php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #41290 ldap_start_tls produces glibc corrupted double-linked list
Submitted: 2007-05-04 18:46 UTC Modified: 2007-05-04 21:15 UTC
From: wyatt dot neal at ngc dot com Assigned:
Status: Not a bug Package: Reproducible crash
PHP Version: 5.2.2 OS: RHEL4U4
Private report: No CVE-ID: None
View Developer Edit
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: wyatt dot neal at ngc dot com
New email:
PHP Version: OS:

 

 [2007-05-04 18:46 UTC] wyatt dot neal at ngc dot com 
Description:
------------
Running PHP version 5.2.2, I can consistently crash php (cli) with a

*** glibc detected *** corrupted double-linked list

Verified permissions to all files and paths.
Running Openldap 2.3.

The test code below should reproduce the error without fail.  I've verified the same operations against Openldap with a client written in C and this error does not occur.  I'll apologize ahead of time for any mis-spellings since I've had to retype the entire backtrace by hand.

Reproduce code:
---------------
<?php

$host = "ldap://host.domain.com";
$tls_cacert = "/etc/openldap/cacerts/cacert.pem";
$tls_cert = "/etc/openldap/certificates/ldap-client.pem";
$tls_key = "/etc/openldap/certificates/ldap-client-key.pem";

putenv("LDAPTLS_CACERT=$tls_cacert");
putenv("LDAPTLS_CERT=$tls_cert");
putenv("LDAPTLS_KEY=$tls_key");

$result = ldap_set_option(NULL, LDAP_OPT_PROTOCOL_VERSION, 3);
if(!$result) {
exit(0);
}

$conn = ldap_connect($host);

if(!conn) {
exit(0);
}

$result = ldap_start_tls($conn);

if(!result) {
exit(0);
}
?>

Expected result:
----------------
A clean exit.

Actual result:
--------------
(gdb) run test.php
.....
[New Tread -1208449344 (LWP 10103)]
*** glibc detected *** corrupted double-linked list: 0x09e63d0 ***

Program received signal SIGABRT, Aborted.
[Switching to Thread -1208449344 (LWP 10103)]
0x0061b7a2 in _dl_sysinfo_int80 () from /lib/ld-linux.so.2
(gdb) bt
#0 	0x0061b7a2 in _dl_sysinfo_int80
...
#5 	0x0016333a in free() from /lib/tls/libc.so.6
#6 	0x006f8cf2 in CRYPTO_free() from /lib/libcrypto.so.4
#7 	0x00753213 in X509_CINF_free() from /lib/libcrypto.so.4
#8 	0x00758003 in ASN1_primitive_free () from /lib/libcrypto.so.4
#9 	0x007581d3 in ASN1_item_free () from /lib/libcrypto.so.4
#10 	0x00753311 in X509_free() from /lib/libcrypto.so.4
#11	0x00ba353e in ssl_cert_free () from /lib/libssl.so.4
#12	0x00ba11c7 in SSL_CTX_free() from /lib/libssl.so.4
#13	0x009b0e13 in ldap_pvt_tls_init_def_ctx () from /usr/lib/libldap-2.3.so.0
#14	0x009b113e in ldap_pvt_tls_init_def_ctx () from /usr/lib/libldap-2.3.so.0
#15	0x009b1482 in ldap_int_tls_start () from /usr/lib/libldap-2.3.so.0
#16	0x009b1bbc in ldap_start_tls_s () from /usr/lib/libldap-2.3.so.0
#17	0x080f36b2 in zif_ldap_start_tls (ht=1, return_value=0xb7f53120, return_value_ptr=0x0, this_ptr=0x0, return_value_used=1) at /usr/src/debug/php-5.2.2/ext/ldap/ldap.c:2110
#18	0x08255321 in zend_do_fcal_common_helper_SPEC (execute_data=0xbff90b20) at /usr/src/debug/php-5.2.2/Zend/zend_vm_execute.h:200
#19	0x08254a99 in execute (op_array=0xb7f520f8) at /usr/src/debug/php-5.2.2/Zend/zend_vm_execute.h:92
#20	0x0823b8d9 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /usr/src/debug/php-5.2.2/Zend/zend.c:1134
#21	0x08202f29 in php_execute_script (primary_file=0xbff92f80) at /usr/src/debug/php-5.2.2/main/main.c:1794
#22	0x082b619e in main (argc=2, argv=0xbff93054) at /usr/src/debug/php-5.2.2/sapi/cli/php_cli.c:1130

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2007-05-04 19:46 UTC] tony2001@php.net 
The backtrace clearly shows it's not PHP problem.
 [2007-05-04 20:07 UTC] wyatt dot neal at ngc dot com 
really?  do you think that the ld->link at ext/ldap/ldap.c:2108 being invalid when the ldap_start_tls_s call is made to OpenLDAP could cause the problem?  i've written other tls clients for OpenLDAP and in my experience, the ldap_start_tls_s call only fails when you pass invalid data into it.
 [2007-05-04 20:21 UTC] tony2001@php.net 
>really?  do you think that the ld->link at ext/ldap/ldap.c:2108 
>being invalid when the ldap_start_tls_s call is made to OpenLDAP
>could cause the problem?  

No, I don't think it can make OpenSSL library to crash.

>i've written other tls clients for OpenLDAP and in my experience,
>the ldap_start_tls_s call only fails when you pass invalid data into it.

We would really appreciate a patch from you.
 [2007-05-04 21:15 UTC] wyatt dot neal at ngc dot com 
due to company policy, i can not contribute a patch back.  i think i've given enough info here if someone else ever wants to take a stab at it though.
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved. 		Last updated: Wed Jul 16 03:01:33 2025 UTC