php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #72801 apcu crashes (SIGSEGV) php/Apache on memory allocation failures
Submitted: 2016-08-10 11:28 UTC Modified: 2016-10-14 14:35 UTC
Votes:4
Avg. Score:4.8 ± 0.4
Reproduced:4 of 4 (100.0%)
Same Version:3 (75.0%)
Same OS:0 (0.0%)
From: jaromird at microsoft dot com Assigned: krakjoe (profile)
Status: Closed Package: Reproducible crash
PHP Version: 7.0.9 OS: Mac OS X
Private report: No CVE-ID: None
 [2016-08-10 11:28 UTC] jaromird at microsoft dot com
Description:
------------
Started seeing more frequent Apache crashes after upgrade to PHP 7.0 for one of our applications which makes heavy use of apc cache. After investigation, found a reproduction script to trigger segmentation fault eventually.

Late apcu code inspection revealed that code doesn't check for memory allocation failures on many places. Typical case for example: string duplication fails in apcu_store(), code then inserts zval with NULL value into cache, then apcu_fetch() crashes when dereferencing the value.

I hope I've covered all necessary places in the patch, but surely would suggest close review. So far only the case triggered by the below test is really tested.

Test script:
---------------
<?php

/*
Might need tweaking to trigger the memory allocation failure

ini settings:
memory_limit = 4512M
apcu shared memory size default - 128M
*/

$f = str_repeat('c', 800 * 1024 * 1024 );

apcu_store('aaa', $f, 5);

$s = apcu_fetch('aaa');

echo ($s == $f) ? "same" : "different";


Expected result:
----------------
script running to completion, returning "same" if no memory problem, "different" if memory allocation failure in apc_fetch()

Actual result:
--------------
Segmentation fault: 11


Patches

patch-apc_cache.c (last revision 2016-08-10 11:28 UTC by jaromird at microsoft dot com)

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2016-08-10 11:29 UTC] jaromird at microsoft dot com
Tested with apcu 5.1.5
 [2016-08-10 12:03 UTC] nikic@php.net
-Assigned To: +Assigned To: krakjoe
 [2016-08-10 12:03 UTC] nikic@php.net
Not seeing apcu in the package list, so assigning this to joe directly.
 [2016-09-29 09:49 UTC] krakjoe@php.net
-Status: Assigned +Status: Closed
 [2016-09-29 09:49 UTC] krakjoe@php.net
The fix for this bug has been committed.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.

 For Windows:

http://windows.php.net/snapshots/
 
Thank you for the report, and for helping us make PHP better.

Sorry about the delay, thanks for the patch ;)
 [2016-10-14 14:28 UTC] jaromird at microsoft dot com
Was the fix actually applied? Don't see anything relevant in the github repo
 [2016-10-14 14:35 UTC] requinix@php.net
And the fix is present as of v5.1.6, which was released last week.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Fri Apr 19 18:01:28 2024 UTC