#20927 [Opn]: Crash inside libpq (PQexec) with PHP > 4.1.2

ID: 20927 User updated by: dfs@roaringpenguin.com Reported By: dfs@roaringpenguin.com Status: Open Bug Type: PostgreSQL related Operating System: Red Hat Linux 8.0 on Intel PHP Version: 4.3.0RC2 New Comment: More info: Under Solaris 8 on SPARC, Apache 1.3.27 and PHP 4.2.3, it works fine. Probably, Solaris's libc has different malloc strategy so the bug is not triggered. I recompiled Apache, PHP and libpq so everything was statically linked in a single http executable. Segfaulted. Ran it under valgrind (http://developer.kde.org/~sewardj/) and it worked perfectly. :-( Next, converted the script to a CGI, and installed stand-alone versions of php-4.2.3 and php-4.1.2. The cgi crashed with php-4.2.3, but worked fine with php-4.1.2. (Same Apache server in each case.) Therefore, I believe this is a hard-to-find memory corruption bug. :-( (To do the CGI test, copy showtrap.php to showtrap.cgi and add the appropriate #! line at the beginning, fix permissions, etc.) Previous Comments: ------------------------------------------------------------------------ [2002-12-11 10:36:28] dfs@roaringpenguin.com Hi, I've tried the following versions of libpq: 7.2.2 7.2.3 7.3.0 They all exhibit the same behaviour. The default version that comes with RH8.0 is 7.2.2. Thanks, David. ------------------------------------------------------------------------ [2002-12-11 10:35:04] sesser@php.net Uhmm I should read better... What versions of libpq do you use with 4.1.2 and 4.2.x? ------------------------------------------------------------------------ [2002-12-11 10:34:38] dfs@roaringpenguin.com Then how do you explain the crash in Apache 1.3.27? It is a PHP bug for sure, because changing PHP versions is the only thing which makes it go away. ------------------------------------------------------------------------ [2002-12-11 10:32:10] sesser@php.net It crashs with PHP 4.2.2 because it runs in Apache 2. The PSQL lib ist most probably not thread safe. ------------------------------------------------------------------------ [2002-12-11 09:55:43] dfs@roaringpenguin.com I disagree. The bug *IS* in PHP, not libpq. The reason I assert this is as follows: - I tried Apache 1.3.27, 2.0.40 and 2.0.43 with libraries from PostgreSQL 7.2.2, 7.2.3 and 7.3, and PHP 4.2.2, 4.2.3 and PHP 4.3.0RC2. ALL combinations crashed reliably. With PHP 4.1.2, I am *unable* to get a crash. Something in PHP is corrupting memory, and later on, malloc() is failing. I use the same libpq library with Perl and Tcl, and have never yet had a segfault. For more info, here's a stack trace for Red Hat 8.0 with Red Hat's version of Apache (2.0.40) and Red Hat's PHP (4.2.2). Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 8192 (LWP 3305)] 0x42073d65 in _int_malloc () from /lib/i686/libc.so.6 (gdb) bt #0 0x42073d65 in _int_malloc () from /lib/i686/libc.so.6 #1 0x42073155 in malloc () from /lib/i686/libc.so.6 #2 0x4051881b in completed.1 () from /etc/httpd/modules/libphp4.so #3 0x405c5cb1 in completed.1 () from /etc/httpd/modules/libphp4.so #4 0x405c5fe1 in completed.1 () from /etc/httpd/modules/libphp4.so #5 0x405c615e in completed.1 () from /etc/httpd/modules/libphp4.so #6 0x40522efc in completed.1 () from /etc/httpd/modules/libphp4.so #7 0x40522c6d in completed.1 () from /etc/httpd/modules/libphp4.so #8 0x40522c6d in completed.1 () from /etc/httpd/modules/libphp4.so #9 0x40522c6d in completed.1 () from /etc/httpd/modules/libphp4.so #10 0x4052f6b6 in completed.1 () from /etc/httpd/modules/libphp4.so #11 0x4053df7a in completed.1 () from /etc/httpd/modules/libphp4.so #12 0x4053a7bd in completed.1 () from /etc/httpd/modules/libphp4.so #13 0x0807169c in ap_pass_brigade () #14 0x08078e27 in default_handler () #15 0x08065bf5 in ap_run_handler () #16 0x0806620d in ap_invoke_handler () #17 0x080629c6 in ap_process_request () #18 0x0805e0ac in ap_process_http_connection () #19 0x0806f0d5 in ap_run_process_connection () #20 0x08064238 in child_main () #21 0x0806445a in make_child () #22 0x080644b6 in startup_children () #23 0x08064cdf in ap_mpm_run () #24 0x0806ac5f in main () #25 0x420158d4 in __libc_start_main () from /lib/i686/libc.so.6 ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at http://bugs.php.net/20927 -- Edit this bug report at http://bugs.php.net/?id=20927&edit=1