PHP :: Bug #73310 :: PECL OAuth segfaults when OPcache is enabled in PHP 7

Bug #73310

PECL OAuth segfaults when OPcache is enabled in PHP 7

Submitted:

2016-10-13 04:33 UTC

Modified:

2022-01-03 09:20 UTC

Votes:	34
Avg. Score:	4.4 ± 0.7
Reproduced:	33 of 34 (97.1%)
Same Version:	19 (57.6%)
Same OS:	11 (33.3%)

From:

james at dunarri dot com

Assigned:

cmb (profile)

Status:

No Feedback

Package:

*General Issues

PHP Version:

7.0.11

OS:

CentOS 7.2

Private report:

CVE-ID:

None

View Add Comment Developer Edit

[2016-10-13 04:33 UTC] james at dunarri dot com

Description:
------------
Installed OAuth 2.0.2 via pecl install oauth on a system running PHP 7.0.11

I didn't have problems like this prior to installing the OAuth extension, and it only happens on scripts that make OAuth calls. The following is what is happening:

1. run "systemctl restart php-fpm" to get a fresh start
2. access a script that makes an OAuth fetch call, works fine the first time
3. refresh the script, now I get "Allowed memory size of 2147483648 bytes exhausted (tried to allocate 4294967426 bytes)" the line it points to for this error is calling oauth->fetch
4. refresh a 3rd time, now I get a 503 and the php-fpm error.log shows "child exited on signal 11 (SIGSEGV - core dumped)"
5. every refresh after this produces a SIGSEGV, yet other PHP code still works fine.


Test script:
---------------
<?php
$oauth = new OAuth('2c3b6b01ed6d890bfe9bf6d86b4ca9a3', '22c64228b04198d5c9cfbec07b8949fd');
$oauth->enableDebug();
$oauth->setToken('5bb125fb3aaed2dbb2a42e67d189ab6d', 'b577b44f911db8cd0879e2c827ebe3e3');
$headers = array('Content-Type' => 'application/json', 'Accept' => 'application/json');
// the next line causes the bug
$oauth->fetch('http://wildscooterparts.com/api/rest/products/56', null, OAUTH_HTTP_METHOD_GET, $headers);
echo '<pre>'; print_r($oauth->getLastResponseInfo());
?>


Expected result:
----------------
The response info should be output everytime it is run, not just the first time. php-fpm should not SIGSEGV!!

Actual result:
--------------
After the first run, php-fpm generates a SIGSEGV when running the script and outputs 503 to the browser.

core_backtrace contains this:
{   "signal": 11
,   "executable": "/usr/sbin/php-fpm"
,   "stacktrace":
      [ {   "crash_thread": true
        ,   "frames":
              [ {   "address": 140307830553088
                ,   "build_id_offset": 140307830553088
                } ]
        } ]
}

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports

[2016-10-13 04:50 UTC] james at dunarri dot com

Can you please change this to PRIVATE?? I didn't know my oauth tokens would be going on the public internet or I wouldn't have posted the test script.

[2016-10-13 06:16 UTC] james at dunarri dot com

It's not just php-fpm, I tried switching back to mod_php and prefork to alleviate my troubles and the same thing is happening. have to restart httpd to get it to work once, then:
AH00052: child pid 16825 exit signal Segmentation fault (11)

[2016-10-13 06:53 UTC] james at dunarri dot com

-Summary: PECL OAuth corrupts memory in php-fpm +Summary: PECL OAuth segfaults when OPcache is enabled in PHP 7

[2016-10-13 06:53 UTC] james at dunarri dot com

The bug is actually due to the OPcache, I disabled it via .user.ini and the problem went away. However, we need OPcache for performance!

[2016-11-07 20:16 UTC] shelbylmoore at gmail dot com

A potential workaround is to blacklist the files leveraging the oauth extension for opcache using the opcache.blacklist_file config option in opcache.ini

[2016-11-09 14:16 UTC] ionut dot breta at zitec dot com

Hello,

I'm experiencing the same problem on CentOS 6.8 with PHP 7.0.12, but only on PHP-FPM SAPI. An interesting thing I've discovered is that if I don't send the headers parameter to the fetch method, the client works flawlessly (when OPCache enabled).

