Edit report at https://bugs.php.net/bug.php?id=68348&edit=1
ID: 68348
User updated by: php dot net at danslereseau dot com
Reported by: php dot net at danslereseau dot com
Summary: SIGSEGV in zend_hash_destroy at L558 p =
p->pListNext;
-Status: Feedback
+Status: Assigned
Type: Bug
Package: *General Issues
Operating System: Amazon Linux 2014.09
PHP Version: 5.5.18
Assigned To: cmb
Block user comment: N
Private report: N
New Comment:
No, I can't reproduce now.
I tried on PHP 7.2, 7.3, 7.4 and 8.0, using CLI.
Previous Comments:
------------------------------------------------------------------------
[2021-10-11 13:06:34] cmb@php.net
On a closer look, this might not be related to the mysql extension
at all, but rather to the session extension and/or the shutdown
sequence. Since mysql is unbundled as of PHP 7.0.0 (and unlikely
to receive bug fixes), I've tried with mysqli_real_connect() and
curl_init(), but there was no segfault for me. Can you still
reproduce the segfault with any of the actively supported PHP
versions[1]? Also if you call another extension in crash(), or is
this actually mysql related?
[1] <https://www.php.net/supported-versions.php>
------------------------------------------------------------------------
[2017-09-21 16:11:45] cmb@php.net
Thanks for the quick reply! I'm not accustomed to the MySQL extension, which
apparently causes the segfault, so I'm unassigning myself. Sorry.
------------------------------------------------------------------------
[2017-09-21 15:52:58] php dot net at danslereseau dot com
Yes, the code snippet posted on 2014-11-06 05:34 UTC still crashes PHP 5.6.31 from CLI.
$ php crash.php
Segmentation fault
$ php -v
PHP 5.6.31 (cli) (built: Aug 14 2017 17:37:23)
Copyright (c) 1997-2016 The PHP Group
Zend Engine v2.6.0, Copyright (c) 1998-2016 Zend Technologies
with Zend OPcache v7.0.6-dev, Copyright (c) 1999-2016, by Zend Technologies
------------------------------------------------------------------------
[2017-09-21 15:45:13] cmb@php.net
Support for PHP 5.5 has ended quite a while ago. Can you still reproduce this
issue with a currently supported PHP version?
------------------------------------------------------------------------
[2014-11-06 05:34:03] php dot net at danslereseau dot com
While trying to debug this, I found this code that crashes php (cli and php-fpm):
<?php
function crash() {
@mysql_connect('127.0.0.2');
}
class Session_Handler_T {
public function open($path, $name)
{
return TRUE;
}
public function close()
{
return TRUE;
}
public function read($id)
{
crash();
return TRUE;
}
public function write($id, $data)
{
crash();
return TRUE;
}
public function destroy($id)
{
return TRUE;
}
public function gc($maxlifetime)
{
return TRUE;
}
}
class ExceptHandler extends Exception {
public static function handle(Exception $e) {
$handler = new Session_Handler_T();
session_set_save_handler
(
array($handler, 'open'),
array($handler, 'close'),
array($handler, 'read'),
array($handler, 'write'),
array($handler, 'destroy'),
array($handler, 'gc')
);
session_start();
}
}
set_exception_handler(array('ExceptHandler', 'handle'));
throw new Exception('test');
?>
But if gives a different stack trace (this one was obtained using php-cli instead of php-fpm, but
php-fpm crashes on this code too):
#0 0x00007fffe3fd6b6f in php_mysql_do_connect (ht=<optimized out>,
return_value=0x7ffff7fdb490, persistent=<optimized out>,
