|
|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
[2008-04-30 17:19 UTC] mattr at shoplet dot com
Description:
------------
The execution of the attached script halts unexpectedly with "ALERT - canary mismatch on efree() - heap overflow detected (attacker 'REMOTE_ADDR not set', file '../library/Zend/Db/Statement/Mysqli.php', line 113)" in the apache error log.
PHP Info:
-----------------------
PHP Version => 5.2.5
System => FreeBSD localhost 6.2-RELEASE FreeBSD 6.2-RELEASE #0: Fri Jan 12 11:05:30 UTC 2007 root@dessler.cse.buff
alo.edu:/usr/obj/usr/src/sys/SMP i386
Configure Command => './configure' '--with-layout=GNU' '--with-config-file-scan-dir=/usr/local/etc/php' '--disable-all' '--e
nable-libxml' '--with-libxml-dir=/usr/local' '--enable-reflection' '--program-prefix=' '--enable-fastcgi' '--with-apxs=/usr/lo
cal/sbin/apxs' '--with-regex=php' '--with-zend-vm=CALL' '--enable-debug' '--enable-zend-multibyte' '--prefix=/usr/local' '--ma
ndir=/usr/local/man' '--infodir=/usr/local/info/'
PHP API => 20041225
PHP Extension => 20060613
Zend Extension => 220060519
Debug Build => yes
Thread Safety => disabled
Zend Memory Manager => enabled
IPv6 Support => enabled
This server is protected with the Suhosin Patch 0.9.6.2
Copyright (c) 2006 Hardened-PHP Project
-----------------------
Script fails on another machine running Debian 4 in the same reproducible manner with and without the Suhosin patch.
Reproduce code:
---------------
#!/usr/local/bin/php
<?php
set_include_path('../library/'. PATH_SEPARATOR . '../application/lib/' . PATH_SEPARATOR . get_include_path());
require_once('Zend/Db.php');
// Zend Db classes can be found here: http://framework.zend.com
// Can attach to the ticket later if needed.
date_default_timezone_set('America/New_York');
$db = Zend_Db::factory('mysqli',Array('host'=>'localhost','username'=>'','password'=>'','dbname'=>'eproc'));
$order_num = 1208212550;
$sql = $db->quoteInto("SELECT * FROM `eproc`.`Orders` WHERE `order_num`=? LIMIT 1",$order_num);
$q = $db->fetchAll($sql);
$batch_status = $db->fetchOne("SELECT `to_po` FROM `eproc2`.`batch_status` WHERE `status`='done' ORDER BY `to_po` DESC LIMIT 1");
$items = $db->fetchAll("SELECT * FROM `eproc`.`Order_Item` WHERE `order_num`='{$order_num}' ORDER BY `line_num` ASC");
$notes = $db->fetchAll("SELECT * FROM `eproc`.`notes` WHERE `order_num`='{$order_num}' ORDER BY `sticky` DESC, `date_modified` ASC");
$emails = $db->fetchAll("SELECT `message_id`,`from_email`,`to_email`,`subject`,`date_received` FROM `email_store`.`email` WHERE `order_num`='{$order_num}' ORDER BY `date_received` ASC");
$attachments = $db->fetchAll("SELECT * FROM `files`.`order_attachments` WHERE `order_num`='{$order_num}' ORDER BY `timestampAdded` ASC");
print_r($q);
print_r($order_id);
print_r($batch_status);
print_r($items);
print_r($notes);
print_r($emails);
print_r($attachments);
Expected result:
----------------
Several Arrays of database results
Actual result:
--------------
Execution:
[Wed Apr 30 12:45:01 2008] Script: './index.php'
---------------------------------------
/usr/ports/lang/php5/work/php-5.2.5/Zend/zend_opcode.c(238) : Block 0x0828d0e0 status:
Invalid pointer: ((prev=0x00000045) != (prev.size=0x00000000))
---------------------------------------
[Wed Apr 30 12:45:01 2008] Script: './index.php'
---------------------------------------
/usr/ports/lang/php5/work/php-5.2.5/Zend/zend_variables.h(35) : Block 0x0828d09c status:
/usr/ports/lang/php5/work/php-5.2.5/Zend/zend_variables.c(36) : Actual location (location was relayed)
Invalid pointer: ((size=0x00000000) != (next.prev=0x0000003d))
---------------------------------------
[Wed Apr 30 12:45:01 2008] Script: './index.php'
/usr/ports/databases/php5-mysqli/work/php-5.2.5/ext/mysqli/mysqli_api.c(362) : Freeing 0x0828D060 (0 bytes), script=./index.php
zend_mm_heap corrupted
Segmentation fault (core dumped)
Backtrace:
#0 0x28583ecb in kill () from /lib/libc.so.6
#1 0x08150f51 in zend_mm_panic (message=0x8252700 "zend_mm_heap corrupted")
at /usr/ports/lang/php5/work/php-5.2.5/Zend/zend_alloc.c:94
