapi_content_types (php_content_types.c:64)
==16297==    by 0x533823B: ts_allocate_id (TSRM.c:259)
==16297==    by 0x5460FF3: php_embed_init (php_embed.c:182)
==16297==    by 0x108989: main (test.c:7)
==16297==  Address 0x100adf18 is 8 bytes before a block of size 8 alloc'd
==16297==    at 0x4C2DA5F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==16297==    by 0x4C2FDDF: realloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==16297==    by 0x53381E8: ts_allocate_id (TSRM.c:255)
==16297==    by 0x5460FF3: php_embed_init (php_embed.c:182)
==16297==    by 0x108989: main (test.c:7)
==16297== 
EG=(nil)

SG=0x100adf70
SG(sapi_started)=0
EG=(nil)

SG=0x100adf70
SG(sapi_started)=0
EG=0x100b25f0

SG=0x100adf70
SG(sapi_started)=0
EG=0x100b25f0

Second block
SG=0x112dfce0
==16297== Invalid read of size 8
==16297==    at 0x534629E: sapi_register_post_entry (SAPI.c:952)
==16297==    by 0x53463E1: sapi_register_post_entries (SAPI.c:940)
==16297==    by 0x534964F: php_setup_sapi_content_types (php_content_types.c:64)
==16297==    by 0x533823B: ts_allocate_id (TSRM.c:259)
==16297==    by 0x5460FF3: php_embed_init (php_embed.c:182)
==16297==    by 0x108AA2: main (test.c:11)
==16297==  Address 0x100adec0 is 0 bytes inside a block of size 32 free'd
==16297==    at 0x4C2ED5B: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==16297==    by 0x533803F: tsrm_shutdown (TSRM.c:190)
==16297==    by 0x54611C6: php_embed_shutdown (php_embed.c:229)
==16297==    by 0x108A7F: main (test.c:8)
==16297==  Block was alloc'd at
==16297==    at 0x4C2DB2F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==16297==    by 0x533830D: allocate_new_resource (TSRM.c:279)
==16297==    by 0x5338570: ts_resource_ex (TSRM.c:368)
==16297==    by 0x5460FCA: php_embed_init (php_embed.c:176)
==16297==    by 0x108989: main (test.c:7)
==16297== 
==16297== Invalid read of size 8
==16297==    at 0x53462A1: sapi_register_post_entry (SAPI.c:952)
==16297==    by 0x53463E1: sapi_register_post_entries (SAPI.c:940)
==16297==    by 0x534964F: php_setup_sapi_content_types (php_content_types.c:64)
==16297==    by 0x533823B: ts_allocate_id (TSRM.c:259)
==16297==    by 0x5460FF3: php_embed_init (php_embed.c:182)
==16297==    by 0x108AA2: main (test.c:11)
==16297==  Address 0x11123650 is 0 bytes inside a block of size 376 free'd
==16297==    at 0x4C2ED5B: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==16297==    by 0x5338034: tsrm_shutdown (TSRM.c:189)
==16297==    by 0x54611C6: php_embed_shutdown (php_embed.c:229)
==16297==    by 0x108A7F: main (test.c:8)
==16297==  Block was alloc'd at
==16297==    at 0x4C2FD4F: realloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==16297==    by 0x53381E8: ts_allocate_id (TSRM.c:255)
==16297==    by 0x10ECAEF1: ???
==16297==    by 0x53B37FA: zend_startup_module_ex (zend_API.c:1843)
==16297==    by 0x53B5CA5: zend_startup_module (zend_API.c:2454)
==16297==    by 0x53BAC04: zend_extension_startup (zend_extensions.c:184)
==16297==    by 0x539F64F: zend_llist_apply_with_del (zend_llist.c:171)
==16297==    by 0x53BAD26: zend_startup_extensions (zend_extensions.c:205)
==16297==    by 0x533B397: php_module_startup (main.c:2305)
==16297==    by 0x5460F6C: php_embed_startup (php_embed.c:109)
==16297==    by 0x54610C1: php_embed_init (php_embed.c:200)
==16297==    by 0x108989: main (test.c:7)
==16297==
==16297== Invalid read of size 1
==16297==    at 0x53462A6: sapi_register_post_entry (SAPI.c:952)
==16297==    by 0x53463E1: sapi_register_post_entries (SAPI.c:940)
==16297==    by 0x534964F: php_setup_sapi_content_types (php_content_types.c:64)
==16297==    by 0x533823B: ts_allocate_id (TSRM.c:259)
==16297==    by 0x5460FF3: php_embed_init (php_embed.c:182)
==16297==    by 0x108AA2: main (test.c:11)
==16297==  Address 0x1b4 is not stack'd, malloc'd or (recently) free'd
==16297==
==16297==
==16297== Process terminating with default action of signal 11 (SIGSEGV)
==16297==  Access not within mapped region at address 0x1B4
==16297==    at 0x53462A6: sapi_register_post_entry (SAPI.c:952)
==16297==    by 0x53463E1: sapi_register_post_entries (SAPI.c:940)
==16297==    by 0x534964F: php_setup_sapi_content_types (php_content_types.c:64)
==16297==    by 0x533823B: ts_allocate_id (TSRM.c:259)
==16297==    by 0x5460FF3: php_embed_init (php_embed.c:182)
==16297==    by 0x108AA2: main (test.c:11)

