|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
[2003-07-10 11:11 UTC] jhuston at cs dot umn dot edu
Description: ------------ Installed PHP 4.3.3RC1 as a DSO on Apache 2.0.47 with the mysql and oracle and gd extension enabled. I was able to reproduce same segfault error on Apache 1.3.27 with DSO enabled. I can also reproduce the same problem from line command. It appears that it does go through to the end of the script but it just dies before it could complete the script peacefully. I'd get the same problem with my other scripts sharing the same set of functions library. I tracked down a possible cause of Bus Error or Segmentation fault. It appears that when the script is doing $_SESSION variable assignments, it puked on exit. When I commented out all lines containing $_SESSION variable assignments, the script exited peacefully without any seg fault or bus error. Some useful Info: [fork@scrabble]% uname -a SunOS scrabble 5.9 Generic sun4u sparc SUNW,Sun-Blade-100 [fork@scrabble]% php -v PHP 4.3.3RC1 (cli) (built: Jul 10 2003 01:47:16) Copyright (c) 1997-2003 The PHP Group Zend Engine v1.3.0, Copyright (c) 1998-2003 Zend Technologies [fork@scrabble]% php -i phpinfo() PHP Version => 4.3.3RC1 System => SunOS scrabble 5.9 Generic sun4u Build Date => Jul 10 2003 01:42:12 Configure Command => './configure' '--with-apxs2=/usr/local/apache2/bin/apxs' '--with-mcrypt' '--with-mysql=/usr/local/mysql4' '--with-oci8' '--enable-track-vars' '--with-openssl=/usr/local/openssl' '--with-gd' '--with-jpeg-dir=/usr/local/lib' '--with-zlib-dir=/usr/local/lib' '--with-png-dir=/usr/local/lib' Server API => Command Line Interface Reproduce code: --------------- One of the source codes can be viewed at: http://scrabble.cs.umn.edu/gradebook/index.phps This link will disappear after this bug ticket has been fixed and closed. Expected result: ---------------- Expected result would return a page from browser. When it segfaults, it returns blank. When I run it from line command I'd get something like this: [fork@scrabble]% php index.php <html><title></title> <style type="text/css"> . . . </table> <tr><td><font color=#333366>Gradebook 1.0a © 2002 Josh Huston, All Rights Reserved</font></td></tr> </table> </html> Bus error [fork@scrabble]% Actual result: -------------- This is what i got when running gdb: [fork@scrabble]% gdb php GNU gdb 5.0 Copyright 2000 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "sparc-sun-solaris2.8"... (gdb) run index.php Starting program: /usr/local/bin/php index.php <html><title></title> <style type="text/css"> . . (snip) . . <tr><td><font color=#333366>Gradebook 1.0a © 2002 Josh Huston, All Rights Reserved</font></td></tr> </table> </html> Program received signal SIGSEGV, Segmentation fault. 0x131d28 in _efree (ptr=0x2c0f80) at /home/src/php-4.3.3RC1/Zend/zend_alloc.c:259 259 in /home/src/php-4.3.3RC1/Zend/zend_alloc.c (gdb) where #0 0x131d28 in _efree (ptr=0x2c0f80) at /home/src/php-4.3.3RC1/Zend/zend_alloc.c:259 #1 0x91b9c in migrate_global (ht=0x32f1a0, pos=0x1) at /home/src/php-4.3.3RC1/ext/session/session.c:640 #2 0x91cbc in php_session_save_current_state () at /home/src/php-4.3.3RC1/ext/session/session.c:670 #3 0x94828 in php_session_flush () at /home/src/php-4.3.3RC1/ext/session/session.c:1593 #4 0x94858 in zm_deactivate_session (type=0, module_number=4) at /home/src/php-4.3.3RC1/ext/session/session.c:1607 #5 0x145934 in module_registry_cleanup (module=0x2ed858) at /home/src/php-4.3.3RC1/Zend/zend_API.c:1167 #6 0x147bfc in zend_hash_apply (ht=0x2c2484, apply_func=0x1458f8 <module_registry_cleanup>) at /home/src/php-4.3.3RC1/Zend/zend_hash.c:688 #7 0x1426e0 in zend_deactivate_modules () at /home/src/php-4.3.3RC1/Zend/zend.c:651 #8 0x112a14 in php_request_shutdown (dummy=0x0) at /home/src/php-4.3.3RC1/main/main.c:982 #9 0x15e438 in main (argc=2, argv=0xffbff67c) at /home/src/php-4.3.3RC1/sapi/cli/php_cli.c:874 PatchesPull RequestsHistoryAllCommentsChangesGit/SVN commits
|
|||||||||||||||||||||||||||||||||||||
