php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #21160 bcomplier - segfaulting patch
Submitted: 2002-12-23 01:58 UTC Modified: 2003-03-13 07:12 UTC
From: tony2001 at ua dot fm Assigned:
Status: Closed Package: PEAR related
PHP Version: 4.3.0 OS: RH 7.3
Private report: No CVE-ID: None
 [2002-12-23 01:58 UTC] tony2001 at ua dot fm
RH7.3, Apache 1.3.27, PHP 4.3.0RC4
bcompiler compiled as dynamic module.

It seems that bcompiler_compile.php compiles class ok, but loading this class with bcompiler_load(); initiates segfault in Apache:
----------
(gdb) file /usr/local/apache/bin/httpd
Reading symbols from /usr/local/apache/bin/httpd...done.
(gdb) run -X -f /usr/local/apache/conf/httpd.conf
Starting program: /usr/local/apache/bin/httpd -X -f /usr/local/apache/conf/httpd.conf

Program received signal SIGSEGV, Segmentation fault.
0x4207b424 in chunk_realloc () from /lib/i686/libc.so.6
(gdb) bt
#0  0x4207b424 in chunk_realloc () from /lib/i686/libc.so.6
#1  0x4207b1f8 in realloc () from /lib/i686/libc.so.6
#2  0x401335af in _erealloc (ptr=0x8147dec, size=5, allow_failure=0) at /root/CVS/php-4.3.0RC4/Zend/zend_alloc.c:293
#3  0x40475ccd in apc_create_string () from /usr/local/lib/php/extensions/bcompiler.so
#4  0x40476163 in apc_deserialize_magic () from /usr/local/lib/php/extensions/bcompiler.so
#5  0x40475180 in zif_bcompiler_load () from /usr/local/lib/php/extensions/bcompiler.so
#6  0x401545fc in execute (op_array=0x81244ac) at /root/CVS/php-4.3.0RC4/Zend/zend_execute.c:1596
#7  0x4014220c in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /root/CVS/php-4.3.0RC4/Zend/zend.c:864
#8  0x4011c22d in php_execute_script (primary_file=0xbffff420) at /root/CVS/php-4.3.0RC4/main/main.c:1573
#9  0x4015bb9e in apache_php_module_main (r=0x811ea3c, display_source_mode=0)
    at /root/CVS/php-4.3.0RC4/sapi/apache/sapi_apache.c:55
#10 0x4015c696 in send_php (r=0x811ea3c, display_source_mode=0, filename=0x0)
    at /root/CVS/php-4.3.0RC4/sapi/apache/mod_php4.c:556
#11 0x4015c6ea in send_parsed_php (r=0x811ea3c) at /root/CVS/php-4.3.0RC4/sapi/apache/mod_php4.c:571
#12 0x0806b02b in ap_invoke_handler ()
#13 0x0807ffcb in process_request_internal ()
#14 0x080803ef in ap_internal_redirect ()
#15 0x0805fe8c in handle_dir ()
#16 0x0806b02b in ap_invoke_handler ()
#17 0x0807ffcb in process_request_internal ()
#18 0x0808002c in ap_process_request ()
#19 0x08076e4d in child_main ()
#20 0x08076ff8 in make_child ()
#21 0x0807716c in startup_children ()
#22 0x080777e4 in standalone_main ()
#23 0x08078047 in main ()
#24 0x42017499 in __libc_start_main () from /lib/i686/libc.so.6
----------

Almost the same trouble happends when calling phpinfo(); if bcompiler.so is loaded.
----------
(gdb) run -X -f /usr/local/apache/conf/httpd.conf
Starting program: /usr/local/apache/bin/httpd -X -f /usr/local/apache/conf/httpd.conf

