|
|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
[2010-07-21 15:50 UTC] miroslav dot zacek at skype dot net
Description:
------------
In the ext/pgsql.c pgsql_globals->notices structure is allocated as persistent but individual messages non persistent. Thus the destructor _php_pgsql_notice_ptr_dtor happens to try to free memory that was already freed by the garbage collector and the thread exits with segmentation fault. Program received signal SIGSEGV, Segmentation fault. 0x00007ffff3cd3013 in _zend_mm_free_int (heap=0x7ffff844b5c0, p=0x7ffff9397390) at /usr/src/php_no_suhosin/php5-5.3.2/Zend/zend_alloc.c:2018 2018 if (ZEND_MM_IS_FREE_BLOCK(next_block)) { (gdb) backtrace #0 0x00007ffff3cd3013 in _zend_mm_free_int (heap=0x7ffff844b5c0, p=0x7ffff9397390) at /usr/src/php_no_suhosin/php5-5.3.2/Zend/zend_alloc.c:2018 #1 0x00007ffff3cd3de1 in _efree (ptr=0x7ffff9397390) at /usr/src/php_no_suhosin/php5-5.3.2/Zend/zend_alloc.c:2351 #2 0x00007fffeb4d3419 in _php_pgsql_notice_ptr_dtor (ptr=0x7ffff9396708) at /tmp/pgsql/pgsql.c:841
Patchespgsql-fixed.diff (last revision 2010-10-18 10:53 UTC by jaromir dot dolecek at skype dot net)pgsql.patch (last revision 2010-07-21 13:51 UTC by miroslav dot zacek at skype dot net) Pull RequestsHistoryAllCommentsChangesGit/SVN commits
|
|||||||||||||||||||||||||||||||||||||
Copyright © 2001-2024 The PHP GroupAll rights reserved. |
Last updated: Mon Apr 29 18:01:30 2024 UTC |
The original description without the double encoding: In the ext/pgsql.c pgsql_globals->notices structure is allocated as persistent but individual messages non persistent. Thus the destructor _php_pgsql_notice_ptr_dtor happens to try to free memory that was already freed by the garbage collector and the thread exits with segmentation fault. Program received signal SIGSEGV, Segmentation fault. 0x00007ffff3cd3013 in _zend_mm_free_int (heap=0x7ffff844b5c0, p=0x7ffff9397390) at /usr/src/php_no_suhosin/php5-5.3.2/Zend/zend_alloc.c:2018 2018 if (ZEND_MM_IS_FREE_BLOCK(next_block)) { (gdb) backtrace #0 0x00007ffff3cd3013 in _zend_mm_free_int (heap=0x7ffff844b5c0, p=0x7ffff9397390) at /usr/src/php_no_suhosin/php5-5.3.2/Zend/zend_alloc.c:2018 #1 0x00007ffff3cd3de1 in _efree (ptr=0x7ffff9397390) at /usr/src/php_no_suhosin/php5-5.3.2/Zend/zend_alloc.c:2351 #2 0x00007fffeb4d3419 in _php_pgsql_notice_ptr_dtor (ptr=0x7ffff9396708) at /tmp/pgsql/pgsql.c:841Trigger script (must replace DBNAME and USER with proper info): <?php $c = pg_connect("host=localhost port=6001 dbname=DBNAME user=USER"); function nop() { } function trigger_notice() { global $c; $rv2 = pg_query($c, 'SELECT * FROM foo()'); } $rv = pg_query($c, 'CREATE OR REPLACE FUNCTION foo() RETURNS integer AS $$ BEGIN RAISE NOTICE \'foo\'; RETURN 3; END $$ LANGUAGE \'plpgsql\' VOLATILE'); session_set_save_handler('nop', 'nop', 'nop', 'trigger_notice', 'nop', 'nop'); session_start();The pgsql-fixed.diff patch results in a lot more core dumps for me than the original problem under FreeBSD. Seems to happen on any notice. == Oct 25 23:23:02 www3 kernel: pid 76489 (php), uid 80: exited on signal 6 (core dumped) Oct 25 23:23:03 www3 kernel: pid 76502 (php), uid 80: exited on signal 6 (core dumped) Oct 25 23:23:13 www3 kernel: pid 76483 (php), uid 80: exited on signal 6 (core dumped) Oct 25 23:23:15 www3 kernel: pid 76503 (php), uid 80: exited on signal 6 (core dumped) Oct 25 23:23:22 www3 kernel: pid 76485 (php), uid 80: exited on signal 6 (core dumped) Oct 25 23:23:22 www3 kernel: pid 76487 (php), uid 80: exited on signal 6 (core dumped) Oct 25 23:23:38 www3 kernel: pid 76506 (php), uid 80: exited on signal 6 (core dumped) Oct 25 23:23:45 www3 kernel: pid 76511 (php), uid 80: exited on signal 6 (core dumped) Oct 25 23:23:46 www3 kernel: pid 76515 (php), uid 80: exited on signal 6 (core dumped) Oct 25 23:23:51 www3 kernel: pid 76508 (php), uid 80: exited on signal 6 (core dumped) Oct 25 23:23:52 www3 kernel: pid 76513 (php), uid 80: exited on signal 6 (core dumped) Oct 25 23:24:04 www3 kernel: pid 