Re: Bug #44872 canary mismatch on efree() - heap overflow detected
| From: | Krister Karlström | Date: | Wed, 15 Oct 2008 07:53:02 +0000 |
| Subject: | Re: Bug #44872 canary mismatch on efree() - heap overflow detected | ||
| References: | 1 2 3 4 5 6 7 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-41049@lists.php.net to get a copy of this message | ||
Hi again,
run the same sample script with PHP 5.2.6 configured with --disable-all --enable-debug --with-mssql on the Ubuntu Hardy machine. I did exactly the same things on both the Slackware server and the Ubuntu, the output and expected result was though different:
Here's PHP:s output on Ubnuntu Hardy 8.0.4 with PHP 5.2.6:
[Wed Oct 15 10:20:52 2008] Script: '/var/www/asta/testcases/TestMsSQL.php'
---------------------------------------
/home/karlstrk/php-5.2.6/Zend/zend_variables.h(35) : Block 0x08317fcc status:
/home/karlstrk/php-5.2.6/Zend/zend_variables.c(36) : Actual location (location was relayed)
Beginning: OK (allocated on /home/karlstrk/php-5.2.6/ext/mssql/php_mssql.c:911, 25 bytes)
Start: OK
End: Overflown (magic=0x0000004D instead of 0x23024D91)
2 byte(s) overflown
---------------------------------------
[Wed Oct 15 10:20:52 2008] Script: '/var/www/asta/testcases/TestMsSQL.php'
---------------------------------------
/home/karlstrk/php-5.2.6/Zend/zend_variables.h(35) : Block 0x08318164 status:
/home/karlstrk/php-5.2.6/Zend/zend_variables.c(36) : Actual location (location was relayed)
Beginning: OK (allocated on /home/karlstrk/php-5.2.6/ext/mssql/php_mssql.c:911, 25 bytes)
Start: OK
End: Overflown (magic=0x0000004D instead of 0x23024D91)
2 byte(s) overflown
---------------------------------------
[Wed Oct 15 10:20:52 2008] Script: '/var/www/asta/testcases/TestMsSQL.php'
---------------------------------------
/home/karlstrk/php-5.2.6/Zend/zend_variables.h(35) : Block 0x083196a4 status:
/home/karlstrk/php-5.2.6/Zend/zend_variables.c(36) : Actual location (location was relayed)
Beginning: OK (allocated on /home/karlstrk/php-5.2.6/ext/mssql/php_mssql.c:911, 25 bytes)
Start: OK
End: Overflown (magic=0x0000004D instead of 0x23024D91)
2 byte(s) overflown
---------------------------------------
[Wed Oct 15 10:20:52 2008] Script: '/var/www/asta/testcases/TestMsSQL.php'
---------------------------------------
/home/karlstrk/php-5.2.6/Zend/zend_variables.h(35) : Block 0x08319878 status:
/home/karlstrk/php-5.2.6/Zend/zend_variables.c(36) : Actual location (location was relayed)
Beginning: OK (allocated on /home/karlstrk/php-5.2.6/ext/mssql/php_mssql.c:911, 25 bytes)
Start: OK
End: Overflown (magic=0x0000004D instead of 0x23024D91)
2 byte(s) overflown
---------------------------------------
[Wed Oct 15 10:20:52 2008] Script: '/var/www/asta/testcases/TestMsSQL.php'
---------------------------------------
/home/karlstrk/php-5.2.6/Zend/zend_variables.h(35) : Block 0x0831aa10 status:
/home/karlstrk/php-5.2.6/Zend/zend_variables.c(36) : Actual location (location was relayed)
Beginning: OK (allocated on /home/karlstrk/php-5.2.6/ext/mssql/php_mssql.c:911, 25 bytes)
Start: OK
End: Overflown (magic=0x0000004D instead of 0x23024D91)
2 byte(s) overflown
---------------------------------------
[Wed Oct 15 10:20:52 2008] Script: '/var/www/asta/testcases/TestMsSQL.php'
---------------------------------------
/home/karlstrk/php-5.2.6/Zend/zend_variables.h(35) : Block 0x0831abf4 status:
/home/karlstrk/php-5.2.6/Zend/zend_variables.c(36) : Actual location (location was relayed)
Beginning: OK (allocated on /home/karlstrk/php-5.2.6/ext/mssql/php_mssql.c:911, 25 bytes)
Start: OK
End: Overflown (magic=0x0000004D instead of 0x23024D91)
2 byte(s) overflown
---------------------------------------
[Wed Oct 15 10:20:52 2008] Script: '/var/www/asta/testcases/TestMsSQL.php'
---------------------------------------
/home/karlstrk/php-5.2.6/Zend/zend_variables.h(35) : Block 0x0831af50 status:
/home/karlstrk/php-5.2.6/Zend/zend_variables.c(36) : Actual location (location was relayed)
Beginning: OK (allocated on /home/karlstrk/php-5.2.6/ext/mssql/php_mssql.c:911, 25 bytes)
