#31048 [Fbk->Opn]: PHP crashes if fpassthru() is used along with fseek()

ID: 31048 User updated by: john dot wellesz at teaser dot fr Reported By: john dot wellesz at teaser dot fr -Status: Feedback +Status: Open Bug Type: Reproducible crash Operating System: FreeBSD 4.9 STABLE and WINXPSP2 PHP Version: 5.0.2 New Comment: OK, The bug doesn't happen in php 5.0.3 (at least on windows XP sp2). I've been able to generate a core dump but without the --enable-debug parameter, plus I've made a kdump. First the kdump (I've called ob_start() just before the call to fpassthru() since it didn't change anything and make the trace shorter): ktrace is launched just before the line: "$handle = fopen($loginfo, "rb");" ------------Kdump Result: 67985 php RET read 0 67985 php CALL close(0x3) 67985 php RET close 0 67985 php CALL wait4(0x10994,0xbfbfd9dc,0,0) 67985 php RET wait4 67988/0x10994 67985 php CALL nanosleep(0xbfbfdab8,0xbfbfdab0) 67985 php RET nanosleep 0 67985 php CALL __getcwd(0xbfbfd5d0,0x400) 67985 php RET __getcwd 0 67985 php CALL lstat(0xbfbfd180,0xbfbfd0d0) 67985 php NAMI "/home" 67985 php RET lstat 0 67985 php CALL lstat(0xbfbfd180,0xbfbfd0d0) 67985 php NAMI "/home/_j2" 67985 php RET lstat 0 67985 php CALL lstat(0xbfbfd180,0xbfbfd0d0) 67985 php NAMI "/home/_j2/j2072" 67985 php RET lstat 0 67985 php CALL lstat(0xbfbfd180,0xbfbfd0d0) 67985 php NAMI "/home/_j2/j2072/pub" 67985 php RET lstat 0 67985 php CALL lstat(0xbfbfd180,0xbfbfd0d0) 67985 php NAMI "/home/_j2/j2072/pub/www.2072productions.com" 67985 php RET lstat 0 67985 php CALL lstat(0xbfbfd180,0xbfbfd0d0) 67985 php NAMI "/home/ _j2/j2072/pub/www.2072productions.com/fpassthru_crash_test_file" 67985 php RET lstat 0 67985 php CALL open(0x8205e8c,0,0x1b6) 67985 php NAMI "/home/ _j2/j2072/pub/www.2072productions.com/fpassthru_crash_test_file" 67985 php RET open 3 67985 php CALL fstat(0x3,0x817892c) 67985 php RET fstat 0 67985 php CALL lseek(0x3,0,0,0,0x1) 67985 php RET lseek 0 67985 php CALL lseek(0x3,0,0x30d40,0,0) 67985 php RET lseek 200000/0x30d40 67985 php CALL break(0x8222000) 67985 php RET break 0 67985 php CALL fstat(0x3,0x817892c) 67985 php RET fstat 0 67985 php CALL mmap(0,0x493e3,0x1,0x1,0x3,0,0x30d40,0) 67985 php RET mmap 677834048/0x2866ed40 67985 php CALL break(0x826e000) 67985 php RET break 0 67985 php PSIG SIGBUS SIG_DFL 67985 php NAMI "/var/cores/php" ------------Now the result of GDB: #0 0x284212a6 in memcpy () from /usr/lib/libc.so.4 (gdb) #0 0x284212a6 in memcpy () from /usr/lib/libc.so.4 Cannot access memory at address 0xbfbfba2c. (gdb) I can't do better, I hope this will be sufficient :-) Previous Comments: ------------------------------------------------------------------------ [2004-12-14 02:18:24] wez@php.net Thank you for this bug report. To properly diagnose the problem, we need a backtrace to see what is happening behind the scenes. To find out how to generate a backtrace, please read http://bugs.php.net/bugs-generating-backtrace.php Once you have generated a backtrace, please submit it to this bug report and change the status back to "Open". Thank you for helping us make PHP better. Read the link; it tells you how to make a backtrace; without one we can't fix the bug. ------------------------------------------------------------------------ [2004-12-13 20:21:27] john dot wellesz at teaser dot fr Your Bug Report script split lines so the code I provided will only make syntax errors (commented lines are split). So here is the uncommented code: <?php $loginfo="fpassthru_crash_test_file"; touch($loginfo); $handle=fopen($loginfo, "r+b"); ftruncate($handle,0); fseek($handle, 300000, SEEK_END); fwrite($handle,"END"); fclose($handle); $handle=fopen($loginfo, "rb"); fseek($handle, 200000, SEEK_SET); fpassthru($handle); ?> I hope you'll be able to reproduce it :-) ------------------------------------------------------------------------ [2004-12-10 18:36:05] john dot wellesz at teaser dot fr Do you mean that the code provided doesn't make your PHP 5.0.2 to crash? If yes, then try to increase the size of the test file ("fpassthru_crash_test_file") to 2Mb. You can also try to increase the position of the file pointer. The problem looks like a buffer overflow... I'm not a PHP developper, I don't have the tools needed to make the backtrace, I don't have admin access to the machine running under FreeBSD 4.9... And doing it under winXPSP2 will take hours of my time (if ever it is possible), whereas it would take at most 15 minutes for a PHP developper who already have have all the tools needed. Thank you. ------------------------------------------------------------------------ [2004-12-10 09:13:10] derick@php.net Thank you for this bug report. To properly diagnose the problem, we need a backtrace to see what is happening behind the scenes. To find out how to generate a backtrace, please read http://bugs.php.net/bugs-generating-backtrace.php Once you have generated a backtrace, please submit it to this bug report and change the status back to "Open". Thank you for helping us make PHP better. ------------------------------------------------------------------------ [2004-12-10 02:39:53] john dot wellesz at teaser dot fr Description: ------------ The bug I'm about to describe happens on Windows XP SP2 and freeBSD 4.9 STABLE and probably other platforms (I'm currently using PHP 5.0.2 on both). My 2 php (winXP and FreeBSD) run as CGI, the crashes also happens if I execute my script on command line. Modules used is probably irrelevant (and futile?), I use 2 PHP, one on FreeBSD and the other on winXP compiled on totally different way with not the same modules... (tell me if you can't reproduce the crash, i'll provide more info). ---------------- BUG REQUIREMENTS: --> You must have a file of at least 300Kb in size (200Kb won't make PHP to crash) --> You must have set the file pointer with fseek at 200,000 bytes (other values may not produce the bug) from the beginning of the file. --> You must call fpassthru() to print the rest of the file. Reproduce code: --------------- <?php //test file path $loginfo="fpassthru_crash_test_file"; //create the file; touch($loginfo); //allocate ~300000 bytes in the files (the file will make 300003 bytes) $handle=fopen($loginfo, "r+b"); ftruncate($handle,0); fseek($handle, 300000, SEEK_END); fwrite($handle,"END"); fclose($handle); //Open it for reading $handle=fopen($loginfo, "rb"); fseek($handle, 200000, SEEK_SET);//the 200000 is important, other values may not trigger the bug fpassthru($handle); ?> Expected result: ---------------- PHP should print the file till the end, we should see "END"... Actual result: -------------- PHP displays the file till the 98304th byte and crashes with a bus error (Signal 10). ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=31048&edit=1