[2016-12-07 12:19 UTC] black at zypo dot com

Sadly we can still validate this for PHP 7.1.0 (OPcache 7.1.0) and OAuth 2.0.2 via PHP-FPM on Mac OS 10.11.6.

This works flawlessly with PHP 5.6.6 (OPcache 7.0.4-dev) and OAuth 1.2.3 on the same system, also via PHP-FPM.

And as donut said, if you call $oauth->fetch(<url>, <data>, <method>) - Without the 4th parameter "<header>", it also works with PHP 7.1.0.

[2016-12-21 15:19 UTC] php dot qa at sebastianmendel dot de

[2017-03-28 10:19 UTC] beganovic dot emir at gmail dot com

The segfault doesn't occur anymore with PHP 7.1.3.
The test script now throws exception as expected (OAuthException):

 Uncaught OAuthException: Invalid auth/bad request (got a 401, expected HTTP/1.1 20X or a redirect)

[2018-04-17 18:16 UTC] martin dot zwickel at efficient dot it

I get out of memory exceptions when using OPCache + PHP 7.1.16 and the OAuth 2.0.2 under Ubuntu 16.04:

PHP Fatal error:  Allowed memory size of 805306368 bytes exhausted (tried to allocate 12383783844356333714 bytes) in .../oauth.php
PHP Fatal error:  Allowed memory size of 805306368 bytes exhausted (tried to allocate 9230944994605164725 bytes) in .../oauth.php

This is the "special" code:
                $this->_oAuth = new \OAuth($key, $secret, OAUTH_SIG_METHOD_HMACSHA1, OAUTH_AUTH_TYPE_AUTHORIZATION);
                $this->_oAuth->disableSSLChecks();
                $this->_oAuth->setToken($token, $tokensecret);

                $this->oAuth->fetch($requestUrl, json_encode($postData), OAUTH_HTTP_METHOD_POST, array('Content-Type' => 'application/json'));
                $response = $this->oAuth->getLastResponse();

Just does an API request to magento.

PHP Version: 7.1.16-1+ubuntu16.04.1+deb.sury.org+1

Only blacklisting the file that use OAuth helps. Or disabling OPCache completely.

Will there be a bug fix release?

[2019-01-24 21:06 UTC] james at dunarri dot com

Is this project even active? Can't believe it's been over 2 years and this issue still persists (now on PHP 7.1.26)!
I had used the opcache blacklist file suggested and happily went on my way and forgot about this bug only to be bitten by it again when I renamed one of the blacklisted files.

[2019-02-06 15:48 UTC] lenormand dot sbn at gmail dot com

this bug still persists with php7.2.10 and Uservoice. The solution for me is to uncomment the line 'opcache.enable = 0' in the file php.ini or used 'phpdismod opcache'. Is there any other way to get around it?

[2021-07-27 11:32 UTC] cmb@php.net

-Status: Open +Status: Feedback -Assigned To: +Assigned To: cmb

[2021-07-27 11:32 UTC] cmb@php.net

Does this still happen with any of the actively supported PHP
versions[1] and latest oauth (2.0.7)?

[1] <php.net/supported-versions.php>

[2021-08-08 04:22 UTC] pecl-dev at lists dot php dot net

No feedback was provided. The bug is being suspended because
we assume that you are no longer experiencing the problem.
If this is not the case and you are able to provide the
information that was requested earlier, please do so and
change the status of the bug back to "Re-Opened". Thank you.

[2022-01-02 15:12 UTC] php at amberon dot ru

Reproduced on php 8.0.13 + oauth 2.0.7

[2022-01-03 09:20 UTC] cmb@php.net

-Package: oauth +Package: *General Issues

[2022-01-03 09:20 UTC] cmb@php.net

Please report oauth related issues at
<https://github.com/php/pecl-web_services-oauth/issues>.

	php.net \| support \| documentation \| report a bug \| advanced search \| search howto \| statistics \| random bug \| login
go to bug id or search bugs for


Copyright © 2001-2022 The PHP Group All rights reserved.	Last updated: Fri Aug 12 09:05:46 2022 UTC