Bug #75729 [Com]: opcache segfault when installing Bitrix

Edit report at https://bugs.php.net/bug.php?id=75729&edit=1 ID: 75729 Comment by: info at ihead dot ru Reported by: chipitsine at gmail dot com Summary: opcache segfault when installing Bitrix Status: Closed Type: Bug Package: opcache Operating System: centos 7 PHP Version: 7.2.1RC1 Block user comment: N Private report: N New Comment: In patch http://git.php.net/?p=php-src.git;a=commit;h=d9e71169e6c0d8cd33e44f5e6a1d1ec3926f3362 changed code in condition num_args == 2 substr can recieve 3 args, so it is necessary to change the corresponging code in num_args == 3 --- sccp.c.orig 2018-02-27 19:33:06.000000000 +0300 +++ sccp.c 2018-03-24 12:01:08.808825000 +0300 @@ -820,7 +820,8 @@ } else if (zend_string_equals_literal(name, "substr")) { if (Z_TYPE_P(args[0]) != IS_STRING || Z_TYPE_P(args[1]) != IS_LONG - || Z_TYPE_P(args[2]) != IS_LONG) { + || Z_TYPE_P(args[2]) != IS_LONG + || (CG(compiler_options) & ZEND_COMPILE_NO_BUILTIN_STRLEN)) { return FAILURE; } /* pass */ Previous Comments: ------------------------------------------------------------------------ [2018-03-24 08:43:11] info at ihead dot ru I found the code which cause segfault: echo substr(PHP_OS, 0, 3); ------------------------------------------------------------------------ [2018-03-23 19:41:18] info at ihead dot ru PHP 7.2.3, FreeBSD 11.1 Problem exists in PHP 7.2.3. I got segmentation fault when installing 1C-Bitrix (http://www.1c-bitrix.ru/download/scripts/bitrixsetup.php) with mbstring.func_overload=2 after submitting form with database connection parameters. ------------------------------------------------------------------------ [2018-02-05 20:11:18] nikic@php.net Automatic comment on behalf of nikita.ppv@gmail.com Revision: http://git.php.net/?p=php-src.git;a=commit;h=d9e71169e6c0d8cd33e44f5e6a1d1ec3926f3362 Log: Fixed bug #75729 ------------------------------------------------------------------------ [2017-12-26 17:50:48] chipitsine at gmail dot com Note: bitrix requires the following settings mbstring.func_overload=2 mbstring.internal_encoding=UTF-8 it turns out that them crash opcache. without those setting opcache works ------------------------------------------------------------------------ [2017-12-25 19:00:58] chipitsine at gmail dot com Description: ------------ during installing of https://www.1c-bitrix.ru/download/start_encode_php5.tar.gz I got a segfault however, if I disable opcache, everything is ok Actual result: -------------- [root@php72 corefiles]# gdb --core core.httpd.1514227684.1132 which httpdGNU gdb (GDB) Red Hat Enterprise Linux 7.6.1-100.el7 Copyright (C) 2013 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-redhat-linux-gnu". For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>... Reading symbols from /usr/sbin/httpd...Reading symbols from /usr/lib/debug/usr/sbin/httpd.debug...done. done. [New LWP 1132] [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib64/libthread_db.so.1". Core