Copyright © 2001-2025 The PHP GroupAll rights reserved. |
Last updated: Sat Oct 25 01:00:01 2025 UTC |
During the course of writing a shorter script, I discovered a possible cause of bus error or segmentation fault. When assigning $_SESSION variable to an undefined variable, it puked. I would like to add that I was able to reproduce the same behavior under 4.3.2 source tree on Solaris. It worked fine under 4.2.3 until I upgraded it to 4.3.2 and the problem surfaced. Here's the short and sweet script that caused bus error: --- <? session_name("unclesam"); session_start(); import_request_variables("gp"); $webusername = $_SESSION['webusername']; $webuserid = $_SESSION['webuserid']; $webuserroleid = $_SESSION['webuserroleid']; if($termid == "") { $termid = $_SESSION['termid']; $courseid = $_SESSION['courseid']; } $_SESSION['termid'] = $termid; $_SESSION['courseid'] = $courseid; ?> It didn't crash at all yet. --- If you assigned termid to some value via POST or GET, it doesn't crash at all. I wrote this code in this particular way because I wanted the script to remember the termid value and when the user pressed back button or if termid has been changed, it will save the change into session variable. The script can be accessed to at http://scrabble.cs.umn.edu/gradebook/test.php. The first time you access to this script, it'll come up blank because it core dumped. But if you appended "?termid=1" to the URL above, it survives. So basically, if termid is undefined, the script just pukes.I downloaded the CVS snapshot and compiled it with same configure options. It is still getting the same bus error as described earlier. I ran a test on test.php (same code as i posted earlier). [fork@scrabble gradebook]% php -v PHP 4.3.3RC2-dev (cli) (built: Jul 10 2003 13:24:53) Copyright (c) 1997-2003 The PHP Group Zend Engine v1.3.0, Copyright (c) 1998-2003 Zend Technologies [fork@scrabble gradebook]% php test.php Notice: import_request_variables(): No prefix specified - possible security hazard in /home/projects/gradebook/test.php on line 6 Notice: Undefined index: webusername in /home/projects/gradebook/test.php on line 8 Notice: Undefined index: webuserid in /home/projects/gradebook/test.php on line 9 Notice: Undefined index: webuserroleid in /home/projects/gradebook/test.php on line 10 Notice: Undefined variable: termid in /home/projects/gradebook/test.php on line 12 Notice: Undefined index: termid in /home/projects/gradebook/test.php on line 13 Notice: Undefined index: courseid in /home/projects/gradebook/test.php on line 14 It didn't crash at all yet. Bus error Then I ran it on gdb again and it still produced same error message as mentioned earlier. [fork@scrabble gradebook]% gdb php GNU gdb 5.0 Copyright 2000 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "sparc-sun-solaris2.8"... (gdb) run test.php Starting program: /usr/local/bin/php test.php Notice: import_request_variables(): No prefix specified - possible security hazard in /home/projects/gradebook/test.php on line 6 Notice: Undefined index: webusername in /home/projects/gradebook/test.php on line 8 Notice: Undefined index: webuserid in /home/projects/gradebook/test.php on line 9 Notice: Undefined index: webuserroleid in /home/projects/gradebook/test.php on line 10 Notice: Undefined variable: termid in /home/projects/gradebook/test.php on line 12 Notice: Undefined index: termid in /home/projects/gradebook/test.php on line 13 Notice: Undefined index: courseid in /home/projects/gradebook/test.php on line 14 It didn't crash at all yet. Program received signal SIGSEGV, Segmentation fault. 