Bug #75989 [Opn->Fbk]: SIGSEGV at php_html_entities

Edit report at https://bugs.php.net/bug.php?id=75989&edit=1 ID: 75989 Updated by: nikic@php.net Reported by: yuri dot grigorian at ca dot com Summary: SIGSEGV at php_html_entities -Status: Open +Status: Feedback Type: Bug Package: Unknown/Other Function Operating System: Ubuntu 14 PHP Version: 5.6.33 Block user comment: N Private report: N Previous Comments: ------------------------------------------------------------------------ [2018-02-21 13:31:49] cmb@php.net PHP 5.6 does no longer receive normal bug fixes, but security fixes only. Unless this is a security issue (hard to assess without a reproduce script), or it happens also on PHP 7.1 at least, we won't fix it. ------------------------------------------------------------------------ [2018-02-21 10:58:13] yuri dot grigorian at ca dot com Description: ------------ I occasionally experience apache2 child crashes, Couldn't reproduce it manually... Got lots of coredumps, but it seems they come from a different place each time. Attached are backtraces of the most popular ones. Machine is Ubuntu 14, libapache2-mod-php5.6, php 5.6.33+3, Apache/2.4.7, installed from ondrej ppa. Actual result: -------------- (gdb) bt full #0 0x00007f9e85698f13 in get_default_charset () at /build/php5.6-I6I9am/php5.6-5.6.33/ext/standard/html.c:90 No locals. #1 0x00007f9e8569b735 in php_html_entities (ht=<optimized out>, return_value=0x7f9e8d0ea070, all=0, return_value_used=<optimized out>, this_ptr=<optimized out>, return_value_ptr=<optimized out>) at /build/php5.6-I6I9am/php5.6-5.6.33/ext/standard/html.c:1464 str = 0x7f9e8d0ea910 "Status changed to CREATE (5)" hint_charset = 0x0 str_len = 28 hint_charset_len = 0 new_len = 140318948106352 flags = 2 replaced = <optimized out> double_encode = 1 '\001' #2 0x00007f9e85733b1b in dtrace_execute_internal (execute_data_ptr=<optimized out>, fci=<optimized out>, return_value_used=<optimized out>) at /build/php5.6-I6I9am/php5.6-5.6.33/Zend/zend_dtrace.c:97 lineno = <optimized out> filename = <optimized out> #3 0x00007f9e857e9b54 in zend_do_fcall_common_helper_SPEC (execute_data=<optimized out>) at /build/php5.6-I6I9am/php5.6-5.6.33/Zend/zend_vm_execute.h:560 ret = 0x7f9e8986aa00 opline = <optimized out> should_change_scope = <optimized out> fbc = 0x7f9e8a6303d0 num_args = <optimized out> #4 0x00007f9e8577f0b8 in execute_ex (execute_data=0x7f9e8986aa40) at /build/php5.6-I6I9am/php5.6-5.6.33/Zend/zend_vm_execute.h:363 ret = <optimized out> original_in_execution = 1 '\001' #5 0x00007f9e85733a19 in dtrace_execute_ex (execute_data=<optimized out>) at /build/php5.6-I6I9am/php5.6-5.6.33/Zend/zend_dtrace.c:73 lineno = <optimized out> scope = 0x0 filename = <optimized out> funcname = <optimized out> classname = <optimized out> #6 0x00007f9e7544c74e in nr_php_execute_enabled () at /home/hudson/slave-workspace/workspace/php-release-agent/label/centos5-64-nrcamp/agent/php_execute.c:1191 No locals. #7 0x00007f9e7544ce32 in nr_php_execute () at /home/hudson/slave-workspace/workspace/php-release-agent/label/centos5-64-nrcamp/agent/php_execute.c:1301 No locals. #8 0x00007f9e857ea077 in zend_do_fcall_common_helper_SPEC (execute_data=<optimized out>) at /build/php5.6-I6I9am/php5.6-5.6.33/Zend/zend_vm_execute.h:592 