Program received signal SIGSEGV, Segmentation fault.
0x4207acc0 in chunk_free () from /lib/i686/libc.so.6
(gdb) bt
#0  0x4207acc0 in chunk_free () from /lib/i686/libc.so.6
#1  0x4207ac24 in free () from /lib/i686/libc.so.6
#2  0x40133875 in shutdown_memory_manager (silent=0, clean_cache=0) at /root/CVS/php-4.3.0RC4/Zend/zend_alloc.c:462
#3  0x4011afa4 in php_request_shutdown (dummy=0x0) at /root/CVS/php-4.3.0RC4/main/main.c:949
#4  0x4015bbf8 in apache_php_module_main (r=0x811e0fc, display_source_mode=0)
    at /root/CVS/php-4.3.0RC4/sapi/apache/sapi_apache.c:61
#5  0x4015c696 in send_php (r=0x811e0fc, display_source_mode=0, filename=0x0)
    at /root/CVS/php-4.3.0RC4/sapi/apache/mod_php4.c:556
#6  0x4015c6ea in send_parsed_php (r=0x811e0fc) at /root/CVS/php-4.3.0RC4/sapi/apache/mod_php4.c:571
#7  0x0806b02b in ap_invoke_handler ()
#8  0x0807ffcb in process_request_internal ()
#9  0x0808002c in ap_process_request ()
#10 0x08076e4d in child_main ()
#11 0x08076ff8 in make_child ()
#12 0x0807716c in startup_children ()
#13 0x080777e4 in standalone_main ()
#14 0x08078047 in main ()
#15 0x42017499 in __libc_start_main () from /lib/i686/libc.so.6
----------

The same trouble happends with Apache 1.3.26, PHP 4.3.0-dev (rather old, July CVS-version).
Extension compiles without any warnings or errors.

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2003-03-08 09:06 UTC] alan_k@php.net
can you try an updated version from CVS - there have been a few fixes added since then.