was generated by `/usr/sbin/httpd -DFOREGROUND'. Program terminated with signal 11, Segmentation fault. #0 __strlen_sse42 () at ../sysdeps/x86_64/multiarch/strlen-sse4.S:31 31 pcmpeqb (%rdi), %xmm1 (gdb) bt #0 __strlen_sse42 () at ../sysdeps/x86_64/multiarch/strlen-sse4.S:31 #1 0x00007f5beeec597a in xbuf_format_converter (xbuf=0x7ffc3d252d10, is_char=1 '\001', fmt=<optimized out>, ap=0x7ffc3d252e40) at /usr/src/debug/php-7.2.1RC1/main/spprintf.c:604 #2 0x00007f5beef2678a in zend_vspprintf (pbuf=pbuf@entry=0x7ffc3d252d78, max_len=1024, format=<optimized out>, ap=<optimized out>) at /usr/src/debug/php-7.2.1RC1/Zend/zend.c:170 #3 0x00007f5beed343ae in php_error_cb (type=16, error_filename=0x7f5beefddd32 "Unknown", error_lineno=0, format=<optimized out>, args=<optimized out>) at /usr/src/debug/php-7.2.1RC1/main/main.c:1037 #4 0x00007f5beed36464 in zend_error (type=type@entry=16, format=format@entry=0x7f5bef0470bf "%s%s%s(): %s") at /usr/src/debug/php-7.2.1RC1/Zend/zend.c:1230 #5 0x00007f5beed36d63 in zend_parse_parameters_debug_error (msg=msg@entry=0x7f5bef046f30 "could not obtain parameters for parsing") at /usr/src/debug/php-7.2.1RC1/Zend/zend_API.c:828 #6 0x00007f5beef307d6 in zend_parse_va_args (num_args=<optimized out>, type_spec=<optimized out>, va=va@entry=0x7ffc3d253030, flags=flags@entry=0) at /usr/src/debug/php-7.2.1RC1/Zend/zend_API.c:923 #7 0x00007f5beef30936 in zend_parse_parameters (num_args=<optimized out>, type_spec=type_spec@entry=0x7f5be8489450 "sl|l!s") at /usr/src/debug/php-7.2.1RC1/Zend/zend_API.c:990 #8 0x00007f5be83a8968 in zif_mb_substr (execute_data=<optimized out>, return_value=0x7ffc3d253200) at /usr/src/debug/php-7.2.1RC1/ext/mbstring/mbstring.c:2905 #9 0x00007f5bedbd9354 in ct_eval_func_call (args=0x7ffc3d253210, num_args=3, name=<optimized out>, result=0x7ffc3d253200) at /usr/src/debug/php-7.2.1RC1/ext/opcache/Optimizer/sccp.c:844 #10 sccp_visit_instr (scdf=0x7ffc3d253360, opline=<optimized out>, ssa_op=0x7f5bde783bd0) at /usr/src/debug/php-7.2.1RC1/ext/opcache/Optimizer/sccp.c:1279 #11 0x00007f5bedbdb47c in scdf_solve (scdf=scdf@entry=0x7ffc3d253360, name=name@entry=0x7f5bedbea4b0 "SCCP") at /usr/src/debug/php-7.2.1RC1/ext/opcache/Optimizer/scdf.c:167 #12 0x00007f5bedbda0a5 in sccp_optimize_op_array (ctx=ctx@entry=0x7ffc3d253550, op_array=op_array@entry=0x7f5bde6490d0, ssa=ssa@entry=0x7f5bde69d048, call_map=call_map@entry=0x7f5bde6b0d00) at /usr/src/debug/php-7.2.1RC1/ext/opcache/Optimizer/sccp.c:1669 #13 0x00007f5bedbbf723 in zend_dfa_optimize_op_array (op_array=0x7f5bde6490d0, ctx=ctx@entry=0x7ffc3d253550, ssa=0x7f5bde69d048, call_map=0x7f5bde6b0d00) at /usr/src/debug/php-7.2.1RC1/ext/opcache/Optimizer/dfa_pass.c:566 #14 0x00007f5bedbb1922 in zend_optimize_script (script=script@entry=0x7f5bde697000, optimization_level=2147467263, debug_level=0) at /usr/src/debug/php-7.2.1RC1/ext/opcache/Optimizer/zend_optimizer.c:1263 ---Type <return> to continue, or q <return> to quit--- #15 0x00007f5bedba061a in cache_script_in_shared_memory (from_shared_memory=<synthetic pointer>, key_length=<optimized out>, key=<optimized out>, new_persistent_script=0x7f5bde697000) at /usr/src/debug/php-7.2.1RC1/ext/opcache/ZendAccelerator.c:1321 #16 persistent_compile_file (file_handle=<optimized out>, type=8) at /usr/src/debug/php-7.2.1RC1/ext/opcache/ZendAccelerator.c:1922 #17 0x00007f5beeeeb5fb in compile_filename (type=type@entry=8, filename=filename@entry=0x7f5bede22420) at Zend/zend_language_scanner.l:662 #18 0x00007f5beef8c84a in zend_include_or_eval (inc_filename=inc_filename@entry=0x7f5bede22420, type=8) at /usr/src/debug/php-7.2.1RC1/Zend/zend_execute.c:2826 #19 0x00007f5beefcd1e3 in ZEND_INCLUDE_OR_EVAL_SPEC_TMPVAR_HANDLER () at /usr/src/debug/php-7.2.1RC1/Zend/zend_vm_execute.h:48631 #20 0x00007f5beefd219a in execute_ex (ex=0x10) at /usr/src/debug/php-7.2.1RC1/Zend/zend_vm_execute.h:63139 #21 0x00007f5beefd9aae in zend_execute (op_array=op_array@entry=0x7f5bede850e0, return_value=return_value@entry=0x7f5be01ccd08) at /usr/src/debug/php-7.2.1RC1/Zend/zend_vm_execute.h:63763 #22 0x00007f5beef279b3 in zend_execute_scripts (type=-303946800, type@entry=8, retval=0x7f5be01ccd08, retval@entry=0x0, file_count=file_count@entry=3) at /usr/src/debug/php-7.2.1RC1/Zend/zend.c:1496 #23 0x00007f5beeec28a8 in php_execute_script (primary_file=primary_file@entry=0x7ffc3d255d70) at /usr/src/debug/php-7.2.1RC1/main/main.c:2590 #24 0x00007f5beefdbc0a in php_handler (r=<optimized out>) at /usr/src/debug/php-7.2.1RC1/sapi/apache2handler/sapi_apache2.c:701 #25 0x000055e3fb158a10 in ap_run_handler (r=0x55e3fc2a5380) at config.c:168 #26 0x000055e3fb158de9 in ap_invoke_handler (r=r@entry=0x55e3fc2a5380) at config.c:432 #27 0x000055e3fb16d12a in ap_process_async_request (r=r@entry=0x55e3fc2a5380) at http_request.c:317 #28 0x000055e3fb16d404 in ap_process_request (r=r@entry=0x55e3fc2a5380) at http_request.c:363 #29 0x000055e3fb169db2 in ap_process_http_sync_connection (c=0x55e3fc29ee60) at http_core.c:190 #30 ap_process_http_connection (c=0x55e3fc29ee60) at http_core.c:231 #31 0x000055e3fb161e30 in ap_run_process_connection (c=0x55e3fc29ee60) at connection.c:41 #32 0x000055e3fb162218 in ap_process_connection (c=c@entry=0x55e3fc29ee60, csd=<optimized out>) at connection.c:202 #33 0x00007f5bf27e07ef in child_main (child_num_arg=child_num_arg@entry=2) at prefork.c:704 #34 0x00007f5bf27e0a26 in make_child (s=0x55e3fc036348, slot=slot@entry=2) at prefork.c:800 #35 0x00007f5bf27e0a86 in startup_children (number_to_start=3) at prefork.c:818 #36 0x00007f5bf27e1790 in prefork_run (_pconf=<optimized out>, plog=0x55e3fc038358, s=0x55e3fc036348) at prefork.c:976 #37 0x000055e3fb13f0fe in ap_run_mpm (pconf=0x55e3fc00b138, plog=0x55e3fc038358, s=0x55e3fc036348) at mpm_common.c:96 #38 0x000055e3fb138726 in main (argc=2, argv=0x7ffc3d256568) at main.c:777 (gdb) ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=75729&edit=1