Bug #76338 [NEW]: Probable race condition/overflow in PHP crashes Apache

From: webmaster_20180513 at cubiclesoft dot com Operating system: Windows PHP version: 7.1.17 Package: Reproducible crash Bug Type: Bug Bug description:Probable race condition/overflow in PHP crashes Apache Description: ------------ I've spent hours tracking down and replicating this bug as best as possible with a simple example. I can replicate the crash much more reliably with significantly more complex userland code, fewer concurrent connections, and without the .htaccess file. That is, approximately 1 in 5,000 requests at a concurrency level of 10 instead of 1 in 150,000 requests at a concurrency level of 70. As a result, replicating the crash on a regular basis has proven to be quite difficult but a crash bug does exist somewhere. Given the rarity of the bug and the requirement for concurrency to be high, I strongly suspect a race condition or a buffer overflow is causing PHP to crash (and, of course, take Apache with it). When there is more code that PHP has to process, the likelihood of a crash increases. PHP doesn't even have to execute any userland code beyond basic loading of PHP files. I ran into this bug while attempting to perform some simple application benchmarks on a Windows 10 Pro 64-bit PC. It's a Core i7, 32GB RAM, SSD storage. Apache and PHP are both 32-bit. I don't know why, but both the .htaccess file and the commented lines in the $config array improve the chance of encountering the crash bug. Currently enabled PHP modules: extension=php_curl.dll extension=php_gd2.dll extension=php_imagick.dll extension=php_ldap.dll extension=php_mysqli.dll extension=php_openssl.dll extension=php_pdo_mysql.dll extension=php_pdo_pgsql.dll extension=php_pdo_sqlite.dll Test script: --------------- test_config.php: <?php $config = array( "rootpath" => __DIR__, // "something" => "asdfasdfsadf", // "something" => "asdfasdfsadf", // "something" => "asdfasdfsadf", // "something" => "asdfasdfsadf", // "something" => "asdfasdfsadf", // "something" => "asdfasdfsadf", // "something" => "asdfasdfsadf", // "something" => "asdfasdfsadf", // "something" => "asdfasdfsadf", // "something" => "asdfasdfsadf", // "something" => "asdfasdfsadf", // "something" => "asdfasdfsadf", // "something" => "asdfasdfsadf", // "something" => "asdfasdfsadf", // "something" => "asdfasdfsadf", // "something" => "asdfasdfsadf", // "something" => "asdfasdfsadf", // "something" => "asdfasdfsadf", // "something" => "asdfasdfsadf", // "something" => "asdfasdfsadf", // "something" => "asdfasdfsadf", // "something" => "asdfasdfsadf", // "something" => "asdfasdfsadf", // "something" => "asdfasdfsadf", // "something" => "asdfasdfsadf", // "something" => "asdfasdfsadf", // "something" => "asdfasdfsadf", // "something" => "asdfasdfsadf", // "something" => "asdfasdfsadf", // "something" => "asdfasdfsadf", // "something" => "asdfasdfsadf", // "something" => "asdfasdfsadf", // "something" => "asdfasdfsadf", // "something" => "asdfasdfsadf", // "something" => "asdfasdfsadf", // "something" => "asdfasdfsadf", // "something" => "asdfasdfsadf", // "something" => "asdfasdfsadf", // "something" => "asdfasdfsadf", // "something" => "asdfasdfsadf", ); ?> test_class.php: <?php class MyTestClass { public static function MyTestFunction() { echo "Hi!\n"; } public static function MyTestFunction2() { echo "Hi!\n"; } public static function MyTestFunction3() { echo "Hi!\n"; } } ?> test_main.php: <?php require_once "test_config.php"; require_once $config["rootpath"] . "/test_class.php"; MyTestClass::MyTestFunction(); ?> .htaccess: RewriteEngine On RewriteCond %{REQUEST_FILENAME} !-f RewriteCond %{REQUEST_FILENAME} !-d RewriteRule . index.php [L] Expected result: ---------------- PHP should not crash. Actual result: -------------- ab.exe -t 30 -c 70 -n 1000000 http://localhost/bugtest/test_main.php This is ApacheBench, Version 2.3 <$Revision: 1826891 $> Copyright 1996 Adam Twiss, Zeus Technology Ltd, http://www.zeustech.net/ Licensed to The Apache Software Foundation, http://www.apache.org/ Benchmarking localhost (be patient) Completed 100000 requests apr_socket_recv: An existing connection was forcibly closed by the remote host. (730054) Total of 113255 requests completed The Apache logs show: [Sun May 13 20:02:03.882411 2018] [mpm_winnt:notice] [pid 12996:tid 656] AH00428: Parent: child process 20688 exited with status 3221226356 -- Restarting. [Sun May 13 20:02:03.910856 2018] [mpm_winnt:notice] [pid 12996:tid 656] AH00455: Apache/2.4.33 (Win32) PHP/7.1.17 configured -- resuming normal operations [Sun May 13 20:02:03.910856 2018] [mpm_winnt:notice] [pid 12996:tid 656] AH00456: Apache Lounge VC14 Server built: Mar 22 2018 10:55:30 [Sun May 13 20:02:03.910856 2018] [core:notice] [pid 12996:tid 656] AH00094: Command line: 'apache/bin/httpd.exe -d C:/webserver/apache' [Sun May 13 20:02:03.913362 2018] [mpm_winnt:notice] [pid 12996:tid 656] AH00418: Parent: Created child process 4304 [Sun May 13 20:02:04.315200 2018] [mpm_winnt:notice] [pid 4304:tid 688] AH00354: Child: Starting 64 worker threads. -- Edit bug report at https://bugs.php.net/bug.php?id=76338&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=76338&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=76338&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=76338&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=76338&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=76338&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=76338&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=76338&r=needscript Try newer version: https://bugs.php.net/fix.php?id=76338&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=76338&r=support Expected behavior: https://bugs.php.net/fix.php?id=76338&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=76338&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=76338&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=76338&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=76338&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=76338&r=dst IIS Stability: https://bugs.php.net/fix.php?id=76338&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=76338&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=76338&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=76338&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=76338&r=mysqlcfg