Start: OK
End: Overflown (magic=0x0000004D instead of 0x23024D91)
2 byte(s) overflown
---------------------------------------
[Wed Oct 15 10:20:52 2008] Script: '/var/www/asta/testcases/TestMsSQL.php'
---------------------------------------
/home/karlstrk/php-5.2.6/Zend/zend_variables.h(35) : Block 0x0831b124 status:
/home/karlstrk/php-5.2.6/Zend/zend_variables.c(36) : Actual location (location was relayed)
Beginning: OK (allocated on /home/karlstrk/php-5.2.6/ext/mssql/php_mssql.c:911, 25 bytes)
Start: OK
End: Overflown (magic=0x0000004D instead of 0x23024D91)
2 byte(s) overflown
---------------------------------------
[Wed Oct 15 10:20:52 2008] Script: '/var/www/asta/testcases/TestMsSQL.php'
---------------------------------------
/home/karlstrk/php-5.2.6/Zend/zend_variables.h(35) : Block 0x0831b2f4 status:
/home/karlstrk/php-5.2.6/Zend/zend_variables.c(36) : Actual location (location was relayed)
Beginning: OK (allocated on /home/karlstrk/php-5.2.6/ext/mssql/php_mssql.c:911, 25 bytes)
Start: OK
End: Overflown (magic=0x0000004D instead of 0x23024D91)
2 byte(s) overflown
---------------------------------------
[Wed Oct 15 10:20:52 2008] Script: '/var/www/asta/testcases/TestMsSQL.php'
---------------------------------------
/home/karlstrk/php-5.2.6/Zend/zend_variables.h(35) : Block 0x0831b7e0 status:
/home/karlstrk/php-5.2.6/Zend/zend_variables.c(36) : Actual location (location was relayed)
Beginning: OK (allocated on /home/karlstrk/php-5.2.6/ext/mssql/php_mssql.c:911, 25 bytes)
Start: OK
End: Overflown (magic=0x0000004D instead of 0x23024D91)
2 byte(s) overflown
---------------------------------------
[Wed Oct 15 10:20:52 2008] Script: '/var/www/asta/testcases/TestMsSQL.php'
/home/karlstrk/php-5.2.6/ext/mssql/php_mssql.c(911) : Freeing 0x08317FCC (25 bytes), script=/var/www/asta/testcases/TestMsSQL.php
Last leak repeated 9 times
=== Total 10 memory leaks detected ===
It reports 10 memory leaks..? I'm also gonna run this though valgrind, need to install it on this machine first...
/Krister Karlström
Ilia Alshanetsky wrote:
Can you try to compile PHP with --disable-all --enable-debug and a flag for the mssql extension, then try to run valgrind. From the output it seems there maybe errors in dl() library. On 14-Oct-08, at 4:15 AM, Krister Karlström wrote:-- * Ing. Krister Karlström, Zend Certified Engineer * * Systemutvecklare, IT-Centralen * * Arcada - Nylands Svenska Yrkeshögskola * * Jan-Magnus Janssons plats 1, 00550 Helsingfors, Finland * * Tel: +358(20)7699699 GSM: +358(50)5328390 * * E-mail: krister.karlstrom@arcada.fi *Hi, I run the script on a server in our production environment, a slackware server with a self compiled PHP from source. The PHP version was 5.2.5. php-v gives the following: PHP 5.2.5 (cli) (built: Mar 28 2008 12:02:55) Copyright (c) 1997-2007 The PHP Group Zend Engine v2.2.0, Copyright (c) 1998-2007 Zend Technologies I found the problem on a development server which was running Ubuntu and apperently also the Suhosin patch (the latest available packet from Ubuntu). /Krister Karlström Pierre Joye wrote:hi, On Tue, Oct 14, 2008 at 8:46 AM, Krister Karlström <krister.karlstrom@arcada.fi> wrote:About this bug #44872, I run my small sample script (posted on the bug reporting page) through valgrind and got the attached output. I'm not sure whether this shows that there's a leak in the mssql extension or if this is normal. Valgrind said that 853 bytes where definitely lost, does this mean that there is a memory leak? Hopefully someone who is better to analyze valgrinds output than me can tell the answer... Here's the full output from valgrind:That's exactly why it is not as easy that some may say. This report shows the (expected sometimes) warnings with dl and something related to the SNMP extension. The scripts in the bug report were using mysqli and mssql, with all kind of possible extensions (zend optimizer, debugger, etc.) and patches applied. Did you run it using a self compiled php? Which version? Cheers,