ret = 0x7f9e8986a848 opline = 0x7f9e71250a08 should_change_scope = <optimized out> fbc = 0x7f9e8d0e8750 num_args = <optimized out> #9 0x00007f9e8577f0b8 in execute_ex (execute_data=0x7f9e8986a868) at /build/php5.6-I6I9am/php5.6-5.6.33/Zend/zend_vm_execute.h:363 ret = <optimized out> original_in_execution = 1 '\001' #10 0x00007f9e85733a19 in dtrace_execute_ex (execute_data=<optimized out>) at /build/php5.6-I6I9am/php5.6-5.6.33/Zend/zend_dtrace.c:73 ---Type <return> to continue, or q <return> to quit--- lineno = <optimized out> scope = 0x0 filename = <optimized out> funcname = <optimized out> classname = <optimized out> #11 0x00007f9e7544c74e in nr_php_execute_enabled () at /home/hudson/slave-workspace/workspace/php-release-agent/label/centos5-64-nrcamp/agent/php_execute.c:1191 No locals. #12 0x00007f9e7544ce32 in nr_php_execute () at /home/hudson/slave-workspace/workspace/php-release-agent/label/centos5-64-nrcamp/agent/php_execute.c:1301 No locals. #13 0x00007f9e8573574f in zend_call_function (fci=fci@entry=0x7ffff6617a90, fci_cache=<optimized out>, fci_cache@entry=0x7ffff6617a60) at /build/php5.6-I6I9am/php5.6-5.6.33/Zend/zend_execute_API.c:831 current_opline_before_exception = 0x7f9e723b6710 i = <optimized out> original_return_value = 0x0 calling_symbol_table = 0x0 original_op_array = 0x7f9e8ad8a560 original_opline_ptr = 0x7f9e8986a6a8 current_scope = 0x7f9e8ad7e3b0 current_called_scope = 0x7f9e8ad7d128 calling_scope = <optimized out> called_scope = 0x7f9e8cf258f0 current_this = 0x7f9e8cf0e108 execute_data = {opline = 0x0, function_state = {function = 0x7f9e8cf26068, arguments = 0x7f9e8986a7e0}, op_array = 0x0, object = 0x7f9e8cf3ffb0, symbol_table = 0x0, prev_execute_data = 0x7f9e8986a6a8, old_error_reporting = 0x0, nested = 0 '\000', original_return_value = 0x0, current_scope = 0x7f9e8ad7e3b0, current_called_scope = 0x7f9e8ad7d128, current_this = 0x7f9e8cf0e108, fast_ret = 0x0, delayed_exception = 0x0, call_slots = 0x7f9e8986a790, call = 0x7f9e8986a790} fci_cache_local = {initialized = 4 '\004', function_handler = 0x7f9e8574e798 <zend_parse_parameters+152>, calling_scope = 0x7f9e85b32f00 <executor_globals+576>, called_scope = 0x3000000028, object_ptr = 0x7ffff6617a50} #14 0x00007f9e85682472 in zif_call_user_func_array (ht=<optimized out>, return_value=0x7f9e8cfe4710, return_value_ptr=<optimized out>, this_ptr=<optimized out>, return_value_used=<optimized out>) at /build/php5.6-I6I9am/php5.6-5.6.33/ext/standard/basic_functions.c:4790 params = 0x7f9e8cfe4688 retval_ptr = 0x0 fci = {size = 72, function_table = 0x7f9e8cf25918, function_name = 0x7f9e8cf42750, symbol_table = 0x0, retval_ptr_ptr = 0x7ffff6617a58, param_count = 3, params = 0x7f9e8cfddc18, object_ptr = 0x7f9e8cf3ffb0, no_separation = 1 '\001'} fci_cache = {initialized = 1 '\001', function_handler = 0x7f9e8cf26068, calling_scope = 0x7f9e8cf258f0, called_scope = 0x7f9e8cf258f0, object_ptr = 0x7f9e8cf3ffb0} #15 0x00007f9e85733b1b in dtrace_execute_internal (execute_data_ptr=<optimized out>, fci=<optimized out>, return_value_used=<optimized out>) at /build/php5.6-I6I9am/php5.6-5.6.33/Zend/zend_dtrace.c:97 lineno = <optimized out> filename = <optimized out> #16 0x00007f9e857e9b54 in zend_do_fcall_common_helper_SPEC (execute_data=<optimized