Bug #76675 [Opn->Csd]: Segfault with H2 server push

Edit report at https://bugs.php.net/bug.php?id=76675&edit=1 ID: 76675 Updated by: nikic@php.net Reported by: tobias dot nyholm at gmail dot com Summary: Segfault with H2 server push -Status: Open +Status: Closed Type: Bug Package: cURL related Operating System: OSX PHP Version: 7.2.8 Block user comment: N Private report: N New Comment: Automatic comment on behalf of pmmaga Revision: http://git.php.net/?p=php-src.git;a=commit;h=32ae7160377e9548dcf27ff3e0e75c3c9cd3c36c Log: Fixed bug #76675 Previous Comments: ------------------------------------------------------------------------ [2018-07-29 11:42:21] rasmus@php.net In that backtrace, ch looks like a valid curl handle, but ch->res is null at that point. (gdb) p ch $1 = (php_curl *) 0x7fffec265c80 (gdb) p *ch $2 = {cp = 0x5555569af080, handlers = 0x7fffec25f348, res = 0x0, to_free = 0x7fffec28f000, header = {str = 0x0}, err = {str = '\000' <repeats 256 times>, no = 0}, in_callback = 0 '\000', clone = 0x7fffec28a010} ------------------------------------------------------------------------ [2018-07-29 11:36:57] rasmus@php.net I am able to reproduce the segfault. Interestingly it doesn't crash under Valgrind, nor is it giving me any clues about the crash, which is odd. The gdb backtrace is useful though (against 7.3): Thread 1 "php" received signal SIGSEGV, Segmentation fault. curl_write_header (data=0x555557c48c60 "HTTP/2 200 \r\n", size=1, nmemb=13, ctx=0x7fffec266040) at /home/rasmus/php-src/ext/curl/interface.c:1654 1654 GC_ADDREF(ch->res); (gdb) bt #0 curl_write_header (data=0x555557c48c60 "HTTP/2 200 \r\n", size=1, nmemb=13, ctx=0x7fffec266040) at /home/rasmus/php-src/ext/curl/interface.c:1654 #1 0x00007ffff36f22bd in ?? () from /usr/lib/x86_64-linux-gnu/libcurl-gnutls.so.4 #2 0x00007ffff36f0754 in ?? () from /usr/lib/x86_64-linux-gnu/libcurl-gnutls.so.4 #3 0x00007ffff3709a78 in ?? () from /usr/lib/x86_64-linux-gnu/libcurl-gnutls.so.4 #4 0x00007ffff3714726 in ?? () from /usr/lib/x86_64-linux-gnu/libcurl-gnutls.so.4 #5 0x00007ffff3715361 in curl_multi_perform () from /usr/lib/x86_64-linux-gnu/libcurl-gnutls.so.4 #6 0x0000555555838f4e in zif_curl_multi_exec (execute_data=<optimized out>, return_value=0x7fffec21d190) at /home/rasmus/php-src/ext/curl/multi.c:278 #7 0x0000555555ba64e8 in ZEND_DO_ICALL_SPEC_RETVAL_USED_HANDLER () at /home/rasmus/php-src/Zend/zend_vm_execute.h:690 #8 execute_ex (ex=0x28) at /home/rasmus/php-src/Zend/zend_vm_execute.h:54894 #9 0x0000555555baef55 in zend_execute (op_array=op_array@entry=0x7fffec27d2a0, return_value=return_value@entry=0x7fffdc0d58d8) at /home/rasmus/php-src/Zend/zend_vm_execute.h:60326 #10 0x0000555555b23f65 in zend_execute_scripts (type=-333328176, type@entry=8, retval=0x7fffdc0d58d8, retval@entry=0x0, file_count=file_count@entry=3) at /home/rasmus/php-src/Zend/zend.c:1564 #11 0x0000555555ac6b50 in php_execute_script (primary_file=0x7fffffffcf10) at /home/rasmus/php-src/main/main.c:2608 #12 0x0000555555bb12dd in do_cli (argc=2, argv=0x555556706330) at /home/rasmus/php-src/sapi/cli/php_cli.c:1002 #13 0x00005555556cba76 in main (argc=2, argv=0x555556706330) at /home/rasmus/php-src/sapi/cli/php_cli.c:1395 ------------------------------------------------------------------------ [2018-07-28 00:12:09] tobias dot nyholm at gmail dot com Description: ------------ When experimenting with HTTP2 server push I found some issues. 