PHP :: Bug #67150 :: Segfault in zend_call

Bug #67150

Segfault in zend_call_function

Submitted:

2014-04-29 13:38 UTC

Modified:

2014-12-30 10:42 UTC

Votes:	1
Avg. Score:	5.0 ± 0.0
Reproduced:	1 of 1 (100.0%)
Same Version:	0 (0.0%)
Same OS:	0 (0.0%)

From:

nefthy-php at nefthy dot de

Assigned:

Status:

No Feedback

Package:

Reproducible crash

PHP Version:

5.5.11

OS:

Gentoo/Linux

Private report:

CVE-ID:

None

View Developer Edit

[2014-04-29 13:38 UTC] nefthy-php at nefthy dot de

Description:
------------
The apache PHP module segfault while procesing a POST request on a symfony2 project.

# php -v
PHP 5.5.11-pl0-gentoo (cli) (built: Apr 10 2014 15:04:45) 
Copyright (c) 1997-2014 The PHP Group
Zend Engine v2.5.0, Copyright (c) 1998-2014 Zend Technologies
    with Zend OPcache v7.0.4-dev, Copyright (c) 1999-2014, by Zend Technologies
    with Xdebug v2.2.3, Copyright (c) 2002-2013, by Derick Rethans

Test script:
---------------
I cannot isolate the php code that is causing the crash.

Expected result:
----------------
should not crash

Actual result:
--------------
Backtrace:

Core was generated by `/usr/sbin/apache2 -D CGI -D PHP5 -D DEFAULT_VHOST -d /usr/lib64/apache2 -f /etc'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x00007effd8801d09 in zend_call_function (fci=fci@entry=0x1a905b8, fci_cache=fci_cache@entry=0x1a90600)
    at /var/tmp/portage/dev-lang/php-5.5.11/work/sapis-build/apache2/Zend/zend_execute_API.c:812