out>) at /build/php5.6-I6I9am/php5.6-5.6.33/Zend/zend_vm_execute.h:560 ret = 0x7f9e8986a688 opline = <optimized out> should_change_scope = <optimized out> fbc = 0x7f9e8a641380 num_args = <optimized out> #17 0x00007f9e8577f0b8 in execute_ex (execute_data=0x7f9e8986a6a8) at /build/php5.6-I6I9am/php5.6-5.6.33/Zend/zend_vm_execute.h:363 ret = <optimized out> ---Type <return> to continue, or q <return> to quit--- original_in_execution = 1 '\001' #18 0x00007f9e85733a19 in dtrace_execute_ex (execute_data=<optimized out>) at /build/php5.6-I6I9am/php5.6-5.6.33/Zend/zend_dtrace.c:73 lineno = <optimized out> scope = 0x0 filename = <optimized out> funcname = <optimized out> classname = <optimized out> #19 0x00007f9e7544c74e in nr_php_execute_enabled () at /home/hudson/slave-workspace/workspace/php-release-agent/label/centos5-64-nrcamp/agent/php_execute.c:1191 No locals. #20 0x00007f9e7544ce32 in nr_php_execute () at /home/hudson/slave-workspace/workspace/php-release-agent/label/centos5-64-nrcamp/agent/php_execute.c:1301 No locals. #21 0x00007f9e857ea077 in zend_do_fcall_common_helper_SPEC (execute_data=<optimized out>) at /build/php5.6-I6I9am/php5.6-5.6.33/Zend/zend_vm_execute.h:592 ret = 0x7f9e8986a538 opline = 0x7f9e6ff90068 should_change_scope = <optimized out> fbc = 0x7f9e8ad8a560 num_args = <optimized out> #22 0x00007f9e8577f0b8 in execute_ex (execute_data=0x7f9e8986a558) at /build/php5.6-I6I9am/php5.6-5.6.33/Zend/zend_vm_execute.h:363 ret = <optimized out> original_in_execution = 1 '\001' #23 0x00007f9e85733a19 in dtrace_execute_ex (execute_data=<optimized out>) at /build/php5.6-I6I9am/php5.6-5.6.33/Zend/zend_dtrace.c:73 lineno = <optimized out> scope = 0x0 filename = <optimized out> funcname = <optimized out> classname = <optimized out> #24 0x00007f9e7544c74e in nr_php_execute_enabled () at /home/hudson/slave-workspace/workspace/php-release-agent/label/centos5-64-nrcamp/agent/php_execute.c:1191 No locals. #25 0x00007f9e7544ce32 in nr_php_execute () at /home/hudson/slave-workspace/workspace/php-release-agent/label/centos5-64-nrcamp/agent/php_execute.c:1301 No locals. #26 0x00007f9e857ea077 in zend_do_fcall_common_helper_SPEC (execute_data=<optimized out>) at /build/php5.6-I6I9am/php5.6-5.6.33/Zend/zend_vm_execute.h:592 ret = 0x7f9e8986a400 opline = 0x7f9e6f9613f8 should_change_scope = <optimized out> fbc = 0x7f9e8ad7e2a8 num_args = <optimized out> #27 0x00007f9e8577f0b8 in execute_ex (execute_data=0x7f9e8986a420) at /build/php5.6-I6I9am/php5.6-5.6.33/Zend/zend_vm_execute.h:363 ret = <optimized out> original_in_execution = 1 '\001' #28 0x00007f9e85733a19 in dtrace_execute_ex (execute_data=<optimized out>) at /build/php5.6-I6I9am/php5.6-5.6.33/Zend/zend_dtrace.c:73 lineno = <optimized out> scope = 0x0 filename = <optimized out> funcname = <optimized out> ---Type <return> to continue, or q <return> to quit--- classname = <optimized out> #29 0x00007f9e7544ca92 in nr_php_execute_file () at /home/hudson/slave-workspace/workspace/php-release-agent/label/centos5-64-nrcamp/agent/php_execute.c:856 No locals. #30 nr_php_execute_enabled () at /home/hudson/slave-workspace/workspace/php-release-agent/label/centos5-64-nrcamp/agent/php_execute.c:1073 No locals. #31 0x00007f9e7544ce32 in nr_php_execute () at /home/hudson/slave-workspace/workspace/php-release-agent/label/centos5-64-nrcamp/agent/php_execute.c:1301 No locals. #32 0x00007f9e857e93cf in ZEND_INCLUDE_OR_EVAL_SPEC_CONST_HANDLER (execute_data=0x7f9e8986a358) at /build/php5.6-I6I9am/php5.6-5.6.33/Zend/zend_vm_execute.h:3026 opline = 0x7f9e6f960460 new_op_array = 0x7f9e898a0e88 inc_filename = 0x7f9e6f960410 tmp_inc_filename = 0x0 failure_retval = 0 '\000' #33 0x00007f9e8577f0b8 in execute_ex (execute_data=0x7f9e8986a358) at /build/php5.6-I6I9am/php5.6-5.6.33/Zend/zend_vm_execute.h:363 ret = <optimized out> original_in_execution = 0 '\000' #34 0x00007f9e85733a19 in dtrace_execute_ex (execute_data=<optimized out>) at /build/php5.6-I6I9am/php5.6-5.6.33/Zend/zend_dtrace.c:73 lineno = <optimized out> scope = 0x0 filename = <optimized out> funcname = <optimized out> classname = <optimized out> #35 0x00007f9e7544ca92 in nr_php_execute_file () at /home/hudson/slave-workspace/workspace/php-release-agent/label/centos5-64-nrcamp/agent/php_execute.c:856 No locals. #36 nr_php_execute_enabled () at /home/hudson/slave-workspace/workspace/php-release-agent/label/centos5-64-nrcamp/agent/php_execute.c:1073 No locals. #37 0x00007f9e7544ce32 in nr_php_execute () at /home/hudson/slave-workspace/workspace/php-release-agent/label/centos5-64-nrcamp/agent/php_execute.c:1301 No locals. #38 0x00007f9e85745e50 in zend_execute_scripts (type=type@entry=8, retval=retval@entry=0x0, file_count=file_count@entry=3) at /build/php5.6-I6I9am/php5.6-5.6.33/Zend/zend.c:1341 files = {{gp_offset = 40, fp_offset = 32670, overflow_arg_area = 0x7ffff66185c0, reg_save_area = 0x7ffff6618550}} i = 1 file_handle = 0x7ffff661a840 orig_op_array = 0x0 orig_retval_ptr_ptr = 0x0 orig_interactive = 0 #39 0x00007f9e856e3832 in php_execute_script (primary_file=primary_file@entry=0x7ffff661a840) at /build/php5.6-I6I9am/php5.6-5.6.33/main/main.c:2613 realfile = "\034\000\000\000\000\000\000\000\005", '\000' <repeats 11 times>, "\236\177\000\000\000\177ኞ\177\000\000u<f\240\062\376\035\000\071\277q\205\236\177\000\000\177\003\000\000\000\000\000\000\240\000\000\000\000\000\000\000\200\226a\366\377\177\000\000\300\226a\366\377\177\000\000\000\227a\366\377\177\000\000\002", '\000' <repeats 15 times>, "\373\377\377\377f\000\000\000\001\000\000\000\000\000\000\000\071\277q\205\236\177\000\000p\217댞\177\000\000\200\236a\366\377\177\000\000\200\236a\366\377\177\000\000p\236a\366\377\177\000\000i\017\206\210\236\177\000\000VlKu\236\177\000\000\240\236a\366\377\177\000\000\220\236a\366\377\177\000\000i\017\206\210\236\177\000\000[lKu"... __orig_bailout = 0x7ffff661a8c0 __bailout = {{__jmpbuf = {140318887902472, -8779197948997737314, 140318887902472, 140318890020800, 0, 140318887989904, -8779197949643660130, -8725473701159967586}, __mask_was_saved = 0, __saved_mask = {__val = {1132913822, 9223372032559808614, 0, 7, 140737326978624, 4294967296, 140737326978632, 140737326979568, 0, 140737326978592, 140318873309515, 0, 140737326980736, 140737326978602, 1, 4579595891102449657}}}} ---Type <return> to continue, or q <return> to quit--- prepend_file_p = <optimized out> append_file_p = 0x0 prepend_file = {type = ZEND_HANDLE_FILENAME, filename = 0x0, opened_path = 0x0, handle = {fd = 0, fp = 0x0, stream = {handle = 0x0, isatty = 0, mmap = {len = 0, pos = 