 [2003-03-11 01:26 UTC] tony2001 at ua dot fm
I've tried CVS version a few seconds ago. When I'm trying to run make I get this (pay attention - I've updated PHP version and using ZE2 now, but it looks like this is not a reason):
----
make
/bin/sh /root/CVS/bcompiler/libtool --mode=compile gcc  -I. -I/root/CVS/bcompiler -DPHP_ATOM_INC -I/root/CVS/bcompiler/include -I/root/CVS/bcompiler/main -I/root/CVS/bcompiler -I/usr/local/include/php -I/usr/local/include/php/main -I/usr/local/include/php/Zend -I/usr/local/include/php/TSRM  -DHAVE_CONFIG_H  -g -O2  -prefer-pic -c /root/CVS/bcompiler/bcompiler.c -o bcompiler.lo
gcc -I. -I/root/CVS/bcompiler -DPHP_ATOM_INC -I/root/CVS/bcompiler/include -I/root/CVS/bcompiler/main -I/root/CVS/bcompiler -I/usr/local/include/php -I/usr/local/include/php/main -I/usr/local/include/php/Zend -I/usr/local/include/php/TSRM -DHAVE_CONFIG_H -g -O2 -c /root/CVS/bcompiler/bcompiler.c  -fPIC -DPIC -o bcompiler.lo
In file included from /root/CVS/bcompiler/bcompiler.c:32:
/root/CVS/bcompiler/php_bcompiler.h:165: parse error before `*'
/root/CVS/bcompiler/php_bcompiler.h:166: parse error before `*'
/root/CVS/bcompiler/bcompiler.c: In function `bcompiler_read':
/root/CVS/bcompiler/bcompiler.c:1248: invalid type argument of `unary *'
/root/CVS/bcompiler/bcompiler.c:1251: invalid type argument of `unary *'
/root/CVS/bcompiler/bcompiler.c: In function `apc_create_string':
/root/CVS/bcompiler/bcompiler.c:1667: `buffer' undeclared (first use in this function)
/root/CVS/bcompiler/bcompiler.c:1667: (Each undeclared identifier is reported only once
/root/CVS/bcompiler/bcompiler.c:1667: for each function it appears in.)
/root/CVS/bcompiler/bcompiler.c:1667: subscripted value is neither array nor pointer
/root/CVS/bcompiler/bcompiler.c: In function `apc_create_arg_types':
/root/CVS/bcompiler/bcompiler.c:1695: `buffer' undeclared (first use in this function)
/root/CVS/bcompiler/bcompiler.c:1695: subscripted value is neither array nor pointer
/root/CVS/bcompiler/bcompiler.c: In function `deserialize_magic':
/root/CVS/bcompiler/bcompiler.c:1735: `buffer' undeclared (first use in this function)
/root/CVS/bcompiler/bcompiler.c:1735: subscripted value is neither array nor pointer
/root/CVS/bcompiler/bcompiler.c: In function `apc_deserialize_zend_llist':
/root/CVS/bcompiler/bcompiler.c:1793: `buffer' undeclared (first use in this function)
/root/CVS/bcompiler/bcompiler.c:1793: subscripted value is neither array nor pointer
/root/CVS/bcompiler/bcompiler.c: In function `apc_serialize_zvalue_value':
/root/CVS/bcompiler/bcompiler.c:2012: structure has no member named `ce'
/root/CVS/bcompiler/bcompiler.c:2013: structure has no member named `properties'
/root/CVS/bcompiler/bcompiler.c: In function `apc_deserialize_zvalue_value':
/root/CVS/bcompiler/bcompiler.c:2052: structure has no member named `ce'
/root/CVS/bcompiler/bcompiler.c:2053: structure has no member named `properties'
/root/CVS/bcompiler/bcompiler.c: In function `apc_serialize_zend_class_entry':
/root/CVS/bcompiler/bcompiler.c:2219: subscripted value is neither array nor pointer
/root/CVS/bcompiler/bcompiler.c:2243: structure has no member named `handle_function_call'
/root/CVS/bcompiler/bcompiler.c:2244: structure has no member named `handle_property_get'
/root/CVS/bcompiler/bcompiler.c:2245: structure has no member named `handle_property_set'
/root/CVS/bcompiler/bcompiler.c: In function `apc_deserialize_zend_class_entry':
/root/CVS/bcompiler/bcompiler.c:2283: warning: assignment makes integer from pointer without a cast
/root/CVS/bcompiler/bcompiler.c:2284: invalid type argument of `unary *'
/root/CVS/bcompiler/bcompiler.c:2309: structure has no member named `handle_function_call'
/root/CVS/bcompiler/bcompiler.c:2310: structure has no member named `handle_property_get'
/root/CVS/bcompiler/bcompiler.c:2311: structure has no member named `handle_property_set'
/root/CVS/bcompiler/bcompiler.c: In function `apc_serialize_znode':
/root/CVS/bcompiler/bcompiler.c:2355: union has no member named `fetch_type'
/root/CVS/bcompiler/bcompiler.c:2360: union has no member named `fetch_type'
/root/CVS/bcompiler/bcompiler.c: In function `apc_deserialize_znode':
/root/CVS/bcompiler/bcompiler.c:2404: `buffer' undeclared (first use in this function)
/root/CVS/bcompiler/bcompiler.c:2404: subscripted value is neither array nor pointer
/root/CVS/bcompiler/bcompiler.c: In function `apc_serialize_zend_op_array':
/root/CVS/bcompiler/bcompiler.c:2498: structure has no member named `uses_globals'
/root/CVS/bcompiler/bcompiler.c:2508: structure has no member named `uses_globals'
/root/CVS/bcompiler/bcompiler.c: In function `apc_deserialize_zend_op_array':
/root/CVS/bcompiler/bcompiler.c:2551: `ZEND_DECLARE_FUNCTION_OR_CLASS' undeclared (first use in this function)
/root/CVS/bcompiler/bcompiler.c:2696: structure has no member named `uses_globals'
/root/CVS/bcompiler/bcompiler.c:2702: `buffer' undeclared (first use in this function)
/root/CVS/bcompiler/bcompiler.c:2702: subscripted value is neither array nor pointer
/root/CVS/bcompiler/bcompiler.c: At top level:
/root/CVS/bcompiler/bcompiler.c:2751: parse error before `*'
/root/CVS/bcompiler/bcompiler.c: In function `apc_serialize_zend_overloaded_function':
/root/CVS/bcompiler/bcompiler.c:2753: `zof' undeclared (first use in this function)
/root/CVS/bcompiler/bcompiler.c: At top level:
/root/CVS/bcompiler/bcompiler.c:2759: parse error before `*'
/root/CVS/bcompiler/bcompiler.c: In function `apc_deserialize_zend_overloaded_function':
/root/CVS/bcompiler/bcompiler.c:2761: `zof' undeclared (first use in this function)
/root/CVS/bcompiler/bcompiler.c: In function `apc_serialize_zend_function':
/root/CVS/bcompiler/bcompiler.c:2786: union has no member named `overloaded_function'
/root/CVS/bcompiler/bcompiler.c: In function `apc_deserialize_zend_function':
/root/CVS/bcompiler/bcompiler.c:2810: union has no member named `overloaded_function'
make: *** [bcompiler.lo] Error 1

