Bug #60990 [Fbk->NoF]: Segfault when trying to allocate more memory

From: Date: Sun, 20 Jun 2021 04:22:13 +0000
Subject: Bug #60990 [Fbk->NoF]: Segfault when trying to allocate more memory
References: 1  Groups: php.bugs 
Request: Send a blank email to php-bugs+get-234537@lists.php.net to get a copy of this message 
Edit report at https://bugs.php.net/bug.php?id=60990&edit=1

 ID:               60990
 Updated by:       php-bugs@lists.php.net
 Reported by:      flatline at hardwired dot hu
 Summary:          Segfault when trying to allocate more memory
-Status:           Feedback
+Status:           No Feedback
 Type:             Bug
 Package:          Reproducible crash
 Operating System: Debian Squeeze x86_64
 PHP Version:      5.3.10
 Assigned To:      cmb
 Private report:   N

 New Comment:

No feedback was provided. The bug is being suspended because
we assume that you are no longer experiencing the problem.
If this is not the case and you are able to provide the
information that was requested earlier, please do so and
change the status of the bug back to "Re-Opened". Thank you.


Previous Comments:
------------------------------------------------------------------------
[2021-06-09 14:29:37] cmb@php.net

Is this still an issue with any of the actively supported PHP
versions[1]?

[1] <https://www.php.net/supported-versions.php>

------------------------------------------------------------------------
[2012-02-07 10:59:06] flatline at hardwired dot hu

Full backtrace without suhosin.so:

