php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #18932 fgetcsv with large line causes Apache segfault
Submitted: 2002-08-15 20:37 UTC Modified: 2002-08-19 17:42 UTC
From: speedfreak50 at netscape dot net Assigned:
Status: Closed Package: Reproducible crash
PHP Version: 4CVS-2002-08-15 OS: Linux (Red Hat 7.3)
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: speedfreak50 at netscape dot net
New email:
PHP Version: OS:

 

 [2002-08-15 20:37 UTC] speedfreak50 at netscape dot net
Below is a .csv file and a script to generate the segfault. 
Just tested with php4-STABLE-200208151200 using same ./configure as in 
Redhat php-4.1.2 source rpm. 
 
Save this file as /tmp/segfault.csv 
------------------------------------ 
"Xxxxxxxxx Directors Meeting","6/13/2002","4:30:00 PM","6/13/2002","5:30:00 
PM","False","False","6/13/2002","4:15:00 
PM",,,,,,,,"",,"Normal","False","Normal","2" 
"IPM Network Design Review","6/14/2002","1:30:00 PM","6/14/2002","4:00:00 
PM","False","False","6/14/2002","1:15:00 
PM","xxxxxxxxxxx","xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx;xxxxxxxxxxxxxxxxxxxxxxxxxxxx;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",,,,," 
Xxxx - can you bring your projector? 
 
Agenda: 
 
Review IPM network design 
Design Document draft to be distributed by EOB 6/6/02 (Thursday) 
 
Decode the XXX sizing spreadsheet 
Start construction of consolidated flow map 
Build strategy to validate all network assumptions 
 
Notes - need to add ip route-cache flow to XXX downlink interface between 
XXXX/04 and XXXX/02 on the 6509 
Enumerate netflow generation flows through the 6509  XXXX to provide 
netflow architectire diagram. 
Rip out exclusion rules for XXX 
What is the specification of the field difference between XXX V5 and V7 - 
how do we map a XXX to port and install it into XXX? 
What are the commission impacts for each modem technology 
Why is the xxxxxxxxxxxxx network layer 2 attached to xxxxxxxxxx - is this a 
legacy aspect that needs to be deinstalled - xxxxxxxxxxxxx. 
Section 5.2.1 - Change VLAN XXX to VLAN XXX 
Future health check consideration would be use use a tcp porbe based upon 
collector script that opens and closes based upon service availability 
Design XXX for XXX access server off xxxxxxxxxx 
Outbound to XXX flows - XXX section - requires engagement with XXX to 
define and then design into XXX frontier 
Add XXX Access/Access server to XXXxxx 
 
","8/333 Rm F",,"Normal","False","Normal","2" 
---------------------------------------- 
And run this script: 
-------------------------------- 
<? 
echo "<html><head></head><body>"; 
$fp = fopen("/tmp/segfault.csv", 'r'); 
if (!$fp) { 
        echo "FALSE<br>"; 
        exit; 
} 
echo "GETTING CSV<br>"; 
flush(); 
while ($line = fgetcsv($fp, 1024, ",")) { 
        echo "GOT: " . $line[0] . "<br>"; 
        flush(); 
} 
echo "</body></html>"; 
?> 
--------------------------------- 
Apache child process will crash. 
Could this be a remote exploit? 

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2002-08-15 21:04 UTC] rasmus@php.net
Reproduced here - unlikely to be a remote exploit unless someone if fgetcsv'ing over the network and the bad guy is able to change the target of that.  Or of course if the bad guy gets in and changes .csv files locally, but if they are on your server already, that is the least of your worries.
 [2002-08-15 21:33 UTC] rasmus@php.net
With debug on, here is the backtrace

Program received signal SIGSEGV, Segmentation fault.
0x0819344b in shutdown_memory_manager (silent=1, clean_cache=0) at /home/rasmus/php4/Zend/zend_alloc.c:462
462						if (!iterator->cached
(gdb) bt
#0  0x0819344b in shutdown_memory_manager (silent=1, clean_cache=0) at /home/rasmus/php4/Zend/zend_alloc.c:462
#1  0x08175aae in php_request_shutdown (dummy=0x0) at /home/rasmus/php4/main/main.c:901
#2  0x081b8fa6 in main (argc=2, argv=0xbffff974) at /home/rasmus/php4/sapi/cgi/cgi_main.c:1100
#3  0x4047f1c4 in __libc_start_main () from /lib/libc.so.6
(gdb) p iterator
$1 = (zend_mem_header *) 0x73656363
(gdb) p *iterator
$2 = {magic = 0, filename = 0x0, lineno = 0, reported = 0, orig_filename = 0x0, orig_lineno = 0, pNext = 0x0, pLast = 0x0, size = 0, cached = 0}
(gdb) p *t
$3 = {magic = 1930623196, filename = 0x82218c0 "/home/rasmus/php4/Zend/zend_API.c", lineno = 835, reported = 1, orig_filename = 0x0, orig_lineno = 0, pNext = 0x8303350, pLast = 0x0, size = 1247, cached = 0}

That fgetcsv code is nasty-looking.  Not awake enough to dive in right now.
 [2002-08-16 10:59 UTC] kalowsky@php.net
Assigning to Rasmus as he seems to think he might know whats going on.

from what I know another bug of this same nature was recently no-feedbacked.  But I can't remember the bug number off hand.
 [2002-08-16 12:50 UTC] rasmus@php.net
Uh, no, I never said that.  Even now that I am awake that fgetcsv() code looks nasty.  I was about to throw the blame on some poor sod, but I had a look at CVS and I wrote the function originally and it has then since been hacked on by Thies, Sterling, Yohgaki, Wez, Zeev, Derick, Hartmut, Stig, Torben and Jeroen.  I'm unassigning myself, for now, to make sure anybody else who is keen on fixing it doesn't get discouraged.  I will however try to get to it sometime soon if nobody else does.  Looks like it will take an hour of getting cozy with gdb to fix this one.
 [2002-08-19 17:42 UTC] iliaa@php.net
This bug has been fixed in CVS.

In case this was a PHP problem, snapshots of the sources are packaged
every three hours; this change will be in the next snapshot. You can
grab the snapshot at http://snaps.php.net/.
 
In case this was a documentation problem, the fix will show up soon at
http://www.php.net/manual/.

In case this was a PHP.net website problem, the change will show
up on the PHP.net site and on the mirror sites in short time.
 
Thank you for the report, and for helping us make PHP better.


 [2003-01-23 10:32 UTC] d dot rousseau at nnx dot com
This bug seems to be back.
With 4.2.3 I do get segfaults when trying to fgetcsv() a line longer than the buffer size (in my case, it fails with 5000 and works with 5100)
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Sat Oct 05 11:01:26 2024 UTC