From: php at mni dot de
Operating system: CentOS 7.8.2003
PHP version: 7.4.9
Package: FPM related
Bug Type: Bug
Bug description:Segfault in php-fpm
Description:
------------
We experiences a problem with a Wordpress/Woocommerce Installation. Some
of our users are no longer able to login, when they have a saved
shopping cart in the database. The login fails with a 502 (Bad Gateway)
Error because the FPM-Child dies with a segfault:
[2083913.678027] php-fpm[18682]: segfault at 7ffd48dddff8 ip
000055ffaf5ae175 sp 00007ffd48dde000 error 6 in
php-fpm[55ffaf320000+472000]
Core was generated by `php-fpm: pool www '.
Program terminated with signal 11, Segmentation fault.
#0 0x0000560723ee1e09 in zend_dtoa (dd=39.899999999999999,
mode=mode@entry=3, ndigits=ndigits@entry=2,
decpt=decpt@entry=0x7ffcbac60098, sign=sign@entry=0x7ffcbac60174,
rve=rve@entry=0x7ffcbac60030) at
/usr/src/debug/php-7.4.9/Zend/zend_strtod.c:3721
3721 {
If it is useful for debugging, i can send you the whole Core-Dump
(350MB).
The problem exists also on Centos 7.6 with php7.3. I can 'solve' the
problem by deleting the saved shopping cart entry from the database. The
problem ist reproducible on a staging server.
Please let me know, what further information do you need. Thank you in
advance.
Expected result:
----------------
No segfault, User is able to login.
Actual result:
--------------
segfault, see above
backtrace
#0 0x0000560723ee1e09 in zend_dtoa (dd=39.899999999999999,
mode=mode@entry=3, ndigits=ndigits@entry=2,
decpt=decpt@entry=0x7ffcbac60098, sign=sign@entry=0x7ffcbac60174,
rve=rve@entry=0x7ffcbac60030) at
/usr/src/debug/php-7.4.9/Zend/zend_strtod.c:3721
#1 0x0000560723e5e1d7 in __cvt (value=value@entry=39.899999999999999,
ndigit=ndigit@entry=2, decpt=0x7ffcbac60098,
sign=sign@entry=0x7ffcbac60174, fmode=fmode@entry=1, pad=1)
at /usr/src/debug/php-7.4.9/main/snprintf.c:90
#2 0x0000560723e5e4db in php_fcvt (sign=0x7ffcbac60174,
decpt=0x7ffcbac60098, ndigit=2, value=39.899999999999999) at
/usr/src/debug/php-7.4.9/main/snprintf.c:386
#3 php_conv_fp (format=<optimized out>,
num=num@entry=39.899999999999999, add_dp=NO, precision=2,
dec_point=<optimized out>, is_negative=is_negative@entry=0x7ffcbac60174,
buf=buf@entry=0x7ffcbac601a1 "", len=0x7ffcbac60178) at
/usr/src/debug/php-7.4.9/main/snprintf.c:386
#4 0x0000560723e6117a in xbuf_format_converter (xbuf=0x7ffcbac60620,
is_char=0 '\000', fmt=0x560723fb12f6 "F", ap=0x7ffcbac60650) at
/usr/src/debug/php-7.4.9/main/spprintf.c:637
#5 0x0000560723ebe009 in zend_vstrpprintf (max_len=0, format=<optimized
out>, ap=ap@entry=0x7ffcbac60650) at
/usr/src/debug/php-7.4.9/Zend/zend.c:243
#6 0x0000560723ebe104 in zend_strpprintf (max_len=max_len@entry=0,
format=format@entry=0x560723fb12f3 "%.*F") at
/usr/src/debug/php-7.4.9/Zend/zend.c:264
#7 0x0000560723e1978e in _php_math_number_format_ex
(d=39.899999999999999, dec=2, dec_point=dec_point@entry=0x7ffcbac607bc
".+\f\340\002", dec_point_len=dec_point_len@entry=1,
thousand_sep=thousand_sep@entry=0x7ffcbac607b8
",\003D[.+\f\340\002", thousand_sep_len=thousand_sep_len@entry=1) at
/usr/src/debug/php-7.4.9/ext/standard/math.c:1160
#8 0x0000560723e19be7 in _php_math_number_format (d=<optimized out>,
dec=<optimized out>, dec_point=<optimized out>, thousand_sep=<optimized
out>)
at /usr/src/debug/php-7.4.9/ext/standard/math.c:1138
#9 0x0000560723e19d69 in zif_number_format () at
/usr/src/debug/php-7.4.9/ext/standard/math.c:1282
#10 0x0000560723f40768 in ZEND_DO_ICALL_SPEC_RETVAL_USED_HANDLER () at
/usr/src/debug/php-7.4.9/Zend/zend_vm_execute.h:1314
#11 execute_ex () at
/usr/src/debug/php-7.4.9/Zend/zend_vm_execute.h:53740
#12 0x0000560723eb07e6 in zend_call_function () at
/usr/src/debug/php-7.4.9/Zend/zend_execute_API.c:813
#13 0x0000560723de0b09 in php_array_user_compare (a=<optimized out>,
b=<optimized out>) at /usr/src/debug/php-7.4.9/ext/standard/array.c:971
#14 0x0000560723ed93f0 in zend_sort_3 (swp=<optimized out>,
cmp=<optimized out>, c=<optimized out>, b=<optimized out>, a=<optimized