(gdb) thread apply all bt full

Thread 1 (Thread 13418):
#0  _zval_ptr_dtor (zval_ptr=0xa1) at /usr/src/php5/source/php5-5.3.10/Zend/zend_execute_API.c:436
        zv = 0x1221730
#1  0x00000000006d0a78 in zend_hash_destroy (ht=0x1bb0de0) at
/usr/src/php5/source/php5-5.3.10/Zend/zend_hash.c:729
        p = 0x1221730
#2  0x00000000006c350f in _zval_dtor_func (zvalue=0x1bb0d90) at
/usr/src/php5/source/php5-5.3.10/Zend/zend_variables.c:46
No locals.
#3  0x00000000006b74f9 in _zval_ptr_dtor (zval_ptr=0xa1) at
/usr/src/php5/source/php5-5.3.10/Zend/zend_variables.h:35
        zv = 0x1bb0d90
#4  0x00000000006d0712 in zend_hash_apply_deleter (ht=0xe31168, p=0x115ee48) at
/usr/src/php5/source/php5-5.3.10/Zend/zend_hash.c:814
        retval = 0x10c92e0
#5  0x00000000006d0998 in zend_hash_graceful_reverse_destroy (ht=0xe31168) at
/usr/src/php5/source/php5-5.3.10/Zend/zend_hash.c:850
        p = 0x3654f0c6cb0
#6  0x00000000006b7b0e in shutdown_executor () at
/usr/src/php5/source/php5-5.3.10/Zend/zend_execute_API.c:256
        __orig_bailout = <incomplete type>
        __bailout = {{__jmpbuf = {14880736, 0, 2924945600, 862009622, 17601248, 0, 17605824, 0},
__mask_was_saved = 0, __saved_mask = {__val = {1280986688, 869,
                14946704, 0, 7227061, 0, 18392456, 0, 18305824, 0, 14946704, 0, 7227061, 0,
14946704, 0}}}}
        __bailout = {{__jmpbuf = {14880736, 0, 2924945600, 862009622, 17601248, 0, 17605824, 0},
__mask_was_saved = 0, __saved_mask = {__val = {1280986688, 869,
                14946704, 0, 7227061, 0, 18392456, 0, 18305824, 0, 14946704, 0, 7227061, 0,
14946704, 0}}}}
        __bailout = {{__jmpbuf = {14880736, 0, 2924945600, 862009622, 17601248, 0, 17605824, 0},
__mask_was_saved = 0, __saved_mask = {__val = {1280986688, 869,
                14946704, 0, 7227061, 0, 18392456, 0, 18305824, 0, 14946704, 0, 7227061, 0,
14946704, 0}}}}
        __bailout = {{__jmpbuf = {14880736, 0, 2924945600, 862009622, 17601248, 0, 17605824, 0},
__mask_was_saved = 0, __saved_mask = {__val = {1280986688, 869,
                14946704, 0, 7227061, 0, 18392456, 0, 18305824, 0, 14946704, 0, 7227061, 0,
14946704, 0}}}}
        __bailout = {{__jmpbuf = {14880736, 0, 2924945600, 862009622, 17601248, 0, 17605824, 0},
__mask_was_saved = 0, __saved_mask = {__val = {1280986688, 869,
                14946704, 0, 7227061, 0, 18392456, 0, 18305824, 0, 14946704, 0, 7227061, 0,
14946704, 0}}}}
        __bailout = {{__jmpbuf = {14880736, 0, 2924945600, 862009622, 17601248, 0, 17605824, 0},
__mask_was_saved = 0, __saved_mask = {__val = {1280986688, 869,
                14946704, 0, 7227061, 0, 18392456, 0, 18305824, 0, 14946704, 0, 7227061, 0,
14946704, 0}}}}
        __bailout = {{__jmpbuf = {14880736, 0, 2924945600, 862009622, 17601248, 0, 17605824, 0},