warning: Source file is more recent than executable.
812                 (!EG(objects_store).object_buckets || !EG(objects_store).object_buckets[Z_OBJ_HANDLE_P(fci->object_ptr)].valid)) {
(gdb) bt
#0  0x00007effd8801d09 in zend_call_function (fci=fci@entry=0x1a905b8, fci_cache=fci_cache@entry=0x1a90600)
    at /var/tmp/portage/dev-lang/php-5.5.11/work/sapis-build/apache2/Zend/zend_execute_API.c:812
#1  0x00007effd881c817 in zend_fcall_info_call (fci=0x1a905b8, fcc=0x1a90600, 
    retval_ptr_ptr=retval_ptr_ptr@entry=0x7fffd624fa60, args=args@entry=0x0)
    at /var/tmp/portage/dev-lang/php-5.5.11/work/sapis-build/apache2/Zend/zend_API.c:3386
#2  0x00007effd87c25da in php_output_handler_op (context=0x7fffd624faa0, handler=0x1bfe3a8)
    at /var/tmp/portage/dev-lang/php-5.5.11/work/sapis-build/apache2/main/output.c:962
#3  php_output_stack_pop (flags=16) at /var/tmp/portage/dev-lang/php-5.5.11/work/sapis-build/apache2/main/output.c:1229
#4  php_output_discard () at /var/tmp/portage/dev-lang/php-5.5.11/work/sapis-build/apache2/main/output.c:344
#5  0x00007effd87c2bbc in zif_ob_get_clean (ht=<optimized out>, return_value=0x1bc8f38, return_value_ptr=<optimized out>, 
    this_ptr=<optimized out>, return_value_used=<optimized out>)
    at /var/tmp/portage/dev-lang/php-5.5.11/work/sapis-build/apache2/main/output.c:1438
#6  0x00007effd1f98325 in xdebug_execute_internal (current_execute_data=0x7effdf3f55b8, fci=0x0, return_value_used=1)
    at /var/tmp/portage/dev-php/xdebug-2.2.3/work/php5.5/xdebug.c:1553
#7  0x00007effd88d77dc in zend_do_fcall_common_helper_SPEC (execute_data=<optimized out>)
    at /var/tmp/portage/dev-lang/php-5.5.11/work/sapis-build/apache2/Zend/zend_vm_execute.h:552
#8  0x00007effd883e6f8 in execute_ex (execute_data=0x7effdf3f55b8)
    at /var/tmp/portage/dev-lang/php-5.5.11/work/sapis-build/apache2/Zend/zend_vm_execute.h:363
#9  0x00007effd1f987d6 in xdebug_execute_ex (execute_data=0x7effdf3f55b8)
    at /var/tmp/portage/dev-php/xdebug-2.2.3/work/php5.5/xdebug.c:1437
#10 0x00007effd88d7e85 in zend_do_fcall_common_helper_SPEC (execute_data=0x7effdf3f5490)
    at /var/tmp/portage/dev-lang/php-5.5.11/work/sapis-build/apache2/Zend/zend_vm_execute.h:584
#11 0x00007effd883e6f8 in execute_ex (execute_data=0x7effdf3f5490)
    at /var/tmp/portage/dev-lang/php-5.5.11/work/sapis-build/apache2/Zend/zend_vm_execute.h:363
#12 0x00007effd1f987d6 in xdebug_execute_ex (execute_data=0x7effdf3f5490)
    at /var/tmp/portage/dev-php/xdebug-2.2.3/work/php5.5/xdebug.c:1437
#13 0x00007effd88d7e85 in zend_do_fcall_common_helper_SPEC (execute_data=0x7effdf3f5320)
    at /var/tmp/portage/dev-lang/php-5.5.11/work/sapis-build/apache2/Zend/zend_vm_execute.h:584
#14 0x00007effd883e6f8 in execute_ex (execute_data=0x7effdf3f5320)
    at /var/tmp/portage/dev-lang/php-5.5.11/work/sapis-build/apache2/Zend/zend_vm_execute.h:363
#15 0x00007effd1f987d6 in xdebug_execute_ex (execute_data=0x7effdf3f5320)
    at /var/tmp/portage/dev-php/xdebug-2.2.3/work/php5.5/xdebug.c:1437
#16 0x00007effd88d7e85 in zend_do_fcall_common_helper_SPEC (execute_data=0x7effdf3f51f0)
    at /var/tmp/portage/dev-lang/php-5.5.11/work/sapis-build/apache2/Zend/zend_vm_execute.h:584
#17 0x00007effd883e6f8 in execute_ex (execute_data=0x7effdf3f51f0)
    at /var/tmp/portage/dev-lang/php-5.5.11/work/sapis-build/apache2/Zend/zend_vm_execute.h:363
#18 0x00007effd1f987d6 in xdebug_execute_ex (execute_data=0x7effdf3f51f0)
    at /var/tmp/portage/dev-php/xdebug-2.2.3/work/php5.5/xdebug.c:1437
#19 0x00007effd88d7e85 in zend_do_fcall_common_helper_SPEC (execute_data=0x7effdf3f50c0)
    at /var/tmp/portage/dev-lang/php-5.5.11/work/sapis-build/apache2/Zend/zend_vm_execute.h:584
#20 0x00007effd883e6f8 in execute_ex (execute_data=0x7effdf3f50c0)
    at /var/tmp/portage/dev-lang/php-5.5.11/work/sapis-build/apache2/Zend/zend_vm_execute.h:363
#21 0x00007effd1f987d6 in xdebug_execute_ex (execute_data=0x7effdf3f50c0)
    at /var/tmp/portage/dev-php/xdebug-2.2.3/work/php5.5/xdebug.c:1437
#22 0x00007effd881221f in zend_execute_scripts (type=type@entry=8, retval=retval@entry=0x0, file_count=file_count@entry=3)
    at /var/tmp/portage/dev-lang/php-5.5.11/work/sapis-build/apache2/Zend/zend.c:1316
#23 0x00007effd87aca27 in php_execute_script (primary_file=primary_file@entry=0x7fffd6252be0)
    at /var/tmp/portage/dev-lang/php-5.5.11/work/sapis-build/apache2/main/main.c:2506
#24 0x00007effd88d95c2 in php_handler (r=0x14675d0)
    at /var/tmp/portage/dev-lang/php-5.5.11/work/sapis-build/apache2/sapi/apache2handler/sapi_apache2.c:667
#25 0x000000000045169a in ap_run_handler (r=0x14675d0) at config.c:169
#26 ap_invoke_handler (r=r@entry=0x14675d0) at config.c:439
#27 0x000000000046864a in ap_process_async_request (r=r@entry=0x14675d0) at http_request.c:317
#28 0x0000000000468914 in ap_process_request (r=r@entry=0x14675d0) at http_request.c:363
#29 0x000000000046439b in ap_process_http_sync_connection (c=0x14614c0) at http_core.c:190
#30 ap_process_http_connection (c=0x14614c0) at http_core.c:231
#31 0x000000000045bf08 in ap_run_process_connection (c=0x14614c0) at connection.c:41
#32 ap_process_connection (c=c@entry=0x14614c0, csd=<optimized out>) at connection.c:202
#33 0x00000000004702a5 in child_main (child_num_arg=child_num_arg@entry=0) at prefork.c:704
#34 0x00000000004714d4 in make_child (slot=0, s=0xfff538) at prefork.c:800
#35 startup_children (number_to_start=5) at prefork.c:818
#36 prefork_run (_pconf=<optimized out>, plog=0x1003378, s=0xfff538) at prefork.c:976
#37 0x000000000043150e in ap_run_mpm (pconf=0xfd6138, plog=0x1003378, s=0xfff538) at mpm_common.c:96
#38 0x00000000004295f5 in main (argc=13, argv=0x7fffd62533e8) at main.c:777

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports

[2014-05-01 18:14 UTC] aharvey@php.net

-Status: Open +Status: Feedback

[2014-05-01 18:14 UTC] aharvey@php.net

Do you still get the crash if you disable xdebug?

[2014-05-01 18:23 UTC] nefthy-php at nefthy dot de

-Status: Feedback +Status: Open

[2014-05-01 18:23 UTC] nefthy-php at nefthy dot de

I haven't checked with xdebug disabled, but it goes away if I disable the symfony2 debugging, which apparently installs some fancy callback to catch fatal error.

[2014-05-01 18:30 UTC] aharvey@php.net

-Status: Open +Status: Feedback

[2014-05-01 18:30 UTC] aharvey@php.net

My point is that xdebug fundamentally changes the way PHP operates, and if the crash only happens with xdebug, then it should be reported to them, not the PHP project.

[2014-12-30 10:42 UTC] php-bugs at lists dot php dot net

No feedback was provided. The bug is being suspended because
we assume that you are no longer experiencing the problem.
If this is not the case and you are able to provide the
information that was requested earlier, please do so and
change the status of the bug back to "Re-Opened". Thank you.

	php.net \| support \| documentation \| report a bug \| advanced search \| search howto \| statistics \| random bug \| login
go to bug id or search bugs for


Copyright © 2001-2026 The PHP Group All rights reserved.	Last updated: Tue Oct 06 21:00:01 2026 UTC