76521 (php), uid 80: exited on signal 6 (core dumped) Oct 25 23:24:07 www3 kernel: pid 76525 (php), uid 80: exited on signal 6 (core dumped) Oct 25 23:24:09 www3 kernel: pid 76522 (php), uid 80: exited on signal 6 (core dumped) Oct 25 23:24:10 www3 kernel: pid 76526 (php), uid 80: exited on signal 6 (core dumped) Oct 25 23:24:16 www3 kernel: pid 76520 (php), uid 80: exited on signal 6 (core dumped) Oct 25 23:24:23 www3 kernel: pid 76527 (php), uid 80: exited on signal 6 (core dumped) == == www3# gdb /usr/local/bin/php php.core GNU gdb 6.1.1 [FreeBSD] Copyright 2004 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "amd64-marcel-freebsd"... Core was generated by `php'. Program terminated with signal 6, Aborted. Reading symbols from /lib/libcrypt.so.3...done. Loaded symbols for /lib/libcrypt.so.3 Reading symbols from /lib/libz.so.3...done. Loaded symbols for /lib/libz.so.3 Reading symbols from /usr/local/pgsql/lib/libpq.so.5...done. Loaded symbols for /usr/local/pgsql/lib/libpq.so.5 Reading symbols from /lib/libm.so.4...done. Loaded symbols for /lib/libm.so.4 Reading symbols from /usr/local/lib/libxml2.so.5...done. Loaded symbols for /usr/local/lib/libxml2.so.5 Reading symbols from /usr/local/lib/libiconv.so.3...done. Loaded symbols for /usr/local/lib/libiconv.so.3 Reading symbols from /lib/libc.so.6...done. Loaded symbols for /lib/libc.so.6 Reading symbols from /lib/libpthread.so.2...done. Loaded symbols for /lib/libpthread.so.2 Reading symbols from /libexec/ld-elf.so.1...done. Loaded symbols for /libexec/ld-elf.so.1 #0 0x00000008012990bc in kill () from /lib/libc.so.6 [New LWP 100277] (gdb) bt #0 0x00000008012990bc in kill () from /lib/libc.so.6 #1 0x0000000801297f4d in abort () from /lib/libc.so.6 #2 0x0000000801231025 in _UTF8_init () from /lib/libc.so.6 #3 0x000000080123105c in _UTF8_init () from /lib/libc.so.6 #4 0x0000000801231ffd in _UTF8_init () from /lib/libc.so.6 #5 0x00000000004a6431 in _php_pgsql_notice_ptr_dtor (ptr=0x12ada) at /usr/home/max/tmp/php-5.2.14/ext/pgsql/pgsql.c:397 #6 0x00000000005b13e2 in _zend_hash_index_update_or_next_insert (ht=0x85b928, h=4, pData=0x7fffffff7d78, nDataSize=8, pDest=0x0, flag=76482) at /usr/home/max/tmp/php-5.2.14/Zend/zend_hash.c:374 #7 0x00000000004a63be in _php_pgsql_notice_handler (resource_id=0x4, message=0xa15e00 "WARNING: nonstandard use of \\\\ in a string literal\nLINE 1: ...id AND n.id=p.groupid ORDER BY similarity(r.name, 'SECRET_WE...\n", ' ' <repeats 61 times>, "^\nHINT: Use"...) at /usr/home/max/tmp/php-5.2.14/ext/pgsql/pgsql.c:384 #8 0x0000000800b6d09a in pqGetErrorNotice3 () from /usr/local/pgsql/lib/libpq.so.5 #9 0x0000000800b6d66a in pqParseInput3 () from /usr/local/pgsql/lib/libpq.so.5 #10 0x0000000800b65d0f in PQgetResult () from /usr/local/pgsql/lib/libpq.so.5 #11 0x0000000800b65ece in PQgetResult () from /usr/local/pgsql/lib/libpq.so.5 #12 0x00000000004a806a in zif_pg_query (ht=76506, return_value=0x8978f0, return_value_ptr=0x12ac2, this_ptr=0x8012990dc, return_value_used=-2138572576) at /usr/home/max/tmp/php-5.2.14/ext/pgsql/pgsql.c:1178 #13 0x00000000005c5e3c in zend_do_fcall_common_helper_SPEC (execute_data=0x7fffffff81b0) at zend_vm_execute.h:200 #14 0x00000000005c577f in execute (op_array=0xa19c00) at zend_vm_execute.h:92 #15 0x00000000005c5a3c in zend_do_fcall_common_helper_SPEC (execute_data=0x7fffffff9f50) at zend_vm_execute.h:234 #16 0x00000000005c577f in execute (op_array=0xa59360) at zend_vm_execute.h:92 #17 0x00000000005c5a3c in zend_do_fcall_common_helper_SPEC (execute_data=0x7fffffffb190) at zend_vm_execute.h:234 #18 0x00000000005c577f in execute (op_array=0x8858f8) at zend_vm_execute.h:92 #19 0x00000000005a7778 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /usr/home/max/tmp/php-5.2.14/Zend/zend.c:1134 #20 0x00000000005669e6 in php_execute_script (primary_file=0x7fffffffed00) at /usr/home/max/tmp/php-5.2.14/main/main.c:2036 #21 0x00000000006352e7 in main (argc=1, argv=0x7fffffffedc8) at /usr/home/max/tmp/php-5.2.14/sapi/cgi/cgi_main.c:1999 ==