__mask_was_saved = 0, __saved_mask = {__val = {1280986688, 869,
                14946704, 0, 7227061, 0, 18392456, 0, 18305824, 0, 14946704, 0, 7227061, 0,
14946704, 0}}}}
        __bailout = {{__jmpbuf = {14880736, 0, 2924945600, 862009622, 17601248, 0, 17605824, 0},
__mask_was_saved = 0, __saved_mask = {__val = {1280986688, 869,
                14946704, 0, 7227061, 0, 18392456, 0, 18305824, 0, 14946704, 0, 7227061, 0,
14946704, 0}}}}
        __bailout = {{__jmpbuf = {14880736, 0, 2924945600, 862009622, 17601248, 0, 17605824, 0},
__mask_was_saved = 0, __saved_mask = {__val = {1280986688, 869,
                14946704, 0, 7227061, 0, 18392456, 0, 18305824, 0, 14946704, 0, 7227061, 0,
14946704, 0}}}}
        __orig_bailout = <incomplete type>
        __bailout = {{__jmpbuf = {14880736, 0, 2924945600, 862009622, 17601248, 0, 17605824, 0},
__mask_was_saved = 0, __saved_mask = {__val = {1280986688, 869,
                14946704, 0, 7227061, 0, 18392456, 0, 18305824, 0, 14946704, 0, 7227061, 0,
14946704, 0}}}}
        __bailout = {{__jmpbuf = {14880736, 0, 2924945600, 862009622, 17601248, 0, 17605824, 0},
__mask_was_saved = 0, __saved_mask = {__val = {1280986688, 869,
                14946704, 0, 7227061, 0, 18392456, 0, 18305824, 0, 14946704, 0, 7227061, 0,
14946704, 0}}}}
        __bailout = {{__jmpbuf = {14880736, 0, 2924945600, 862009622, 17601248, 0, 17605824, 0},
__mask_was_saved = 0, __saved_mask = {__val = {1280986688, 869,
                14946704, 0, 7227061, 0, 18392456, 0, 18305824, 0, 14946704, 0, 7227061, 0,
14946704, 0}}}}
#7  0x00000000006c4762 in zend_deactivate () at /usr/src/php5/source/php5-5.3.10/Zend/zend.c:963
        __orig_bailout = 0x0
---Type <return> to continue, or q <return> to quit---
        __bailout = {{__jmpbuf = {152109408, 962, 14878784, 0, 2924945600, 862009622, 17601248, 0},
__mask_was_saved = 862134464, __saved_mask = {__val = {
                0 <repeats 12 times>, 17680896, 0, 0, 145}}}}
        __orig_bailout = 0x0
        __bailout = {{__jmpbuf = {152109408, 962, 14878784, 0, 2924945600, 862009622, 17601248, 0},
__mask_was_saved = 862134464, __saved_mask = {__val = {
                0 <repeats 12 times>, 17680896, 0, 0, 145}}}}
        __orig_bailout = 0x6c46dd
        __bailout = {{__jmpbuf = {152109408, 962, 14878784, 0, 2924945600, 862009622, 17601248, 0},
__mask_was_saved = 862134464, __saved_mask = {__val = {
                0 <repeats 12 times>, 17680896, 0, 0, 145}}}}
        __orig_bailout = 0x6c46dd
        __bailout = {{__jmpbuf = {152109408, 962, 14878784, 0, 2924945600, 862009622, 17601248, 0},
__mask_was_saved = 862134464, __saved_mask = {__val = {
                0 <repeats 12 times>, 17680896, 0, 0, 145}}}}
        __orig_bailout = 0x10ca4c0
