php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #72801 apcu crashes (SIGSEGV) php/Apache on memory allocation failures
Submitted: 2016-08-10 11:28 UTC Modified: 2016-10-14 14:35 UTC
Votes:4
Avg. Score:4.8 ± 0.4
Reproduced:4 of 4 (100.0%)
Same Version:3 (75.0%)
Same OS:0 (0.0%)
From: jaromird at microsoft dot com Assigned: krakjoe (profile)
Status: Closed Package: Reproducible crash
PHP Version: 7.0.9 OS: Mac OS X
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: jaromird at microsoft dot com
New email:
PHP Version: OS:

 

 [2016-08-10 11:28 UTC] jaromird at microsoft dot com
Description:
------------
Started seeing more frequent Apache crashes after upgrade to PHP 7.0 for one of our applications which makes heavy use of apc cache. After investigation, found a reproduction script to trigger segmentation fault eventually.

Late apcu code inspection revealed that code doesn't check for memory allocation failures on many places. Typical case for example: string duplication fails in apcu_store(), code then inserts zval with NULL value into cache, then apcu_fetch() crashes when dereferencing the value.

I hope I've covered all necessary places in the patch, but surely would suggest close review. So far only the case triggered by the below test is really tested.

Test script:
---------------
<?php

/*
Might need tweaking to trigger the memory allocation failure

ini settings:
memory_limit = 4512M
apcu shared memory size default - 128M
*/

$f = str_repeat('c', 800 * 1024 * 1024 );

apcu_store('aaa', $f, 5);

$s = apcu_fetch('aaa');

echo ($s == $f) ? "same" : "different";


Expected result:
----------------
script running to completion, returning "same" if no memory problem, "different" if memory allocation failure in apc_fetch()

Actual result:
--------------
Segmentation fault: 11


Patches

patch-apc_cache.c (last revision 2016-08-10 11:28 UTC by jaromird at microsoft dot com)

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2016-08-10 11:29 UTC] jaromird at microsoft dot com
Tested with apcu 5.1.5
 [2016-08-10 12:03 UTC] nikic@php.net
-Assigned To: +Assigned To: krakjoe
 [2016-08-10 12:03 UTC] nikic@php.net
Not seeing apcu in the package list, so assigning this to joe directly.
 [2016-09-29 09:49 UTC] krakjoe@php.net
-Status: Assigned +Status: Closed
 [2016-09-29 09:49 UTC] krakjoe@php.net
The fix for this bug has been committed.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.

 For Windows:

http://windows.php.net/snapshots/
 
Thank you for the report, and for helping us make PHP better.

Sorry about the delay, thanks for the patch ;)
 [2016-10-14 14:28 UTC] jaromird at microsoft dot com
Was the fix actually applied? Don't see anything relevant in the github repo
 [2016-10-14 14:35 UTC] requinix@php.net
And the fix is present as of v5.1.6, which was released last week.
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved.
Last updated: Wed Jan 08 14:01:28 2025 UTC