#2 0x08151ef5 in zend_mm_find_leaks (segment=0x827e000, b=0x828d02c)
at /usr/ports/lang/php5/work/php-5.2.5/Zend/zend_alloc.c:1223
#3 0x08152070 in zend_mm_check_leaks (heap=0x827d400) at /usr/ports/lang/php5/work/php-5.2.5/Zend/zend_alloc.c:1277
#4 0x08152aaf in zend_mm_shutdown (heap=0x827d400, full_shutdown=0, silent=0)
at /usr/ports/lang/php5/work/php-5.2.5/Zend/zend_alloc.c:1632
#5 0x08154a76 in shutdown_memory_manager (silent=0, full_shutdown=0)
at /usr/ports/lang/php5/work/php-5.2.5/Zend/zend_alloc.c:2553
#6 0x0812479b in php_request_shutdown (dummy=0x0) at /usr/ports/lang/php5/work/php-5.2.5/main/main.c:1510
#7 0x081d7677 in main (argc=2, argv=0xbfbfeca0) at /usr/ports/lang/php5/work/php-5.2.5/sapi/cli/php_cli.c:1327
PatchesPull RequestsHistoryAllCommentsChangesGit/SVN commits
|
|||||||||||||||||||||||||||||||||||||
Copyright © 2001-2025 The PHP GroupAll rights reserved. |
Last updated: Thu Oct 30 22:00:01 2025 UTC |
php version = 5.2.4-2ubuntu5.3 I am getting this same problem with the following bit of code //class I wrote to make doing things on a remote machine easier $ssh->init($server, $port, $username, $password); $command = "if [ -d '$path' ]; then echo \"true\"; else echo \"false\"; fi 2> /dev/null"; //this executes the command above on the remote and gathers a true or false answer form the ssh stream $answer = $ssh->execute_return($command); //this line is where it barfes all over the memory if ($answer === "true\n"){ return true; } else { return false; }I'm experiencing the same bug using PHP 5.2.4-2ubuntu5.3 with Suhosin-Patch 0.9.6.2 (cli) on a Ubuntu Hardy 8.0.4 server. The following simplified example shows the problem, the last echo row is not executed because of mssql_free_result() fails: <?php $link = mssql_connect('xxxx.xx', 'xxx', 'xxxx'); if(is_resource($link)) { if(mssql_select_db('kursbok', $link)) { $result = mssql_query('select * from Utbildningsprogram order by up_nr'); if(is_resource($result)) { $obj = mssql_fetch_object($result); echo $obj->up_nr."\n"; mssql_free_result($result); } } } echo "Here I am - NOT!"; ?> OUTPUT ================================================================== 201000 ALERT - canary mismatch on efree() - heap overflow detected (attacker 'REMOTE_ADDR not set', file '/var/www/xxxx/TestMsSQL.php', line 16)I have the same error when running certain queries with mssql_query(). There seems to be no way to predict which queries will run and which fail - although if a query fails it always fails and if it runs then it alway runs. The more complex the query, the more likely to fail. I am running PHP Version 5.2.4-2ubuntu5.5 with Suhosin Patch 0.9.6.2. Example code that trips the switch: $dbhandle = mssql_connect($myServer, $myUser, $myPass); $selected = mssql_select_db($myDB, $dbhandle); $query = "SELECT * FROM sims.curr_group INNER JOIN sims.curr_class_period ON sims.curr_group.base_group_id = sims.curr_class_period.base_group_id INNER JOIN sims.sims_person ON sims.sims_person.person_id = sims.curr_class_period.person_id WHERE (sims.curr_group.short_name = '9b/It1')"; $result = mssql_query($query); while($row = mssql_fetch_array($result)) { print_r($row); } //close the connection mssql_close($dbhandle);I also can reproduce this error (Suhosin Patch installed). Very simple test script: <?php $demo_user[]=(object)array("first" => 1); $demo_user[]=(object)array("second" => 2); $demo_user[]=(object)array("third" => 3); echo "<pre>"; var_dump($demo_user); echo "</pre>"; ?> Error Log: [Fri Aug 07 14:38:06 2009] [error] [client xx.xx.xx.xx] ALERT - canary mismatch on efree() - heap overflow detected (attacker 'xx.xx.xx.xx', file '/somedir/somedir/htdocs/f.php', line 2) Version Info: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.6 with Suhosin-Patch proxy_html/3.0.0 Server at xxxxxx Port 80I also tried the code suggested : <?php $demo_user[]=(object)array("first" => 1); $demo_user[]=(object)array("second" => 2); $demo_user[]=(object)array("third" => 3); echo "<pre>"; var_dump($demo_user); echo "</pre>"; ?> This doesnt trigger any error message here