        __bailout = {{__jmpbuf = {152109408, 962, 14878784, 0, 2924945600, 862009622, 17601248, 0},
__mask_was_saved = 862134464, __saved_mask = {__val = {
                0 <repeats 12 times>, 17680896, 0, 0, 145}}}}
        __orig_bailout = 0x6c46dd
        __bailout = {{__jmpbuf = {152109408, 962, 14878784, 0, 2924945600, 862009622, 17601248, 0},
__mask_was_saved = 862134464, __saved_mask = {__val = {
                0 <repeats 12 times>, 17680896, 0, 0, 145}}}}
        __orig_bailout = 0x0
        __bailout = {{__jmpbuf = {152109408, 962, 14878784, 0, 2924945600, 862009622, 17601248, 0},
__mask_was_saved = 862134464, __saved_mask = {__val = {
                0 <repeats 12 times>, 17680896, 0, 0, 145}}}}
#8  0x000000000066f3e5 in php_request_shutdown (dummy=0xa1) at
/usr/src/php5/source/php5-5.3.10/main/main.c:1664
        report_memleaks = 0 '\000'
#9  0x0000000000758ca0 in main (argc=17601248, argv=0x10ca4c0) at
/usr/src/php5/source/php5-5.3.10/sapi/fpm/fpm/fpm_main.c:1886
        primary_script = 0x1000000 "\203â¨ü\201>ĂG\016"
        __bailout = {{__jmpbuf = {0, 0, 11849916, 0, 4122419392, 887433970, 3, 0}, __mask_was_saved
= -1285480256, __saved_mask = {__val = {0, 0, 0, 0, 0, 0,
                1324713501, 869, 0, 0, 1270933192, 869, 0, 0, 1324685090, 869}}}}
        exit_status = 0
        c = 7091440
        file_handle = {type = ZEND_HANDLE_FILENAME, filename = 0x4 <Address 0x4 out of
bounds>,
          opened_path = 0x10c9718
"'\177(Å»\017D>\"/xxxxx.hu/html/kat-origi.phtml", handle = {fd = 0, fp =
0x0, stream = {handle = 0x0, isatty = 17723752, mmap = {
                len = 0, pos = 20674, map = 0x0, buf = 0x3654f03c000 <Address 0x3654f03c000 out
of bounds>, old_handle = 0x3654f03c000, old_closer = 0x1107220},
              reader = 0x6d9820 <zend_stream_stdio_closer>, fsizer = 0x6d9e60
<zend_stream_stdio_reader>, closer = 0x6d98e0 <zend_stream_stdio_fsizer>}},
          free_filename = 224 'ŕ'}
        orig_optind = 0
        orig_optarg = 0x0
        max_requests = 0
        requests = 17722696
        fcgi_fd = 7042240
        request = {listen_socket = 1, fd = 0, id = 0, keep = 3, closed = 1, in_len = 0, in_pad = 0,
out_hdr = 0x0, out_pos = 0x3c2091102f0 "",
          out_buf = "v\004\021\tÂ\003\000\000\000\006\000\000\000\000\000\000Expires: Thu,
19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate, post-check=0,
pre-check=0\r\nPragma: no-cache\r\nSet-Cookie: sess_odi_sid=o7fjrtnnpohsuqg7a7114b"...,
reserved = '\000' <repeats 15 times>, env = 0x0}
        fpm_config = 0x0
        fpm_prefix = 0x0
---Type <return> to continue, or q <return> to quit---
        fpm_pid = 0x3c20911266b ""
        test_conf = 0
        php_information = 0
        __func__ = "main"