0, map = 0x0, buf = 0x0, old_handle = 0x0, old_closer = 0x0}, reader = 0x0, fsizer = 0x0, closer = 0x0}}, free_filename = 0 '\000'} append_file = {type = ZEND_HANDLE_FILENAME, filename = 0x0, opened_path = 0x0, handle = {fd = 0, fp = 0x0, stream = {handle = 0x0, isatty = 0, mmap = {len = 0, pos = 0, map = 0x0, buf = 0x0, old_handle = 0x0, old_closer = 0x0}, reader = 0x0, fsizer = 0x0, closer = 0x0}}, free_filename = 0 '\000'} old_cwd = 0x7ffff66185d0 "/" retval = 0 #40 0x00007f9e857eb6e2 in php_handler (r=<optimized out>) at /build/php5.6-I6I9am/php5.6-5.6.33/sapi/apache2handler/sapi_apache2.c:667 zfd = {type = ZEND_HANDLE_FILENAME, filename = 0x7f9e89786ba8 "/home/blazemeter/vol/www/a.blazemeter.com/public/api.php", opened_path = 0x0, handle = {fd = -161371780, fp = 0x7ffff661a97c, stream = {handle = 0x7ffff661a97c, isatty = -1988596824, mmap = {len = 140318797637872, pos = 140318887932256, map = 0x7f9e00000000, buf = 0x7f9e898b4148 "", old_handle = 0x7f9e898b85e0, old_closer = 0x7f9e898b85e0}, reader = 0x7f9e89787028, fsizer = 0x7f9e8977fd08, closer = 0x7f9e89795290}}, free_filename = 0 '\000'} __orig_bailout = 0x0 __bailout = {{__jmpbuf = {140318887902472, 8779179482153149598, 140318887902472, 140318890020800, 0, 140318887989904, -8779197948999834466, -8725473842931637090}, __mask_was_saved = 0, __saved_mask = {__val = {140318887902472, 0, 140318887902896, 140318889605128, 140318889276184, 140318887932328, 140318887936160, 140318890020800, 0, 140318887989904, 140318833196195, 140318890020800, 0, 140318887932328, 140318887902472, 140318889171024}}}} ctx = 0x7f9e89787210 conf = <optimized out> brigade = 0x7f9e89787f50 bucket = <optimized out> rv = <optimized out> parent_req = 0x0 #41 0x00007f9e8973f120 in ap_run_handler () No symbol table info available. #42 0x00007f9e8973f669 in ap_invoke_handler () No symbol table info available. #43 0x00007f9e897546fc in ap_internal_redirect () No symbol table info available. #44 0x00007f9e84162cfc in ?? () from /usr/lib/apache2/modules/mod_rewrite.so No symbol table info available. #45 0x00007f9e8973f120 in ap_run_handler () No symbol table info available. #46 0x00007f9e8973f669 in ap_invoke_handler () No symbol table info available. #47 0x00007f9e89754c3a in ap_process_async_request () No symbol table info available. #48 0x00007f9e89754f14 in ap_process_request () No symbol table info available. #49 0x00007f9e897519b2 in ?? () No symbol table info available. #50 0x00007f9e89748790 in ap_run_process_connection () No symbol table info available. #51 0x00007f9e85d42767 in ?? () from /usr/lib/apache2/modules/mod_mpm_prefork.so No symbol table info available. ---Type <return> to continue, or q <return> to quit--- #52 0x00007f9e85d429a6 in ?? () from /usr/lib/apache2/modules/mod_mpm_prefork.so No symbol table info available. #53 0x00007f9e85d4360e in ?? () from /usr/lib/apache2/modules/mod_mpm_prefork.so No symbol table info available. #54 0x00007f9e8972428e in ap_run_mpm () No symbol table info available. #55 0x00007f9e8971d2e6 in main () No symbol table info available. ========================================================= (gdb) bt full #0 php_apache_sapi_header_handler (sapi_header=<optimized out>, op=SAPI_HEADER_ADD, sapi_headers=<optimized out>) at /build/php5.6-I6I9am/php5.6-5.6.33/sapi/apache2handler/sapi_apache2.c:124 ctx = 0x0 val = 0x7f9e8cc2b986 "text/html; charset=UTF-8" ptr = 0x7f9e8cc2b984 "" #1 0x00007f9e856ea1e3 in sapi_header_add_op (op=SAPI_HEADER_ADD, sapi_header=0x7ffff661a500) at /build/php5.6-I6I9am/php5.6-5.6.33/main/SAPI.c:658 No locals. #2 0x00007f9e856eb69f in sapi_send_headers () at /build/php5.6-I6I9am/php5.6-5.6.33/main/SAPI.c:879 default_header = {header = 0x7f9e8cc2b978 "Content-type", header_len = 38} len = 24 retval = <optimized out> ret = -1 #3 0x00007f9e85698359 in php_header () at /build/php5.6-I6I9am/php5.6-5.6.33/ext/standard/head.c:68 No locals. #4 0x00007f9e856f37e4 in php_output_header () at /build/php5.6-I6I9am/php5.6-5.6.33/main/output.c:122 No locals. #5 0x00007f9e856f4575 in php_output_deactivate () at /build/php5.6-I6I9am/php5.6-5.6.33/main/output.c:176 handler = 0x0 #6 0x00007f9e856e25a5 in php_request_shutdown (dummy=dummy@entry=0x0) at /build/php5.6-I6I9am/php5.6-5.6.33/main/main.c:1873 __orig_bailout = 0x0 __bailout = {{__jmpbuf = {140318824672448, 8779161889967367326, 140318888473168, 140318890020800, 0, 140318888575632, -8779197948668484450, -8725473701841673058}, __mask_was_saved = 0, __saved_mask = {__val = {140318888499856, 9, 1297040479, 140318888499856, 140318888476256, 13, 140318877984231, 57, 140318888476576, 140318821580631, 140318877995302, 55834574849, 140318888473168, 140318824671136, 140318888473168, 2}}}} report_memleaks = 1 '\001' #7 0x00007f9e857eb5ff in php_apache_request_dtor (r=<optimized out>) at /build/php5.6-I6I9am/php5.6-5.6.33/sapi/apache2handler/sapi_apache2.c:507 No locals. #8 php_handler (r=<optimized out>) at /build/php5.6-I6I9am/php5.6-5.6.33/sapi/apache2handler/sapi_apache2.c:679 ctx = 0x7f9e8980c760 conf = <optimized out> brigade = 0x7f9e89811768 bucket = <optimized out> rv = <optimized out> parent_req = 0x0 #9 0x00007f9e8973f120 in ap_run_handler () No symbol table info available. #10 0x00007f9e8973f669 in ap_invoke_handler () No symbol table info available. #11 0x00007f9e897546fc in ap_internal_redirect () No symbol table info available. #12 0x00007f9e84162cfc in ?? () from /usr/lib/apache2/modules/mod_rewrite.so No symbol table info available. #13 0x00007f9e8973f120 in ap_run_handler () No symbol table info available. #14 0x00007f9e8973f669 in ap_invoke_handler () No symbol table info available. ---Type <return> to continue, or q <return> to quit--- #15 0x00007f9e89754c3a in ap_process_async_request () No symbol table info available. #16 0x00007f9e89754f14 in ap_process_request () No symbol table info available. #17 0x00007f9e897519b2 in ?? () No symbol table info available. #18 0x00007f9e89748790 in ap_run_process_connection () No symbol table info available. #19 0x00007f9e85d42767 in ?? () from /usr/lib/apache2/modules/mod_mpm_prefork.so No symbol table info available. #20 0x00007f9e85d429a6 in ?? () from /usr/lib/apache2/modules/mod_mpm_prefork.so No symbol table info available. #21 0x00007f9e85d4360e in ?? () from /usr/lib/apache2/modules/mod_mpm_prefork.so No symbol table info available. #22 0x00007f9e8972428e in ap_run_mpm () No symbol table info available. #23 0x00007f9e8971d2e6 in main () No symbol table info available. ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=75989&edit=1