From: rainer dot jung at kippdata dot de
Operating system: Solaris Sparc 32 Bit
PHP version: 7.3.0alpha3
Package: Reproducible crash
Bug Type: Bug
Bug description:Bus Error due to unaligned access in zend_ini.c OnUpdateLong
Description:
------------
I get a bus error for most of the PHP tests. An easy example is
test004.sh.
The Solaris Sparc platform is sensitive to correct alignment for 32 bit
and 64 bit types. They must be aligned on corresponding address
boundaries, which is not true in the case of these crashes.
The crash happens for 32 Bit builds in Zend/zend_ini.c:671
(OnUpdateLong):
669 p = (zend_long *) (base+(size_t) mh_arg1);
670
671 *p = zend_atol(ZSTR_VAL(new_value), ZSTR_LEN(new_value));
Here the address p is:
p = 0xfb1f63d5 <mbstring_globals+97>
base = 0xfb1f6374 <mbstring_globals> ""
which is an odd address. Since on this platform zend_long has size 4
(bytes) this would need to be divisible by 4. The value for mh_arg1
comes from the next frame Zend/zend_ini.c:269
(zend_register_ini_entries):
268 if (p->on_modify) {
269 p->on_modify(p, p->value, p->mh_arg1, p->mh_arg2,
p->mh_arg3, ZEND_INI_STAGE_STARTUP);
270 }
There p is:
{name = 0x186760, on_modify = 0xfee87aa8 <OnUpdateLong>, mh_arg1 = 0x61,
mh_arg2 = 0xfb276374 <mbstring_globals>, mh_arg3 = 0x0, value = 0x3de70,
orig_value = 0x0,
displayer = 0x384b8 <zend_ini_boolean_displayer_cb@plt>, module_number
= 30, modifiable = 7 '\a', orig_modifiable = 0 '\000', modified = 0
'\000'}
and mh_arg1 is set in
241 p->mh_arg1 = ini_entry->mh_arg1;
This is ini_entry:
{name = 0xfb246a80 "mbstring.strict_detection", on_modify = 0xfee87aa8
<OnUpdateLong>, mh_arg1 = 0x61, mh_arg2 = 0xfb276374 <mbstring_globals>,
mh_arg3 = 0x0,
value = 0xfb246a38 "0", displayer = 0x384b8
<zend_ini_boolean_displayer_cb@plt>, value_length = 1, name_length = 25,
modifiable = 7 '\a'}
The next frame is ext/mbstring/mbstring.c:1579 (zm_startup_mbstring):
1579 REGISTER_INI_ENTRIES();
The crash does not happen or Linux on x86_64 platforms with 64 bit
builds. These platforms are less sensitive for misalignment.
Regards,
Rainer
--
Edit bug report at https://bugs.php.net/bug.php?id=76594&edit=1
--
Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=76594&r=trysnapshot54
Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=76594&r=trysnapshot55
Try a snapshot (trunk): https://bugs.php.net/fix.php?id=76594&r=trysnapshottrunk
Fixed in SVN: https://bugs.php.net/fix.php?id=76594&r=fixed
Fixed in release: https://bugs.php.net/fix.php?id=76594&r=alreadyfixed
Need backtrace: https://bugs.php.net/fix.php?id=76594&r=needtrace
Need Reproduce Script: https://bugs.php.net/fix.php?id=76594&r=needscript
Try newer version: https://bugs.php.net/fix.php?id=76594&r=oldversion
Not developer issue: https://bugs.php.net/fix.php?id=76594&r=support
Expected behavior: https://bugs.php.net/fix.php?id=76594&r=notwrong
Not enough info: https://bugs.php.net/fix.php?id=76594&r=notenoughinfo
Submitted twice: https://bugs.php.net/fix.php?id=76594&r=submittedtwice
register_globals: https://bugs.php.net/fix.php?id=76594&r=globals
PHP 4 support discontinued: https://bugs.php.net/fix.php?id=76594&r=php4
Daylight Savings: https://bugs.php.net/fix.php?id=76594&r=dst
IIS Stability: https://bugs.php.net/fix.php?id=76594&r=isapi
Install GNU Sed: https://bugs.php.net/fix.php?id=76594&r=gnused
Floating point limitations: https://bugs.php.net/fix.php?id=76594&r=float
No Zend Extensions: https://bugs.php.net/fix.php?id=76594&r=nozend
MySQL Configuration Error: https://bugs.php.net/fix.php?id=76594&r=mysqlcfg