|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
[2005-03-17 06:57 UTC] boro at fixel dot org
Description:
------------
I have Debian Sarge installed including Debian packaged Apache2 and PHP4 (4.3.10). I installed APC using Pear (pear install apc). APC was installed fine. I then added
extension=apc.so
apc.enabled = 1
apc.shm_segments = 2
apc.shm_size = 32
apc.gc_ttl = 3600
to my php.ini and restarted Apache. Apache seemed to start fine. I then tried to access a page made with PHP, but the Apache child which takes care of the request segfaults:
[Thu Mar 17 12:34:18 2005] [notice] child pid 7163 exit signal Segmentation fault (11)
Disabling APC makes it work again. I then used gdb to check one of the childs where it segfaults:
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread -1213722496 (LWP 7167)]
0xb713ed8d in my_copy_class_entry (dst=0xb5150e48, src=0x82924e8, allocate=0xb7141200 <apc_sma_malloc>)
at /root/APC-2.0.4/apc_compile.c:369
369 for (n = 0; src->builtin_functions[n].fname != NULL; n++) {}
I downloaded the source code of APC manually, run phpize and ./configure, removed -O2 optimization from Makefile and compiled & installed. Now APC worked.
I decided to try running Apache2 under Valgrind (when compiled with -O2) to check if there's some memory management problem, and got this:
==11930== Conditional jump or move depends on uninitialised value(s)
==11930== at 0x1CDACD80: my_copy_class_entry (apc_compile.c:366)
==11930== by 0x1CDAD651: apc_copy_new_classes (apc_compile.c:639)
==11930== by 0x1CDAE30E: my_compile_file (apc_main.c:185)
==11930== by 0x1C130BAE: execute (in /usr/lib/apache2/modules/libphp4.so)
==11930==
==11930== Use of uninitialised value of size 4
==11930== at 0x1CDACD8D: my_copy_class_entry (apc_compile.c:370)
==11930== by 0x1CDAD651: apc_copy_new_classes (apc_compile.c:639)
==11930== by 0x1CDAE30E: my_compile_file (apc_main.c:185)
==11930== by 0x1C130BAE: execute (in /usr/lib/apache2/modules/libphp4.so)
==11930==
==11930== Invalid read of size 4
==11930== at 0x1CDACD8D: my_copy_class_entry (apc_compile.c:370)
==11930== by 0x1CDAD651: apc_copy_new_classes (apc_compile.c:639)
==11930== by 0x1CDAE30E: my_compile_file (apc_main.c:185)
==11930== by 0x1C130BAE: execute (in /usr/lib/apache2/modules/libphp4.so)
==11930== Address 0xFFFFFFB8 is not stack'd, malloc'd or (recently) free'd
--11930-- adding signal 11 to pending set
When run under Valgrind without optimizations, I only the next message instead of the previous ones:
==13403== Conditional jump or move depends on uninitialised value(s)
==13403== at 0x1CDAD1F7: my_copy_class_entry (apc_compile.c:366)
==13403== by 0x1CDADCCA: apc_copy_new_classes (apc_compile.c:639)
==13403== by 0x1CDAEB24: my_compile_file (apc_main.c:185)
==13403== by 0x1C130BAE: execute (in /usr/lib/apache2/modules/libphp4.so)
APC compiled with "-O" doesn't work either. My gcc version is "gcc version 3.3.5 (Debian 1:3.3.5-8)".
Note: In the end I noticed that if using gcc-3.4 on Sarge (gcc version 3.4.4 20041218 (prerelease) (Debian 3.4.3-6)), -O2 didn't make APC segfault. I wonder if this is some kind of compiler problem.
Expected result:
----------------
APC should not segfault.
Actual result:
--------------
APC segfaults when installed as is.
PatchesPull RequestsHistoryAllCommentsChangesGit/SVN commits
|
|||||||||||||||||||||||||||
Copyright © 2001-2025 The PHP GroupAll rights reserved. |
Last updated: Mon Nov 03 11:00:02 2025 UTC |
i'll send you one by mail Index: apc_compile.c =================================================================== RCS file: /repository/pecl/apc/apc_compile.c,v retrieving revision 3.14 diff -u -r3.14 apc_compile.c --- apc_compile.c 6 Nov 2004 18:12:10 -0000 3.14 +++ apc_compile.c 8 Apr 2005 17:20:33 -0000 @@ -16,6 +16,7 @@ /* $Id: apc_compile.c,v 3.14 2004/11/06 18:12:10 rasmus Exp $ */ +#include "apc.h" #include "apc_compile.h" #include "apc_globals.h" #include "apc_zend.h" @@ -371,6 +372,12 @@ /* Start with a bitwise copy */ memcpy(dst, src, sizeof(src[0])); + /* only initized & used for internal class + * php failed to initize it for user class, crash if u copy it + * see Zend/zend_compile.c + * .handle_function_call = NULL; but no builtin_functions initized + * dst->builtin_functions = 0; + * */ if (src->name) { if(!(dst->name = apc_xstrdup(src->name, allocate))) { @@ -411,43 +418,6 @@ if(local_dst_alloc) deallocate(dst); return NULL; } - - if (src->builtin_functions) { - int i, n; - - for (n = 0; src->builtin_functions[n].fname != NULL; n++) {} - - if(!(dst->builtin_functions = - (zend_function_entry*) - allocate((n + 1) * sizeof(zend_function_entry)))) { - if(src->name) deallocate(dst->name); - deallocate(dst->refcount); - my_destroy_hashtable(&dst->function_table, (ht_free_fun_t)my_free_f unction, deallocate); - my_destroy_hashtable(&dst->default_properties, (ht_free_fun_t)my_fr ee_zval_ptr, deallocate); - if(local_dst_alloc) deallocate(dst); - return NULL; - } - - - for (i = 0; i < n; i++) { - if(!my_copy_function_entry(&dst->builtin_functions[i], - &src->builtin_functions[i], - allocate, deallocate)) { - int ii; - - for(ii=i-1; i>=0; i--) my_destroy_function_entry(&dst->builtin_ functions[ii], deallocate); - if(src->name) deallocate(dst->name); - deallocate(dst->refcount); - my_destroy_hashtable(&dst->function_table, (ht_free_fun_t)my_fr ee_function, deallocate); - my_destroy_hashtable(&dst->default_properties, (ht_free_fun_t)m y_free_zval_ptr, deallocate); - if(local_dst_alloc) deallocate(dst); - return NULL; - } - } - - dst->builtin_functions[n].fname = NULL; - } - return dst; } /* }}} */ @@ -980,8 +950,6 @@ /* {{{ my_destroy_class_entry */ static void my_destroy_class_entry(zend_class_entry* src, apc_free_t deallocate ) { - int i; - assert(src != NULL); deallocate(src->name); @@ -994,13 +962,6 @@ my_destroy_hashtable(&src->default_properties, (ht_free_fun_t) my_free_zval_ptr, deallocate); - - if (src->builtin_functions) { - for (i = 0; src->builtin_functions[i].fname != NULL; i++) { - my_destroy_function_entry(&src->builtin_functions[i], deallocate); - } - deallocate(src->builtin_functions); - } } /* }}} */Line 99 of php_apc.c is: STD_PHP_INI_ENTRY("apc.enabled", "1", PHP_INI_SYSTEM, OnUpdateInt, enabled, zend_apc_globals, apc_globals) Should probably be a boolean there instead, but that doesn't change anything. This should compile fine as long as you are not in ZTS mode. The Debian PHP port maintainer had an insanity episode where he enabled ZTS for no reason. He has since reversed that, but perhaps your phpize enables ZTS and thus TSRM?