out>) at /usr/src/debug/php-7.4.9/Zend/zend_sort.c:104
#15 zend_sort_3 (swp=<optimized out>, cmp=<optimized out>, c=<optimized
out>, b=<optimized out>, a=<optimized out>) at
/usr/src/debug/php-7.4.9/Zend/zend_sort.c:98
#16 zend_insert_sort (base=0x7ff0b6085940, nmemb=<optimized out>,
siz=32, cmp=0x560723de0a80 <php_array_user_compare>, swp=0x560723eca8e0
<zend_hash_bucket_swap>)
at /usr/src/debug/php-7.4.9/Zend/zend_sort.c:160
#17 0x0000560723ed1a2a in zend_hash_sort_ex (ht=ht@entry=0x7ff0b60839d8,
sort=<optimized out>, compar=compar@entry=0x560723de0a80
<php_array_user_compare>, renumber=<optimized out>)
at /usr/src/debug/php-7.4.9/Zend/zend_hash.c:2493
#18 0x0000560723de0f8f in php_usort () at
/usr/src/debug/php-7.4.9/ext/standard/array.c:1038
#19 0x0000560723f40768 in ZEND_DO_ICALL_SPEC_RETVAL_USED_HANDLER () at
/usr/src/debug/php-7.4.9/Zend/zend_vm_execute.h:1314
#20 execute_ex () at
/usr/src/debug/php-7.4.9/Zend/zend_vm_execute.h:53740
#21 0x0000560723eb07e6 in zend_call_function () at
/usr/src/debug/php-7.4.9/Zend/zend_execute_API.c:813
#22 0x0000560723de0b09 in php_array_user_compare (a=<optimized out>,
b=<optimized out>) at /usr/src/debug/php-7.4.9/ext/standard/array.c:971
#23 0x0000560723ed93f0 in zend_sort_3 (swp=<optimized out>,
cmp=<optimized out>, c=<optimized out>, b=<optimized out>, a=<optimized
out>) at /usr/src/debug/php-7.4.9/Zend/zend_sort.c:104
#24 zend_sort_3 (swp=<optimized out>, cmp=<optimized out>, c=<optimized
out>, b=<optimized out>, a=<optimized out>) at
/usr/src/debug/php-7.4.9/Zend/zend_sort.c:98
#25 zend_insert_sort (base=0x7ff0b6082640, nmemb=<optimized out>,
siz=32, cmp=0x560723de0a80 <php_array_user_compare>, swp=0x560723eca8e0
<zend_hash_bucket_swap>)
at /usr/src/debug/php-7.4.9/Zend/zend_sort.c:160
#26 0x0000560723ed1a2a in zend_hash_sort_ex (ht=ht@entry=0x7ff0b60833f0,
sort=<optimized out>, compar=compar@entry=0x560723de0a80
<php_array_user_compare>, renumber=<optimized out>)
at /usr/src/debug/php-7.4.9/Zend/zend_hash.c:2493
#27 0x0000560723de0f8f in php_usort () at
/usr/src/debug/php-7.4.9/ext/standard/array.c:1038
#28 0x0000560723f40768 in ZEND_DO_ICALL_SPEC_RETVAL_USED_HANDLER () at
/usr/src/debug/php-7.4.9/Zend/zend_vm_execute.h:1314
#29 execute_ex () at
/usr/src/debug/php-7.4.9/Zend/zend_vm_execute.h:53740
#30 0x0000560723eb07e6 in zend_call_function () at
/usr/src/debug/php-7.4.9/Zend/zend_execute_API.c:813
#31 0x0000560723de0b09 in php_array_user_compare (a=<optimized out>,
b=<optimized out>) at /usr/src/debug/php-7.4.9/ext/standard/array.c:971
#32 0x0000560723ed93f0 in zend_sort_3 (swp=<optimized out>,
cmp=<optimized out>, c=<optimized out>, b=<optimized out>, a=<optimized
out>) at /usr/src/debug/php-7.4.9/Zend/zend_sort.c:104
--
Edit bug report at https://bugs.php.net/bug.php?id=79973&edit=1
--
Fix committed: https://bugs.php.net/fix.php?id=79973&r=fixed
Fixed in release: https://bugs.php.net/fix.php?id=79973&r=alreadyfixed
Need backtrace: https://bugs.php.net/fix.php?id=79973&r=needtrace
Need Reproduce Script: https://bugs.php.net/fix.php?id=79973&r=needscript
Try newer version: https://bugs.php.net/fix.php?id=79973&r=oldversion
Not developer issue: https://bugs.php.net/fix.php?id=79973&r=support
Expected behavior: https://bugs.php.net/fix.php?id=79973&r=notwrong
Not enough info: https://bugs.php.net/fix.php?id=79973&r=notenoughinfo
Submitted twice: https://bugs.php.net/fix.php?id=79973&r=submittedtwice
register_globals: https://bugs.php.net/fix.php?id=79973&r=globals
PHP version support discontinued: https://bugs.php.net/fix.php?id=79973&r=phptooold
Daylight Savings: https://bugs.php.net/fix.php?id=79973&r=dst
IIS Stability: https://bugs.php.net/fix.php?id=79973&r=isapi
Install GNU Sed: https://bugs.php.net/fix.php?id=79973&r=gnused
Floating point limitations: https://bugs.php.net/fix.php?id=79973&r=float
No Zend Extensions: https://bugs.php.net/fix.php?id=79973&r=nozend
MySQL Configuration Error: https://bugs.php.net/fix.php?id=79973&r=mysqlcfg