return_value_used=<optimized out>, this_ptr=<optimized out>,
return_value_ptr=<optimized out>) at /usr/src/debug/php-5.5.18/ext/mysql/php_mysql.c:1023
#1 0x000000000058615b in dtrace_execute_internal (execute_data_ptr=<optimized out>,
fci=<optimized out>, return_value_used=<optimized out>)
at /usr/src/debug/php-5.5.18/Zend/zend_dtrace.c:97
#2 0x0000000000646795 in zend_do_fcall_common_helper_SPEC (execute_data=<optimized out>) at
/usr/src/debug/php-5.5.18/Zend/zend_vm_execute.h:552
#3 0x00000000005c04a8 in execute_ex (execute_data=0x7ffff7fa21a0) at
/usr/src/debug/php-5.5.18/Zend/zend_vm_execute.h:363
#4 0x0000000000586059 in dtrace_execute_ex (execute_data=<optimized out>) at
/usr/src/debug/php-5.5.18/Zend/zend_dtrace.c:73
#5 0x0000000000646de0 in zend_do_fcall_common_helper_SPEC (execute_data=0x7ffff7fa2098) at
/usr/src/debug/php-5.5.18/Zend/zend_vm_execute.h:584
#6 0x00000000005c04a8 in execute_ex (execute_data=0x7ffff7fa2098) at
/usr/src/debug/php-5.5.18/Zend/zend_vm_execute.h:363
#7 0x0000000000586059 in dtrace_execute_ex (execute_data=<optimized out>) at
/usr/src/debug/php-5.5.18/Zend/zend_dtrace.c:73
#8 0x0000000000588391 in zend_call_function (fci=fci@entry=0x7fffffffca60, fci_cache=<optimized
out>, fci_cache@entry=0x0)
at /usr/src/debug/php-5.5.18/Zend/zend_execute_API.c:937
#9 0x000000000058858e in call_user_function_ex (function_table=function_table@entry=0x999a00,
object_pp=<optimized out>, function_name=<optimized out>,
retval_ptr_ptr=retval_ptr_ptr@entry=0x7fffffffcaf8, param_count=<optimized out>,
params=params@entry=0x7ffff7fd5a38, no_separation=no_separation@entry=1,
symbol_table=symbol_table@entry=0x0) at /usr/src/debug/php-5.5.18/Zend/zend_execute_API.c:725
#10 0x00000000005885e2 in call_user_function (function_table=0x999a00,
object_pp=object_pp@entry=0x0, function_name=function_name@entry=0x7ffff7fdaef8,
retval_ptr=0x7ffff7fd5fd0, param_count=param_count@entry=2, params=params@entry=0x7fffffffcb60)
at /usr/src/debug/php-5.5.18/Zend/zend_execute_API.c:698
#11 0x000000000049ffec in ps_call_handler (func=0x7ffff7fdaef8, argc=argc@entry=2,
argv=argv@entry=0x7fffffffcb60)
at /usr/src/debug/php-5.5.18/ext/session/mod_user.c:53
#12 0x00000000004a02f5 in ps_write_user (mod_data=<optimized out>, key=0x7ffff7fd6878
"lq1a5due6hkmutv0tnqg0m95s3", val=0x65844d "", vallen=0)
at /usr/src/debug/php-5.5.18/ext/session/mod_user.c:157
#13 0x0000000000498228 in php_session_save_current_state () at
/usr/src/debug/php-5.5.18/ext/session/session.c:544
#14 0x0000000000498846 in php_session_flush () at
/usr/src/debug/php-5.5.18/ext/session/session.c:1619
#15 zm_deactivate_session (type=<optimized out>, module_number=<optimized out>) at
/usr/src/debug/php-5.5.18/ext/session/session.c:2348
#16 0x000000000059d934 in zend_deactivate_modules () at
/usr/src/debug/php-5.5.18/Zend/zend_API.c:2433
#17 0x0000000000536645 in php_request_shutdown (dummy=dummy@entry=0x0) at
/usr/src/debug/php-5.5.18/main/main.c:1777
#18 0x000000000064792a in do_cli (argc=1, argv=0x998e30) at
/usr/src/debug/php-5.5.18/sapi/cli/php_cli.c:1177
#19 0x0000000000421a60 in main (argc=1, argv=0x998e30) at
/usr/src/debug/php-5.5.18/sapi/cli/php_cli.c:1378
------------------------------------------------------------------------
The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
https://bugs.php.net/bug.php?id=68348
--
Edit this bug report at https://bugs.php.net/bug.php?id=68348&edit=1