php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #48034 Crash when script is 8192 (8KB) bytes long
Submitted: 2009-04-21 10:22 UTC Modified: 2017-01-11 16:38 UTC
Votes:20
Avg. Score:3.9 ± 1.4
Reproduced:15 of 17 (88.2%)
Same Version:14 (93.3%)
Same OS:4 (26.7%)
From: ninzya at inbox dot lv Assigned: dmitry (profile)
Status: Closed Package: Reproducible crash
PHP Version: 5.*, 6CVS (2009-04-21) OS: *
Private report: No CVE-ID: None
View Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
If you reported this bug, you can edit this bug over here.
(description)
Block user comment
Status: Assign to:
Package:
Bug Type:
Summary:
From: ninzya at inbox dot lv
New email:
PHP Version: OS:

 

 [2009-04-21 10:22 UTC] ninzya at inbox dot lv
Description:
------------
Configuration: Apache HTTPd 2.0.61.200
PHP: 5.3.0RC1
OS: Windows XP SP3

PHP crashes apache when php file including php tags + data between them is 8192 bytes (8KB) long.

Reproduce code:
---------------
Create file with the following content:

<?php(any 8185 byte long data)?>

or

<?(any 8188 byte long data)?>

and request it through the browser.

Expected result:
----------------
No crashes

Actual result:
--------------
Crash

Patches

mmap.diff.txt (last revision 2012-01-16 14:43 UTC by dmitry at zend dot com)

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2009-04-21 11:14 UTC] jani@php.net
Also: Exactly how does it crash? Are you sure it crashes? How did you configure PHP in Apache? (READ: Not enough information, 99% bogus..)
 [2009-04-21 11:27 UTC] ninzya at inbox dot lv
http://www.stepanov.lv/pub/bug48034.txt <-- php file contents
PHP as module.
It crashes by displaying "Apache.exe - Application error" window, saying "The instruction at 0x0085779c referenced memory at 0x061e2000 (this actually varies). The memory could not be read. Click OK to terminate the program."

(BTW, what is your formula for bogusness percentage?)
 [2009-04-21 11:40 UTC] jani@php.net
Which apache module? Do you have some fancy filtering going on? Does this happen with PHP 5.2.9 ? Do you have any shared extensions loaded? Any Zend extensions like debugger or cache? (disable those and retry)
 [2009-04-21 11:50 UTC] ninzya at inbox dot lv
PHP is installed as apache module.
No fancy filtering, default php/apache installation.
All php modules disabled.

Bug hits only if file size is 8KB exactly (8192 bytes). PHP 5.2.9 also is affected.

By the way, Apache 2.2 is not affected. Seems this is apache 2.0 specific problem. Don't know where to post this issue, here, or in Apache bugtracker.
 [2009-04-21 15:31 UTC] lbarnaud@php.net
It seems related to http://bugs.php.net/bug.php?id=47596 . Not exactly the same problem, though.
It seems php_stream_open_for_zend() does not mmap() enough for ZEND_MMAP_AHEAD (PHP_STREAM_OPTION_MMAP_API in plain_wrapper adjusts the mmap length to the filesize, so ignoring ZEND_MMAP_AHEAD), and this may crash when the parser reads ahead of the mmap()ed region. 
 [2009-04-21 17:20 UTC] ninzya at inbox dot lv
I did everything mentioned in http://bugs.php.net/bugs-generating-backtrace-win32.php

and got these results:

Thread 250 - System ID 5552
Entry point   msvcrt!_endthreadex+3a 
Create time   21.04.2009 15:20:51 
Time spent in user mode   0 Days 0:0:0.656 
Time spent in kernel mode   0 Days 0:0:0.921 


Function     Arg 1     Arg 2     Arg 3   Source 
php5ts!lex_scan+447c     0550fa34     010f54a0     0000002f    
php5ts!zend_register_auto_global+11f     00000000     00000000     00000000
 [2009-04-22 11:09 UTC] bjori@php.net
See also bug#48043
 [2009-04-28 07:16 UTC] dmitry@php.net
This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.