0x135170 in _efree (ptr=0x2c42a0) at /home/src/php4-STABLE-200307101730/Zend/zend_alloc.c:259 259 /home/src/php4-STABLE-200307101730/Zend/zend_alloc.c: No such file or directory. (gdb) where #0 0x135170 in _efree (ptr=0x2c42a0) at /home/src/php4-STABLE-200307101730/Zend/zend_alloc.c:259 #1 0x94e98 in migrate_global (ht=0x332228, pos=0x1) at /home/src/php4-STABLE-200307101730/ext/session/session.c:640 #2 0x94fb8 in php_session_save_current_state () at /home/src/php4-STABLE-200307101730/ext/session/session.c:670 #3 0x97b24 in php_session_flush () at /home/src/php4-STABLE-200307101730/ext/session/session.c:1593 #4 0x97b54 in zm_deactivate_session (type=0, module_number=4) at /home/src/php4-STABLE-200307101730/ext/session/session.c:1607 #5 0x148d7c in module_registry_cleanup (module=0x2f0ba8) at /home/src/php4-STABLE-200307101730/Zend/zend_API.c:1167 #6 0x14b044 in zend_hash_apply (ht=0x2c57a4, apply_func=0x148d40 <module_registry_cleanup>) at /home/src/php4-STABLE-200307101730/Zend/zend_hash.c:688 #7 0x145b28 in zend_deactivate_modules () at /home/src/php4-STABLE-200307101730/Zend/zend.c:651 #8 0x11600c in php_request_shutdown (dummy=0x0) at /home/src/php4-STABLE-200307101730/main/main.c:981 #9 0x1616e8 in main (argc=2, argv=0xffbff674) at /home/src/php4-STABLE-200307101730/sapi/cli/php_cli.c:874Yes, it still crashes. [root@scrabble php4-STABLE-200307150330]# sapi/cli/php -n /home/projects/gradebook/test.php It didn't crash at all yet. Bus error [root@scrabble php4-STABLE-200307150330]# gdb sapi/cli/php GNU gdb 5.0 Copyright 2000 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "sparc-sun-solaris2.8"... (gdb) run -n /home/projects/gradebook/test.php Starting program: /home/src/php4-STABLE-200307150330/sapi/cli/php -n /home/projects/gradebook/test.php It didn't crash at all yet. Program received signal SIGSEGV, Segmentation fault. 0x9f394 in _efree (ptr=0x10a6d8) at /home/src/php4-STABLE-200307150330/Zend/zend_alloc.c:259 259 REMOVE_POINTER_FROM_LIST(p); (gdb) where #0 0x9f394 in _efree (ptr=0x10a6d8) at /home/src/php4-STABLE-200307150330/Zend/zend_alloc.c:259 #1 0x237b4 in migrate_global (ht=0x13a558, pos=0x1) at /home/src/php4-STABLE-200307150330/ext/session/session.c:640 #2 0x238b8 in php_session_save_current_state () at /home/src/php4-STABLE-200307150330/ext/session/session.c:670 #3 0x26058 in php_session_flush () at /home/src/php4-STABLE-200307150330/ext/session/session.c:1593 #4 0x26088 in zm_deactivate_session (type=0, module_number=2) at /home/src/php4-STABLE-200307150330/ext/session/session.c:1607 #5 0xb14b8 in module_registry_cleanup (module=0x12d1e8) at /home/src/php4-STABLE-200307150330/Zend/zend_API.c:1167 #6 0xb3498 in zend_hash_apply (ht=0x10bb2c, apply_func=0xb147c <module_registry_cleanup>) at /home/src/php4-STABLE-200307150330/Zend/zend_hash.c:688 #7 0xae530 in zend_deactivate_modules () at /home/src/php4-STABLE-200307150330/Zend/zend.c:651 #8 0x83060 in php_request_shutdown (dummy=0x0) at /home/src/php4-STABLE-200307150330/main/main.c:981 #9 0xc883c in main (argc=3, argv=0xffbff5c4) at /home/src/php4-STABLE-200307150330/sapi/cli/php_cli.c:874I did the following configure line with fresh snapshot with debug enabled. Hopefully, this will pinpoint the problem even better. ./configure --disable-all --disable-cgi --enable-debug --enable-session Running php on test.php: [root@scrabble php4-STABLE-200307151730]# sapi/cli/php -n test.php It didn't crash at all yet. [Tue Jul 15 12:45:46 2003] Script: 'test.php' --------------------------------------- /home/src/php4-STABLE-200307151730/ext/session/session.c(640) : Block 0x0018A5E8 status: Beginning: Overrun (magic=0x000000B4, expected=0x7312F8DC) Segmentation fault backtrace on gdb: (gdb) run -n test.php Starting program: /home/src/php4-STABLE-200307151730/sapi/cli/php -n test.php It didn't crash at all yet. [Tue Jul 15 12:46:47 2003] Script: 'test.php' --------------------------------------- /home/src/php4-STABLE-200307151730/ext/session/session.c(640) : Block 0x0018A5E8 status: Beginning: Overrun (magic=0x000000B4, expected=0x7312F8DC) Program received signal SIGSEGV, Segmentation fault. 