------------------------------------------------------------------------
[2012-02-07 10:58:06] flatline at hardwired dot hu

Full backtrace with suhosin.so:

(gdb) thread apply all bt full

Thread 1 (Thread 18218):
#0  zend_mm_remove_from_free_list (heap=0xe40ab0, mm_block=0x1c85988) at
/usr/src/php5/source/php5-5.3.10/Zend/zend_alloc_canary.c:880
        index = 9
        rp = 0x9
        cp = 0x1c85988
        prev = 0x0
        next = 0x0
#1  0x00000000006e4738 in _zend_mm_free_canary_int (heap=0xe40ab0, p=0x1c85960) at
/usr/src/php5/source/php5-5.3.10/Zend/zend_alloc_canary.c:2133
        mm_block = 0x1c85938
        next_block = 0x1c85988
        size = 80
#2  0x00000000006d0712 in zend_hash_apply_deleter (ht=0xe31168, p=0x1126638) at
/usr/src/php5/source/php5-5.3.10/Zend/zend_hash.c:814
        retval = 0x119b5e0
#3  0x00000000006d0998 in zend_hash_graceful_reverse_destroy (ht=0xe31168) at
/usr/src/php5/source/php5-5.3.10/Zend/zend_hash.c:850
        p = 0x1c85988
#4  0x00000000006b7b0e in shutdown_executor () at
/usr/src/php5/source/php5-5.3.10/Zend/zend_execute_API.c:256
        __orig_bailout = <incomplete type>
        __bailout = {{__jmpbuf = {14880736, 0, 1622845780, 3043182966, 18462176, 0, 18465520, 0},
__mask_was_saved = 0, __saved_mask = {__val = {2924002880, 830,
                14944944, 0, 7227061, 0, 17601944, 0, 18074376, 0, 14944944, 0, 7227061, 0,
14944944, 0}}}}
        __bailout = {{__jmpbuf = {14880736, 0, 1622845780, 3043182966, 18462176, 0, 18465520, 0},
__mask_was_saved = 0, __saved_mask = {__val = {2924002880, 830,
                14944944, 0, 7227061, 0, 17601944, 0, 18074376, 0, 14944944, 0, 7227061, 0,
14944944, 0}}}}
        __bailout = {{__jmpbuf = {14880736, 0, 1622845780, 3043182966, 18462176, 0, 18465520, 0},
__mask_was_saved = 0, __saved_mask = {__val = {2924002880, 830,
                14944944, 0, 7227061, 0, 17601944, 0, 18074376, 0, 14944944, 0, 7227061, 0,
14944944, 0}}}}
        __bailout = {{__jmpbuf = {14880736, 0, 1622845780, 3043182966, 18462176, 0, 18465520, 0},
__mask_was_saved = 0, __saved_mask = {__val = {2924002880, 830,
                14944944, 0, 7227061, 0, 17601944, 0, 18074376, 0, 14944944, 0, 7227061, 0,
14944944, 0}}}}
        __bailout = {{__jmpbuf = {14880736, 0, 1622845780, 3043182966, 18462176, 0, 18465520, 0},
__mask_was_saved = 0, __saved_mask = {__val = {2924002880, 830,
                14944944, 0, 7227061, 0, 17601944, 0, 18074376, 0, 14944944, 0, 7227061, 0,
14944944, 0}}}}
        __bailout = {{__jmpbuf = {14880736, 0, 1622845780, 3043182966, 18462176, 0, 18465520, 0},
__mask_was_saved = 0, __saved_mask = {__val = {2924002880, 830,
                14944944, 0, 7227061, 0, 17601944, 0, 18074376, 0, 14944944, 0, 7227061, 0,
14944944, 0}}}}
        __bailout = {{__jmpbuf = {14880736, 0, 1622845780, 3043182966, 18462176, 0, 18465520, 0},
__mask_was_saved = 0, __saved_mask = {__val = {2924002880, 830,
                14944944, 0, 7227061, 0, 17601944, 0, 18074376, 0, 14944944, 0, 7227061, 0,
14944944, 0}}}}
        __bailout = {{__jmpbuf = {14880736, 0, 1622845780, 3043182966, 18462176, 0, 18465520, 0},
__mask_was_saved = 0, __saved_mask = {__val = {2924002880, 830,
                14944944, 0, 7227061, 0, 17601944, 0, 18074376, 0, 14944944, 0, 7227061, 0,
14944944, 0}}}}
        __bailout = {{__jmpbuf = {14880736, 0, 1622845780, 3043182966, 18462176, 0, 18465520, 0},
__mask_was_saved = 0, __saved_mask = {__val = {2924002880, 830,
                14944944, 0, 7227061, 0, 17601944, 0, 18074376, 0, 14944944, 0, 7227061, 0,
14944944, 0}}}}
        __orig_bailout = <incomplete type>
        __bailout = {{__jmpbuf = {14880736, 0, 1622845780, 3043182966, 18462176, 0, 18465520, 0},
__mask_was_saved = 0, __saved_mask = {__val = {2924002880, 830,
                14944944, 0, 7227061, 0, 17601944, 0, 18074376, 0, 14944944, 0, 7227061, 0,
14944944, 0}}}}
        __bailout = {{__jmpbuf = {14880736, 0, 1622845780, 3043182966, 18462176, 0, 18465520, 0},
__mask_was_saved = 0, __saved_mask = {__val = {2924002880, 830,
                14944944, 0, 7227061, 0, 17601944, 0, 18074376, 0, 14944944, 0, 7227061, 0,
14944944, 0}}}}
        __bailout = {{__jmpbuf = {14880736, 0, 1622845780, 3043182966, 18462176, 0, 18465520, 0},