 [2009-05-04 16:06 UTC] pajoye@php.net
Not fixed. Only a temp hack.
 [2012-01-11 09:12 UTC] bugzilla33 at gmail dot com
Description:
------------
1. use Test script to generate crash.php, size 8192 bytes
2. now let crash php engine crash.php
3. Any php file of size 8192 bytes crashes Apache and PHP!
4. Tested with Apache 2.2.21 V9 apache longue, PHP 5.4.0 RC5 or RC6 dev on three other machines, Win 7 x86 or Win 7 x64.

Test script:
---------------
testcase php file generator:

<?php

 $out='<?php//';
 for($z=0;$z<8192-9;$z++){$out.=mt_rand(0,9);}
 $out.='?>';

 file_put_contents('crash.php',$out);

 print('1. testcase file generated: crash.php, size '.strlen($out).' bytes<br/>');
 print('2. now let crash php engine <a href="crash.php">crash.php</a><br/>');
 print('<b style="color:red">3. Any php file of size 8192 bytes crashes Apache and PHP!</b><br/>');
 print('4. Tested with Apache 2.2.21 V9 apache longue, PHP 5.4.0 RC5 or RC6 dev on three other machines, Win 7 x86 or Win 7 x64.<br/>');
?>

Expected result:
----------------
NO crash

Actual result:
--------------
CRASH
 [2012-01-11 09:35 UTC] bugzilla33 at gmail dot com
The shortest working example:

<?php
 file_put_contents('8192_testcase.php',str_repeat(' ',8192));
?>
<a href="8192_testcase.php">run testcase</a>

Use Apache 2.2.21, PHP 5.*, Win 7 x86/x64
 [2012-01-16 11:56 UTC] pvasilevich at parallels dot com
This problem reproduced in 5.3.9 released in public/

It looks like temporary workaround commmited by dmitry in 
Revision: 279490
(Date: 2:13:30 PM, Tuesday, April 28, 2009)
Message:
Fixed bug #48034 (PHP crashes when script is 8192 (8KB) bytes long)

has been replaced by 

Revision: 316812
Author: dmitry
Date: 6:30:17 PM, Thursday, September 15, 2011
Message:
Fixed bug #50982 (incorrect assumption of PAGE_SIZE size)

And bug appeared again.

Please fix this problem ASAP.
 [2012-01-16 14:46 UTC] dmitry at zend dot com
Can anyone check if the attached patch fixes the problem?
 [2012-01-16 17:09 UTC] pvasilevich at parallels dot com
I have applied similar patch and problem solved. ( I have removed #ifdef HAVE_MMAP at all)
 [2012-01-16 23:09 UTC] pajoye@php.net
From Matt (our tester/QA team):
"I've tested the patch from 48034 on php_5_4 r322075 on Win7 x64 sp1 and it 
fixes the bug from 60771.

I tested the repro script PID1080 from 60771 that produces a >8k text file and 
tries to require it.

I also produced another >8k file myself and added some php code to it (inside <?
php tags) and required it from another script. With 48034 patch, that also 
works."

phpt for that is coming too
 [2012-01-17 08:15 UTC] pajoye@php.net
Dmitry,

I think you can apply it already :)
 [2012-01-17 09:30 UTC] dmitry@php.net
Automatic comment from SVN on behalf of dmitry
Revision: http://svn.php.net/viewvc/?view=revision&amp;revision=322384
Log: Fixed workaround for bug #48034 on Windows (Crash when script is 8192 (8KB) bytes long)
 [2012-03-23 17:46 UTC] ninzya at inbox dot lv
Just ran into this problem again, almost exactly two years later :) But this time 
with 4KB (4096 bytes) long script:

<?php(any 4089 bytes long data)?>
 [2012-03-23 17:49 UTC] pajoye@php.net
@ninzya at inbox dot lv

It was not in 5.3.10, so please try with 5.3 snapshots.
 [2012-03-23 20:47 UTC] ninzya at inbox dot lv
Few hours ago tried PHP 5.4. Bug is still there.
 [2012-03-23 21:50 UTC] pajoye@php.net
Dmitry, was it ported to 5.4 already?
 [2017-01-11 16:38 UTC] leigh@php.net
-Status: Assigned +Status: Closed
 [2017-01-11 16:38 UTC] leigh@php.net
Cannot reproduce on 5.6, 7.0, 7.1 or master. Assuming fixed.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Sat Oct 05 12:01:27 2024 UTC