1) It does not work when using CURLOPT_TIMEOUT 2) Segmentation fault when using CURLOPT_WRITEFUNCTION and CURLOPT_HEADERFUNCTION 3) Segmentation fault when using CURLOPT_WRITEFUNCTION and CURLOPT_HEADERFUNCTION in CURLMOPT_PUSHFUNCTION. I started with a working example provided by Davey: https://github.com/dshafik/php-http2-push-example Please note my 3 FIXME comments in the test script. Im on PHP 7.2.8 with cUrl 7.61.0. Test script: --------------- <?php $urls = []; function parseUrl($headers, $handle) { global $urls; foreach ($headers as $header) { if (strpos($header, ':path:') === 0) { $path = substr($header, 6); $url = curl_getinfo($handle)['url']; $url = str_replace( parse_url($url, PHP_URL_PATH), $path, $url ); $urls[$url] = $handle; } } } function getUrl($handle) { $found = false; global $urls; foreach ($urls as $url => $h) { if ($handle == $h) { $found = $url; } } if (!$found) { $found = curl_getinfo($handle)['url']; } return $found; } function get_request($url) { $cb = function ($parent, $pushed, $headers) { curl_setopt($pushed, CURLOPT_RETURNTRANSFER, true); curl_setopt($pushed, CURLOPT_HEADER, true); //FIXME These two lines will cause segmentation fault //curl_setopt($pushed, CURLOPT_HEADERFUNCTION, null); //curl_setopt($pushed, CURLOPT_WRITEFUNCTION, null); parseUrl($headers, $pushed); return CURL_PUSH_OK; }; $mh = curl_multi_init(); curl_multi_setopt($mh, CURLMOPT_PIPELINING, CURLPIPE_MULTIPLEX); curl_multi_setopt($mh, CURLMOPT_PUSHFUNCTION, $cb); $curl = curl_init(); curl_reset($curl); curl_setopt($curl, CURLOPT_URL, $url); curl_setopt($curl, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_2); curl_setopt($curl, CURLOPT_FOLLOWLOCATION, false); curl_setopt($curl, CURLOPT_MAXREDIRS, 0); curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, 1); curl_setopt($curl, CURLOPT_SSL_VERIFYHOST, 2); curl_setopt($curl, CURLOPT_HTTPGET, true); curl_setopt($curl, CURLOPT_CUSTOMREQUEST, true); curl_setopt($curl, CURLOPT_PROTOCOLS, CURLPROTO_HTTP | CURLPROTO_HTTPS); curl_setopt($curl, CURLOPT_REDIR_PROTOCOLS, CURLPROTO_HTTP | CURLPROTO_HTTPS); curl_setopt($curl, CURLOPT_HEADER, false); curl_setopt($curl, CURLOPT_FAILONERROR, false); $originalResponseContent = ''; //FIXME Using timeout will weirdly disable pushed responses (content will be empty) //curl_setopt($curl, CURLOPT_TIMEOUT, 30); // ----------- curl_setopt($curl, CURLOPT_RETURNTRANSFER, false); //FIXME These 2 lines will case segmentation fault curl_setopt($curl, CURLOPT_HEADERFUNCTION, function ($ch, $data) { return strlen($data); }); curl_setopt($curl, CURLOPT_WRITEFUNCTION, function ($ch, $data) use (&$originalResponseContent) { $originalResponseContent .= $data; return strlen($data); }); curl_multi_add_handle($mh, $curl); // Start fetching the responses. $content = null; $active = null; do { $mrc = curl_multi_exec($mh, $active); } while ($mrc == CURLM_CALL_MULTI_PERFORM); while ($active && $mrc == CURLM_OK) { curl_multi_select($mh); do { $mrc = curl_multi_exec($mh, $active); } while ($mrc == CURLM_CALL_MULTI_PERFORM); while ($info = curl_multi_info_read($mh)) { if ($info['msg'] == CURLMSG_DONE) { $handle = $info['handle']; if ($handle !== null) { $content = curl_multi_getcontent($handle); $url = getUrl($handle); // Debug echo strlen($content).': '.$url."\n"; curl_multi_remove_handle($mh, $handle); curl_close($handle); } } } } curl_multi_close($mh); return $originalResponseContent; } $url = 'https://http2.golang.org/serverpush'; $response = get_request($url); echo strlen($response).': '.$url."\n\n"; ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=76675&edit=1