Bug #77099 [Com]: PHP crashes with segfault
Edit report at https://bugs.php.net/bug.php?id=77099&edit=1
ID: 77099
Comment by: mason dot malone at gmail dot com
Reported by: info at phpgangsta dot de
Summary: PHP crashes with segfault
Status: Verified
Type: Bug
Package: Pspell related
Operating System: Ubuntu 18.04
PHP Version: 7.2.11
Block user comment: N
Private report: N
New Comment:
We ran into this too, and I'm pretty sure it's due to the following bug in libaspell: https://github.com/GNUAspell/aspell/issues/496
The fix was released as version 0.60.8. I confirmed that installing that fixes the issue locally,
but updating our Debian servers is going to be tricky since that version isn't in Debian stable
and hasn't been backported as far as I can tell.
Previous Comments:
------------------------------------------------------------------------
[2019-08-13 09:57:23] nikic@php.net
Confirming the crash after a couple reloads. Valgrind also produces the following error on a simple
run:
==18344== Conditional jump or move depends on uninitialised value(s)
==18344== at 0x57D5F28: aspeller::AffixMgr::suffix_check(aspeller::LookupInfo const&,
acommon::ParmString, acommon::CheckInfo&, aspeller::GuessInfo*, int, aspeller::AffEntry*) const
(in /usr/lib/x86_64-linux-gnu/libaspell.so.15.2.0)
==18344== by 0x57D676A: aspeller::AffixMgr::affix_check(aspeller::LookupInfo const&,
acommon::ParmString, acommon::CheckInfo&, aspeller::GuessInfo*) const (in
/usr/lib/x86_64-linux-gnu/libaspell.so.15.2.0)
==18344== by 0x57AF79F: ??? (in /usr/lib/x86_64-linux-gnu/libaspell.so.15.2.0)
==18344== by 0x57B3965: ??? (in /usr/lib/x86_64-linux-gnu/libaspell.so.15.2.0)
==18344== by 0x57C2103: aspeller::SpellerImpl::suggest(acommon::MutableString) (in
/usr/lib/x86_64-linux-gnu/libaspell.so.15.2.0)
==18344== by 0x57EA6CB: aspell_speller_suggest (in /usr/lib/x86_64-linux-gnu/libaspell.so.15.2.0)
==18344== by 0x713C26: zif_pspell_suggest (pspell.c:536)
==18344== by 0xA7C44B: ZEND_DO_ICALL_SPEC_RETVAL_UNUSED_HANDLER (zend_vm_execute.h:573)
==18344== by 0xB0311D: execute_ex (zend_vm_execute.h:59747)
==18344== by 0xB08529: zend_execute (zend_vm_execute.h:63776)
==18344== by 0xA179D5: zend_execute_scripts (zend.c:1498)
==18344== by 0x97B072: php_execute_script (main.c:2599)
This looks like a bug in libaspell to me.
------------------------------------------------------------------------
[2019-08-13 09:33:34] ih at vollzeitjobs dot de
I'm experiencing the same, the small testscript crashes every 3-5 times I call it.
Debian 9.9
ii php7.3 7.3.8-1+0~20190807.43+debian9~1.gbp7731bf
ii php7.3-pspell 7.3.8-1+0~20190807.43+debian9~1.gbp7731bf
PHP 7.3.8-1+0~20190807.43+debian9~1.gbp7731bf (cli) (built: Aug 7 2019 19:46:25) ( NTS )
Copyright (c) 1997-2018 The PHP Group
Zend Engine v3.3.8, Copyright (c) 1998-2018 Zend Technologies
with Zend OPcache v7.3.8-1+0~20190807.43+debian9~1.gbp7731bf, Copyright (c) 1999-2018, by Zend
Technologies
---
Aug 13 11:30:55 jobs-herford kernel: [353562.678985] traps: php-fpm7.3[8795] general protection
ip:7f1fc1622828 sp:7fffa675bfe0 error:0
Aug 13 11:30:57 jobs-herford kernel: [353563.968722] traps: php-fpm7.3[8845] general protection
ip:7f1fc16227ec sp:7fffa675bfe0 error:0
Aug 13 11:30:58 jobs-herford kernel: [353565.366368] traps: php-fpm7.3[8801] general protection
ip:7f1fc16227ec sp:7fffa675bfe0 error:0
Aug 13 11:31:03 jobs-herford kernel: [353570.736281] traps: php-fpm7.3[8857] general protection
ip:7f1fc16227ec sp:7fffa675bfe0 error:0
Aug 13 11:31:05 jobs-herford kernel: [353572.048257] php-fpm7.3[8851]: segfault at 8 ip
00007f1fc1622828 sp 00007fffa675bfe0 error 4 in libaspell.so.15.2.0[7f1fc15a8000+a3000]
Aug 13 11:31:06 jobs-herford kernel: [353573.510952] traps: php-fpm7.3[8842] general protection
ip:7f1fc1622828 sp:7fffa675bfe0 error:0
------------------------------------------------------------------------
[2018-11-03 14:58:04] info at phpgangsta dot de
Description:
------------
If I use pspell for spellchecking, it sometimes crashes with a segfault. Every 3-5 times I call the
script via Apache, Apache crashes:
[Sat Nov 03 15:36:12.592943 2018] [core:notice] [pid 5264] AH00051: child pid 29189 exit signal
Segmentation fault (11), possible coredump in /etc/apache2
[Sat Nov 03 15:37:33.689349 2018] [core:notice] [pid 5264] AH00051: child pid 29965 exit signal
Segmentation fault (11), possible coredump in /etc/apache2
[Sat Nov 03 15:40:12.879852 2018] [core:notice] [pid 5264] AH00051: child pid 30367 exit signal
Segmentation fault (11), possible coredump in /etc/apache2
The small script below can reproduce the problem: If you call it from outside via HTTP, it crashes
every 3-5 requests:
curl https://url.de/spellchecker.php
See segmentation faults above.
$ php -v
PHP 7.2.11-3+ubuntu18.04.1+deb.sury.org+1 (cli) (built: Oct 25 2018 06:44:08) ( NTS )
Copyright (c) 1997-2018 The PHP Group
Zend Engine v3.2.0, Copyright (c) 1998-2018 Zend Technologies
with Zend OPcache v7.2.11-3+ubuntu18.04.1+deb.sury.org+1, Copyright (c) 1999-2018, by Zend
Technologies
It seems to just happen with de_DE. If I change it to en_US, it does not crash. Maybe it has to do
with Umlauts oder similar?
Interestingly I'm not able to reproduce it on the command line...
Segmentation fault also happens on Ubuntu 16.04 with PHP 7.1:
$ php -v
PHP 7.1.23-3+ubuntu16.04.1+deb.sury.org+1 (cli) (built: Oct 25 2018 06:43:19) ( NTS )
Copyright (c) 1997-2018 The PHP Group
Zend Engine v3.1.0, Copyright (c) 1998-2018 Zend Technologies
with Zend OPcache v7.1.23-3+ubuntu16.04.1+deb.sury.org+1, Copyright (c) 1999-2018, by Zend
Technologies
Test script:
---------------
<?php
$plink = pspell_new('de_DE', "", "", "utf-8", PSPELL_FAST);
pspell_suggest($plink, '___');
Expected result:
----------------
no crash
Actual result:
--------------
crash with segmentation fault
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=77099&edit=1
Thread (5 messages)