php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #71680 Multiple cURL calls cause malloc error after hostname lookup timeout
Submitted: 2016-02-28 01:34 UTC Modified: 2019-04-07 22:31 UTC
From: geoffdown at fastmail dot net Assigned:
Status: Closed Package: cURL related
PHP Version: 5.6.18 OS: OSX10.4
Private report: No CVE-ID: None
View Add Comment Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
You can add a comment by following this link or if you reported this bug, you can edit this bug over here.
(description)
Block user comment
Status: Assign to:
Package:
Bug Type:
Summary:
From: geoffdown at fastmail dot net
New email:
PHP Version: OS:

 

 [2016-02-28 01:34 UTC] geoffdown at fastmail dot net
Description:
------------
I was able to reproduce this on PHP4.4.9cli (came with the OS) and Macports PHP5.6 (latest version and latest cURL). Fetching multiple URLs, if one fetch times out because the name lookup gives a SERVFAIL (so not an NXDOMAIN) then a malloc error is thrown a few fetches afterwards - it varies, but within 50 I think. The precise point in the fetch function at which it throws the error may vary between PHP4 and 5 - the '1234567' count output should help spot where.
 

Test script:
---------------
<?php
function doRequest($method, $url, $referer, $agent, $timeout, $vars){
$ch=curl_init();
  curl_setopt($ch, CURLOPT_URL, $url);
  if ($referer != "")
  {
    curl_setopt($ch, CURLOPT_REFERER, $referer);
  }
  curl_setopt($ch, CURLOPT_USERAGENT, $agent);
  curl_setopt($ch, CURLOPT_HTTPHEADER, Array('Cache-Control: no-cache','Connection: close'));
  curl_setopt($ch, CURLOPT_HEADER, 1);
  curl_setopt($ch, CURLOPT_FOLLOWLOCATION,0);
  curl_setopt($ch, CURLOPT_MAXREDIRS,5);
  curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
  curl_setopt($ch, CURLOPT_TIMEOUT, $timeout);
  if ($method == 'POST')
  {
    curl_setopt($ch, CURLOPT_POST, 1);
    curl_setopt($ch, CURLOPT_POSTFIELDS, $vars);
  }
  if (substr($url, 0, 5) == "https")
  {
    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
    curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
  }
  echo '4';
  $data = curl_exec($ch);
  echo '5';
  curl_close($ch);
  echo '6';
  return $data;
}

$urls=array('http://catiisleri.com/index.php');
$urls=array_merge($urls,array_fill(1,400,'http://php.net/?sorryimdebuggingabugincurl'));
$agent='Mozilla/4.0 (Windows; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)';
$timeout=15;
$datacount=0;  
//  echo memory_get_usage(), "\n"; //uncomment for PHP5

for($i=0;$i<count($urls);$i++){
 echo '1';
 $url=$urls[$i].rand(0,10000);
 echo '2 ';
 $referer=$url;
// echo memory_get_usage(); //uncomment for PHP5
 echo " $datacount $url $i\n";
 echo '3';
 $res=doRequest('GET', $url, $referer, $agent, $timeout, $post);
 $datacount=$datacount+strlen($res);
 echo "7\n";
 }  //next url


unset($res);
unset($referer);
//  echo memory_get_usage(), "\n"; //uncomment for PHP5
?>

Expected result:
----------------
Finish fetching all URLs with no errors.
In the test script output, the number before the URL is the cumulative amount of data fetched so far and the number following is the number of URLs fetched so far. In the PHP5 version, memory_get_usage() is also shown.