The very first error can probably be ignored - it looks like executor globals are not ready yet.

The second one probably means that SAPI globals structure has not been (properly) allocated.


Previous Comments:
------------------------------------------------------------------------
[2017-12-26 15:28:08] volodymyr at wildwolf dot name

Description:
------------
Please see below — the second call to PHP_EMBED_START_BLOCK() crashes the application.

Same happens in PHP 7.2.0 as well.

Configure options:

--with-config-file-path=/home/vladimir/.phpenv/versions/7.1.12-zts-debug/etc
--with-config-file-scan-dir=/home/vladimir/.phpenv/versions/7.1.12-zts-debug/etc/conf.d
--prefix=/home/vladimir/.phpenv/versions/7.1.12-zts-debug
--libexecdir=/home/vladimir/.phpenv/versions/7.1.12-zts-debug/libexec --without-pear --with-gd
--enable-sockets --with-jpeg-dir=/usr --with-png-dir=/usr --enable-exif --enable-zip --with-zlib
--with-zlib-dir=/usr --with-kerberos --with-openssl --with-mcrypt=/usr --enable-soap
--enable-xmlreader --with-xsl --enable-ftp --enable-cgi --with-curl=/usr --with-tidy --with-xmlrpc
--enable-sysvsem --enable-sysvshm --enable-shmop --with-mysql=mysqlnd --with-mysqli=mysqlnd
--with-pdo-mysql=mysqlnd --with-pdo-sqlite --enable-pcntl --with-readline --enable-mbstring
--disable-debug --disable-fpm --enable-embed --enable-bcmath --disable-phpdbg
--enable-maintainer-zts --with-libdir=lib64


Test script:
---------------
#include <sapi/embed/php_embed.h>

int main()
{
        PHP_EMBED_START_BLOCK(0, 0)
        PHP_EMBED_END_BLOCK();

        PHP_EMBED_START_BLOCK(0, 0)
        PHP_EMBED_END_BLOCK();

        return 0;
}


Expected result:
----------------
Program exits normally.

Actual result:
--------------
Program received signal SIGSEGV, Segmentation fault.
0x00007ffff73d826b in sapi_register_post_entry (post_entry=post_entry@entry=0x7ffff7dae160
<php_post_entries>) at /tmp/php-build/source/7.1.12/main/SAPI.c:951
951             if (SG(sapi_started) && EG(current_execute_data)) {
(gdb) bt
#0  0x00007ffff73d826b in sapi_register_post_entry (post_entry=post_entry@entry=0x7ffff7dae160
<php_post_entries>) at /tmp/php-build/source/7.1.12/main/SAPI.c:951
#1  0x00007ffff73d8362 in sapi_register_post_entries (post_entries=post_entries@entry=0x7ffff7dae160
<php_post_entries>) at /tmp/php-build/source/7.1.12/main/SAPI.c:940
#2  0x00007ffff73db5d0 in php_setup_sapi_content_types () at
/tmp/php-build/source/7.1.12/main/php_content_types.c:64
#3  0x00007ffff73ca23c in ts_allocate_id (rsrc_id=rsrc_id@entry=0x7ffff7dd67b8
<sapi_globals_id>, size=size@entry=560, ctor=ctor@entry=0x7ffff73d5db0
<sapi_globals_ctor>, dtor=dtor@entry=0x7ffff73d5d90 <sapi_globals_dtor>) at
/tmp/php-build/source/7.1.12/TSRM/TSRM.c:259
#4  0x00007ffff73d616c in sapi_startup (sf=sf@entry=0x7ffff7db7e40 <php_embed_module>) at
/tmp/php-build/source/7.1.12/main/SAPI.c:84
#5  0x00007ffff74f2f74 in php_embed_init (argc=0, argv=0x0) at
/tmp/php-build/source/7.1.12/sapi/embed/php_embed.c:182
#6  0x0000555555554a2e in main () at test.c:8



------------------------------------------------------------------------



--
Edit this bug report at https://bugs.php.net/bug.php?id=75735&edit=1

Thread (5 messages)

« previous php.bugs (#213285) next »