I'll try to biuld it with 4.3.0 today.
 [2003-03-13 01:00 UTC] tony2001 at ua dot fm
Ok, I've tried it with 4.3.0 and made some improvements.
I don't know is such patch acceptable or not, but it works ok for me.

*-----------------*
--- /root/IN/bcompiler/bcompiler/bcompiler.c    Tue Feb  4 14:52:11 2003
+++ ./bcompiler.c       Wed Mar 12 22:43:28 2003
@@ -311,7 +311,7 @@
  */
 static void php_bcompiler_init_globals(zend_bcompiler_globals *bcompiler_globals)
 {
-
+

        bcompiler_globals->buffer = (char*) emalloc(1);
        bcompiler_globals->stream = NULL;
@@ -326,9 +326,8 @@
  */
 PHP_MINIT_FUNCTION(bcompiler)
 {
-
+
        ZEND_INIT_MODULE_GLOBALS(bcompiler, php_bcompiler_init_globals, NULL);
-
        bcompiler_saved_zend_compile_file = zend_compile_file;
        zend_compile_file = bcompiler_compile_file;

@@ -340,6 +339,7 @@
  */
 PHP_MSHUTDOWN_FUNCTION(bcompiler)
 {
+
        zend_compile_file = bcompiler_saved_zend_compile_file;
        return SUCCESS;
 }
@@ -350,6 +350,8 @@
  */
 PHP_RINIT_FUNCTION(bcompiler)
 {
+
+       BCOMPILERG(buffer) = (char*) emalloc(1);
        return SUCCESS;
 }
 /* }}} */
@@ -458,7 +460,7 @@
        BCOMPILERG(buffer) = (char*) erealloc(BCOMPILERG(buffer),  n + 1);            \
        php_stream_read((php_stream *) BCOMPILERG(stream) , BCOMPILERG(buffer) , n);   \
        memcpy((char*)bytes, BCOMPILERG(buffer), n);    \
-       BCOMPILER(buffer)[n] = '\0';             \
+       BCOMPILERG(buffer)[n] = '\0';             \
        BCOMPILER_DEBUG(("Got: %s\n",(char*)BCOMPILERG(buffer)));         \
 }

@@ -1719,7 +1721,7 @@
     char *tmp;
     int retval;
     int len = 0;
-
+
     DESERIALIZE_SCALAR(&len, int);
     if (len <= 0)
     {
*-----------------*

And please add to the end of bcompiler_compile.php something like that:
...
if (isset($_SERVER['argv'][1])) {
    $test = new PHP_bcompiler_compile($_SERVER['argv'][1]);
}
else {
    echo "Run ".$SCRIPT_NAME." some_class.php to compile some_class.php.phb\n";
}
...

cause, it's very annoying, when it tries to compile (and compiles!) nonspecified file
to './.phpb' without any messages.
 [2003-03-13 07:12 UTC] alan_k@php.net
This bug has been fixed in CVS.

In case this was a PHP problem, snapshots of the sources are packaged
every three hours; this change will be in the next snapshot. You can
grab the snapshot at http://snaps.php.net/.
 
In case this was a documentation problem, the fix will show up soon at
http://www.php.net/manual/.

In case this was a PHP.net website problem, the change will show
up on the PHP.net site and on the mirror sites in short time.
 
Thank you for the report, and for helping us make PHP better.

thanks - have commited it to CVS
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Mon Dec 30 14:01:28 2024 UTC