Actual result:
--------------
FOR PHP4:
php4 curltest
12  0 http://catiisleri.com/index.php2620 0
34567
12  0 http://php.net/?sorryimdebuggingabugincurl5460 1
34567
12  20277 http://php.net/?sorryimdebuggingabugincurl5019 2
34567
12  40554 http://php.net/?sorryimdebuggingabugincurl148 3
34567
12  60831 http://php.net/?sorryimdebuggingabugincurl8837 4
34567
12  81108 http://php.net/?sorryimdebuggingabugincurl6812 5
34567
12  101385 http://php.net/?sorryimdebuggingabugincurl6024 6
34567
12  121662 http://php.net/?sorryimdebuggingabugincurl371 7
34567
12  141939 http://php.net/?sorryimdebuggingabugincurl9878 8
34567
12  162216 http://php.net/?sorryimdebuggingabugincurl7184 9
34567
12  182493 http://php.net/?sorryimdebuggingabugincurl886 10
34567
12  202770 http://php.net/?sorryimdebuggingabugincurl99 11
34567
12  223047 http://php.net/?sorryimdebuggingabugincurl8979 12
34567
12  243324 http://php.net/?sorryimdebuggingabugincurl8464 13
34567
12  263601 http://php.net/?sorryimdebuggingabugincurl6528 14
34567
12  283878 http://php.net/?sorryimdebuggingabugincurl6718 15
34567
12  304155 http://php.net/?sorryimdebuggingabugincurl4957 16
34567
12  324432 http://php.net/?sorryimdebuggingabugincurl8378 17
34567
12  344709 http://php.net/?sorryimdebuggingabugincurl2921 18
34php4(411) malloc: *** vm_allocate(size=20480) failed (error code=-301)
php4(411) malloc: *** error: can't allocate region
php4(411) malloc: *** set a breakpoint in szone_error to debug
FATAL:  erealloc():  Unable to allocate 18026 bytes
...etc

FOR PHP5:
147968
12 148256 0 http://catiisleri.com/index.php9816 0
34567
12 148560 0 http://php.net/?sorryimdebuggingabugincurl4966 1
34567
12 168848 20277 http://php.net/?sorryimdebuggingabugincurl9456 2
34567
12 168848 40554 http://php.net/?sorryimdebuggingabugincurl4195 3
34567
12 168848 60831 http://php.net/?sorryimdebuggingabugincurl1592 4
34567
12 168848 81108 http://php.net/?sorryimdebuggingabugincurl4880 5
34567
12 168848 101385 http://php.net/?sorryimdebuggingabugincurl4739 6
34567
12 168848 121662 http://php.net/?sorryimdebuggingabugincurl4653 7
34567
12 168848 141939 http://php.net/?sorryimdebuggingabugincurl4581 8
34567
12 168848 162216 http://php.net/?sorryimdebuggingabugincurl4155 9
34567
12 168848 182493 http://php.net/?sorryimdebuggingabugincurl2872 10
34567
12 168848 202770 http://php.net/?sorryimdebuggingabugincurl9770 11
34567
12 168848 223047 http://php.net/?sorryimdebuggingabugincurl868 12
34567
12 168848 243324 http://php.net/?sorryimdebuggingabugincurl1794 13
34567
12 168848 263601 http://php.net/?sorryimdebuggingabugincurl3863 14
34567
12 168848 283878 http://php.net/?sorryimdebuggingabugincurl8450 15
34567
12 168848 304155 http://php.net/?sorryimdebuggingabugincurl1911 16
34567
12 168848 324432 http://php.net/?sorryimdebuggingabugincurl8232 17
34567
12 168848 344709 http://php.net/?sorryimdebuggingabugincurl4539 18
34567
12 168848 364986 http://php.net/?sorryimdebuggingabugincurl7398 19
345php(444) malloc: *** error for object 0x22dd000: Can't deallocate_pages region
php(444) malloc: *** set a breakpoint in szone_error to debug
67
12 168848 385263 http://php.net/?sorryimdebuggingabugincurl4868 20
3php(444) malloc: *** vm_allocate(size=36864) failed (error code=-301)
php(444) malloc: *** error: can't allocate region
php(444) malloc: *** set a breakpoint in szone_error to debug
... etc


Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2019-03-26 16:36 UTC] mike@php.net
-Status: Open +Status: Feedback
 [2019-03-26 16:36 UTC] mike@php.net
Thank you for taking the time to report a problem with PHP.
Unfortunately you are not using a current version of PHP -- 
the problem might already be fixed. Please download a new
PHP version from http://www.php.net/downloads.php

If you are able to reproduce the bug with one of the latest
versions of PHP, please change the PHP version on this bug report
to the version you tested and change the status back to "Open".
Again, thank you for your continued support of PHP.


 [2019-04-07 04:22 UTC] php-bugs at lists dot php dot net
No feedback was provided. The bug is being suspended because
we assume that you are no longer experiencing the problem.
If this is not the case and you are able to provide the
information that was requested earlier, please do so and
change the status of the bug back to "Re-Opened". Thank you.
 [2019-04-07 22:31 UTC] geoffdown at fastmail dot net
-Status: No Feedback +Status: Closed
 [2019-04-07 22:31 UTC] geoffdown at fastmail dot net
Well, three years later it's not surprising that the version has changed :-/
But I did take the time to update PHP and curl and the test script runs without error.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Thu Apr 18 01:01:28 2024 UTC