Bug #76169 [NEW]: php-cgi.exe crash with AV

From: bz0108 at hotmail dot com Operating system: Windows Server 2016 PHP version: 5.6.35 Package: Win32API related Bug Type: Bug Bug description:php-cgi.exe crash with AV Description: ------------ php-cgi.exe crash with AV Php-cgi.exe crash dump debugging log as below: This dump file has an exception of interest stored in it. The stored exception information can be accessed via .ecxr. (22f4.275c): Access violation - code c0000005 (first/second chance not available) eax=00000000 ebx=00000001 ecx=73ab7470 edx=00c6db30 esi=73ab7471 edi=04445d30 eip=77598ffa esp=00c6db18 ebp=00c6db1c iopl=0 nv up ei pl nz na po nc cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010202 ntdll!RtlInitAnsiStringEx+0x1a: 77598ffa 8a01 mov al,byte ptr [ecx] ds:002b:73ab7470=?? 0:000> dd ecx 73ab7470 ???????? ???????? ???????? ???????? 73ab7480 ???????? ???????? ???????? ???????? 73ab7490 ???????? ???????? ???????? ???????? 73ab74a0 ???????? ???????? ???????? ???????? 73ab74b0 ???????? ???????? ???????? ???????? 73ab74c0 ???????? ???????? ???????? ???????? 73ab74d0 ???????? ???????? ???????? ???????? 73ab74e0 ???????? ???????? ???????? ???????? 0:000> kL # ChildEBP RetAddr 00 00c6db1c 74419f9f ntdll!RtlInitAnsiStringEx+0x1a 01 00c6db3c 74429122 KERNELBASE!Basep8BitStringToDynamicUnicodeString+0x20 02 00c6db4c 6d899a61 KERNELBASE!GetFileAttributesExA+0x12 03 00c6db90 6d898f36 php_wincache!get_module+0x3b41 04 00c6db98 6d898f54 php_wincache!get_module+0x3016 05 00c6dc04 6d8911e5 php_wincache!get_module+0x3034 06 00000000 00000000 php_wincache+0x11e5 0:000> dv DestinationString = 0x00c6db30 "--- memory read error at address 0x73ab7470 ---" SourceString = 0x73ab7470 "--- memory read error at address 0x73ab7470 ---" Length = 0x73ab7470 0:000> .frame 2 02 00c6db4c 6d899a61 KERNELBASE!GetFileAttributesExA+0x12 [d:\rs1\minkernel\kernelbase\filemisc.c @ 374] 0:000> dv lpFileName = 0x73ab7470 "--- memory read error at address 0x73ab7470 ---" fInfoLevelId = GetFileExInfoStandard (0n0) lpFileInformation = 0x00c6db74 Result = <value unavailable> FileName = struct _UNICODE_STRING "--- memory read error at address 0x000000ac ---" 0:000> da 0x73ab7470 73ab7470 "????????????????????????????????" 73ab7490 "????????????????????????????????" 73ab74b0 "????????????????????????????????" 73ab74d0 "????????????????????????????????" 73ab74f0 "????????????????????????????????" 73ab7510 "????????????????????????????????" And the binary info: 0:000> lmvm php_wincache Browse full module list start end module name 6d890000 6d8b7000 php_wincache (export symbols) php_wincache.dll Loaded symbol image file: php_wincache.dll Image path: D:\Program Files (x86)\PHP\v5.6\ext\php_wincache.dll Image name: php_wincache.dll Browse all global symbols functions data Timestamp: Thu Nov 10 00:12:36 2016 (58234AF4) CheckSum: 0002AAB7 ImageSize: 00027000 File version: 1.3.7.12 Product version: 1.3.0.0 File flags: 0 (Mask 3F) File OS: 4 Unknown Win32 File type: 2.0 Dll File date: 00000000.00000000 Translations: 0409.04b0 CompanyName: Microsoft Corp. ProductName: Windows Cache Extension 1.3 for PHP 5.6 OriginalFilename: php_wincache.dll ProductVersion: 1.3 FileVersion: 1.3.7.12 FileDescription: Windows Cache Extension for PHP LegalCopyright: Copyright © 2016 Microsoft Corp. All Rights Reserved. Comments: It shows php_wincache passes an invalid address to API GetFileAttributes() as the filename pointer. Which caused php-cgi.exe crash eventually. context: Response Time (ms) Location Deferred srv*E:\symbolcache*http://symweb Symbol search path is: srv*E:\symbolcache*http://symweb Executable search path is: Windows 10 Version 14393 MP (4 procs) Free x86 compatible Product: Server, suite: TerminalServer DataCenter SingleUserTS 10.0.14393.1715 (rs1_release_inmarket.170906-1810) Machine Name: Debug session time: Fri Mar 23 02:57:02.000 2018 (UTC + 8:00) System Uptime: 1 days 18:08:01.222 Process Uptime: 0 days 5:15:23.000 Test script: --------------- n/a -- Edit bug report at https://bugs.php.net/bug.php?id=76169&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=76169&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=76169&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=76169&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=76169&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=76169&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=76169&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=76169&r=needscript Try newer version: https://bugs.php.net/fix.php?id=76169&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=76169&r=support Expected behavior: https://bugs.php.net/fix.php?id=76169&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=76169&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=76169&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=76169&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=76169&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=76169&r=dst IIS Stability: https://bugs.php.net/fix.php?id=76169&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=76169&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=76169&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=76169&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=76169&r=mysqlcfg