__mask_was_saved = 0, __saved_mask = {__val = {2924002880, 830,
                14944944, 0, 7227061, 0, 17601944, 0, 18074376, 0, 14944944, 0, 7227061, 0,
14944944, 0}}}}
---Type <return> to continue, or q <return> to quit---
#5  0x00000000006c4762 in zend_deactivate () at /usr/src/php5/source/php5-5.3.10/Zend/zend.c:963
        __orig_bailout = 0x0
        __bailout = {{__jmpbuf = {428990512, 958, 14878784, 0, 1622845780, 3043182966, 18462176, 0},
__mask_was_saved = -40982188, __saved_mask = {__val = {
                0 <repeats 12 times>, 18541400, 0, 0, 145}}}}
        __orig_bailout = 0x0
        __bailout = {{__jmpbuf = {428990512, 958, 14878784, 0, 1622845780, 3043182966, 18462176, 0},
__mask_was_saved = -40982188, __saved_mask = {__val = {
                0 <repeats 12 times>, 18541400, 0, 0, 145}}}}
        __orig_bailout = 0x6c46dd
        __bailout = {{__jmpbuf = {428990512, 958, 14878784, 0, 1622845780, 3043182966, 18462176, 0},
__mask_was_saved = -40982188, __saved_mask = {__val = {
                0 <repeats 12 times>, 18541400, 0, 0, 145}}}}
        __orig_bailout = 0x6c46dd
        __bailout = {{__jmpbuf = {428990512, 958, 14878784, 0, 1622845780, 3043182966, 18462176, 0},
__mask_was_saved = -40982188, __saved_mask = {__val = {
                0 <repeats 12 times>, 18541400, 0, 0, 145}}}}
        __orig_bailout = 0x119c2f0
        __bailout = {{__jmpbuf = {428990512, 958, 14878784, 0, 1622845780, 3043182966, 18462176, 0},
__mask_was_saved = -40982188, __saved_mask = {__val = {
                0 <repeats 12 times>, 18541400, 0, 0, 145}}}}
        __orig_bailout = 0x6c46dd
        __bailout = {{__jmpbuf = {428990512, 958, 14878784, 0, 1622845780, 3043182966, 18462176, 0},
__mask_was_saved = -40982188, __saved_mask = {__val = {
                0 <repeats 12 times>, 18541400, 0, 0, 145}}}}
        __orig_bailout = 0x0
        __bailout = {{__jmpbuf = {428990512, 958, 14878784, 0, 1622845780, 3043182966, 18462176, 0},
__mask_was_saved = -40982188, __saved_mask = {__val = {
                0 <repeats 12 times>, 18541400, 0, 0, 145}}}}
#6  0x000000000066f3e5 in php_request_shutdown (dummy=0xe40ab0) at
/usr/src/php5/source/php5-5.3.10/main/main.c:1664
        report_memleaks = 0 '\000'
#7  0x0000000000758ca0 in main (argc=18462176, argv=0x119c2f0) at
/usr/src/php5/source/php5-5.3.10/sapi/fpm/fpm/fpm_main.c:1886
        primary_script = 0x1000000 "ÖÓe\237i\177ôh\023"
        __bailout = {{__jmpbuf = {0, 0, 11849916, 0, 1996138836, 2988407700, 3, 0}, __mask_was_saved
= 2106370388, __saved_mask = {__val = {0, 0, 0, 0, 0, 0,
                2967729693, 830, 0, 0, 2913949384, 830, 0, 0, 2967701282, 830}}}}
        exit_status = 0
        c = 29907336
        file_handle = {type = ZEND_HANDLE_FILENAME, filename = 0x2 <Address 0x2 out of
bounds>,
          opened_path = 0x119b500 "ż\235K\212w\216lÜ/xxxxx.hu/html/kat-origi.phtml",
handle = {fd = 0, fp = 0x0, stream = {handle = 0x0, isatty = 18169248, mmap = {
                len = 0, pos = 0, map = 0x0, buf = 0x0, old_handle = 0x0, old_closer = 0}, reader =
0, fsizer = 0, closer = 0}}, free_filename = 0 '\000'}
        orig_optind = 0
        orig_optarg = 0x0
        max_requests = 0
        requests = 18583184
        fcgi_fd = 0
        request = {listen_socket = 1, fd = 0, id = 0, keep = 3, closed = 1, in_len = 0, in_pad = 0,
out_hdr = 0x0, out_pos = 0x3be1991e1c0 "\001\006",
          out_buf = "Fă\221\031ž\003\000\000\001\006\000\001\000\006\002\000Expires: Thu,
19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate, post-check=0,
pre-check=0\r\nPragma: no-cache\r\nSet-Cookie: sess_odi_sid=rlkoioa5p89rt75mbou02m"...,
reserved = "erticum.\000\000\000\000\000\000\000", env = 0x0}
        fpm_config = 0x0
        fpm_prefix = 0x0
---Type <return> to continue, or q <return> to quit---
        fpm_pid = 0x3be19920522 ""
        test_conf = 0
        php_information = 0
        __func__ = "main"

------------------------------------------------------------------------


The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at

    https://bugs.php.net/bug.php?id=60990


--
Edit this bug report at https://bugs.php.net/bug.php?id=60990&edit=1

Thread (10 messages)

« previous php.bugs (#234537) next »