0xff1f04f8 in memcpy () from /usr/platform/SUNW,Sun-Blade-100/lib/libc_psr.so.1 (gdb) bt #0 0xff1f04f8 in memcpy () from /usr/platform/SUNW,Sun-Blade-100/lib/libc_psr.so.1 #1 0x10813c in _mem_block_check (ptr=0x18a610, silent=0, __zend_filename=0x144410 "/home/src/php4-STABLE-200307151730/ext/session/session.c", __zend_lineno=640, __zend_orig_filename=0x0, __zend_orig_lineno=0) at /home/src/php4-STABLE-200307151730/Zend/zend_alloc.c:675 #2 0x1080f4 in _mem_block_check (ptr=0x18a610, silent=1, __zend_filename=0x144410 "/home/src/php4-STABLE-200307151730/ext/session/session.c", __zend_lineno=640, __zend_orig_filename=0x0, __zend_orig_lineno=0) at /home/src/php4-STABLE-200307151730/Zend/zend_alloc.c:667 #3 0x106c88 in _efree (ptr=0x18a610, __zend_filename=0x144410 "/home/src/php4-STABLE-200307151730/ext/session/session.c", __zend_lineno=640, __zend_orig_filename=0x0, __zend_orig_lineno=0) at /home/src/php4-STABLE-200307151730/Zend/zend_alloc.c:243 #4 0x243f8 in migrate_global (ht=0x1bce50, pos=0xffbfefe4) at /home/src/php4-STABLE-200307151730/ext/session/session.c:640 #5 0x245bc in php_session_save_current_state () at /home/src/php4-STABLE-200307151730/ext/session/session.c:670 #6 0x28494 in php_session_flush () at /home/src/php4-STABLE-200307151730/ext/session/session.c:1593 #7 0x284e4 in zm_deactivate_session (type=1, module_number=2) at /home/src/php4-STABLE-200307151730/ext/session/session.c:1607 #8 0x12660c in module_registry_cleanup (module=0x1ad328) at /home/src/php4-STABLE-200307151730/Zend/zend_API.c:1167 #9 0x12a928 in zend_hash_apply (ht=0x18ba78, apply_func=0x12659c <module_registry_cleanup>) at /home/src/php4-STABLE-200307151730/Zend/zend_hash.c:688 #10 0x1214b8 in zend_deactivate_modules () at /home/src/php4-STABLE-200307151730/Zend/zend.c:651 #11 0xccaf4 in php_request_shutdown (dummy=0x0) at /home/src/php4-STABLE-200307151730/main/main.c:981 #12 0x142f48 in main (argc=3, argv=0xffbff5d4) at /home/src/php4-STABLE-200307151730/sapi/cli/php_cli.c:874Interestingly, I am getting the same (similar?) bug on a Linux system (RedHat 7.3) with apache 1.3 and php 4.3.2. My stack trace from gdb: #0 0x403271a1 in _efree (ptr=0x403d01e4) at /usr/local/src/php-4.3.2/Zend/zend_alloc.c:259 #1 0x40294b7a in migrate_global (ht=0x81cbe5c, pos=0xbffff028) at /usr/local/src/php-4.3.2/ext/session/session.c:640 #2 0x40294c69 in php_session_save_current_state () at /usr/local/src/php-4.3.2/ext/session/session.c:670 #3 0x40297192 in php_session_flush () at /usr/local/src/php-4.3.2/ext/session/session.c:1591 #4 0x402971b7 in zm_deactivate_session (type=1, module_number=26) at /usr/local/src/php-4.3.2/ext/session/session.c:1605 #5 0x40338681 in module_registry_cleanup (module=0x80bb0a0) at /usr/local/src/php-4.3.2/Zend/zend_API.c:1167 #6 0x4033a410 in zend_hash_apply (ht=0x403d0560, apply_func=0x40338654 <module_registry_cleanup>) at /usr/local/src/php-4.3.2/Zend/zend_hash.c:688 #7 0x403358d6 in zend_deactivate_modules () at /usr/local/src/php-4.3.2/Zend/zend.c:634 #8 0x4030da19 in php_request_shutdown (dummy=0x0) at /usr/local/src/php-4.3.2/main/main.c:971 #9 0x4034fa91 in apache_php_module_main (r=0x811365c, display_source_mode=0) at /usr/local/src/php-4.3.2/sapi/apache/sapi_apache.c:60 #10 0x4035060e in send_php (r=0x811365c, display_source_mode=0, filename=0x0) at /usr/local/src/php-4.3.2/sapi/apache/mod_php4.c:617 #11 0x40350662 in send_parsed_php (r=0x811365c) at /usr/local/src/php-4.3.2/sapi/apache/mod_php4.c:632 #12 0x08054813 in ap_invoke_handler () #13 0x08069c6b in process_request_internal () #14 0x08069ccc in ap_process_request () #15 0x08060a69 in child_main () #16 0x08060c38 in make_child () #17 0x08060dac in startup_children () #18 0x08061424 in standalone_main () #19 0x08061ca3 in main () #20 0x400ab657 in __libc_start_main (main=0x80618e0 <main>, argc=2, ubp_av=0xbffffb64, init=0x804ec74 <_init>, fini=0x80814e0 <_fini>, rtld_fini=0x4000dcd4 <_dl_fini>, stack_end=0xbffffb5c) at ../sysdeps/generic/libc-start.c:129 (gdb) quitFrom the test-result: ---- EXPECTED OUTPUT Notice: Undefined index: foo in %s on line %d Notice: Undefined index: bar in %s on line %d NULL NULL array(0) { } array(2) { ["foo"]=> NULL ["bar"]=> NULL } ---- ACTUAL OUTPUT NULL NULL array(0) { } array(2) { ["foo"]=> NULL ["bar"]=> NULL } So far I couldnt manage to get the notices, when running the test-script. New Bug?