php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #73363 Segfault in fputcsv() when using output from apc_cache_info()
Submitted: 2016-10-21 13:06 UTC Modified: 2016-11-06 04:22 UTC
From: thomas dot ploch at flixbus dot com Assigned: cmb (profile)
Status: No Feedback Package: Filesystem function related
PHP Version: 7.0.12 OS: Debian 3.16.36-1+deb8u1
Private report: No CVE-ID: None
Have you experienced this issue?
Rate the importance of this bug to you:

 [2016-10-21 13:06 UTC] thomas dot ploch at flixbus dot com
Description:
------------
We tried to analyze some apc cache statistics and ran a short script that would create a CSV file from the output of `apc_cache_info()` (attached). We were then hitting a segfault in `fputcsv` (bt attached).

$ php -v
PHP 7.0.12-1~dotdeb+8.1 (cli) ( NTS )
Copyright (c) 1997-2016 The PHP Group
Zend Engine v3.0.0, Copyright (c) 1998-2016 Zend Technologies
    with Zend OPcache v7.0.12-1~dotdeb+8.1, Copyright (c) 1999-2016, by Zend Technologies

$ php -m
[PHP Modules]
amqp
apc
apcu
bcmath
calendar
Core
ctype
curl
date
dom
exif
fileinfo
filter
ftp
gd
gettext
hash
iconv
igbinary
imagick
intl
json
libxml
mbstring
mcrypt
mysqli
mysqlnd
newrelic
openssl
pcntl
pcre
PDO
pdo_mysql
Phar
posix
readline
Reflection
session
shmop
SimpleXML
sockets
SPL
standard
sysvmsg
sysvsem
sysvshm
tokenizer
wddx
xml
xmlreader
xmlrpc
xmlwriter
xsl
Zend OPcache
zip
zlib

[Zend Modules]
Zend OPcache



Test script:
---------------
<?php

$fp = fopen('/tmp/caches.csv', 'w+');
if (!$fp) {
  throw new \Exception("Unable to create file");
}
$apc = apcu_cache_info();
foreach ($apc['cache_list'] as $item) {
  fputs($fp, join(',', [$item['info']]));
}

fclose($fp);

Actual result:
--------------
(gdb) bt
#0  php_fputcsv (stream=<optimized out>, fields=<optimized out>, 
    delimiter=delimiter@entry=44 ',', enclosure=enclosure@entry=34 '"', 
    escape_char=escape_char@entry=92 '\\')
    at /usr/src/builddir/ext/standard/file.c:1906
#1  0x00007f0e47c3ea80 in zif_fputcsv (execute_data=<optimized out>, 
    return_value=0x7f0e44c140d0) at /usr/src/builddir/ext/standard/file.c:1874
#2  0x00007f0e47ce111a in dtrace_execute_internal (execute_data=<optimized out>, 
    return_value=<optimized out>) at /usr/src/builddir/Zend/zend_dtrace.c:107
#3  0x00007f0e47d76250 in ZEND_DO_FCALL_SPEC_HANDLER ()
    at /usr/src/builddir/Zend/zend_vm_execute.h:844
#4  0x00007f0e47d315db in execute_ex (ex=ex@entry=0x7f0defa31e38)
    at /usr/src/builddir/Zend/zend_vm_execute.h:414
#5  0x00007f0e47ce0fa8 in dtrace_execute_ex (execute_data=0x7f0defa31e38)
    at /usr/src/builddir/Zend/zend_dtrace.c:83
#6  0x00007f0e34d8177a in nr_php_execute_file ()
    at /home/hudson/slave-workspace/workspace/php-release-agent/label/centos5-64-nrcamp/agent/php_execute.c:827
#7  nr_php_execute_enabled ()
    at /home/hudson/slave-workspace/workspace/php-release-agent/label/centos5-64-nrcamp/agent/php_execute.c:1049
#8  0x00007f0e34d81c72 in nr_php_execute ()
    at /home/hudson/slave-workspace/workspace/php-release-agent/label/centos5-64-nrcamp/agent/php_execute.c:1277
#9  0x00007f0e47d860a7 in zend_execute (op_array=op_array@entry=0x7f0e44c8b000, 
    return_value=return_value@entry=0x0)
    at /usr/src/builddir/Zend/zend_vm_execute.h:458
#10 0x00007f0e47cf1323 in zend_execute_scripts (type=type@entry=8, 
    retval=retval@entry=0x0, file_count=file_count@entry=3)
    at /usr/src/builddir/Zend/zend.c:1427
#11 0x00007f0e47c916a0 in php_execute_script (primary_file=0x7ffe463fb4c0)
    at /usr/src/builddir/main/main.c:2494
#12 0x00007f0e47b786e5 in main (argc=1217559598, argv=0x7f0e48927d81)
    at /usr/src/builddir/sapi/fpm/fpm/fpm_main.c:1968

(gdb) info local
ch = 0x7f0e34e10000 <error: Cannot access memory at address 0x7f0e34e10000>
end = 0x6e61e47a87323cda <error: Cannot access memory at address 0x6e61e47a87323cda>
escaped = 0
_z = 0x7f0e44c62648
_p = 0x7f0e44c62648
_end = <optimized out>
count = <optimized out>
i = <optimized out>
ret = <optimized out>
field_tmp = 0x7f0e44c62648
csvline = {s = 0x7f0da4600000, a = 494354407}

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2016-10-21 13:08 UTC] thomas dot ploch at flixbus dot com
-Summary: Segfault in fputcsv() when using ourput from apc_cache_info() +Summary: Segfault in fputcsv() when using output from apc_cache_info()
 [2016-10-21 13:08 UTC] thomas dot ploch at flixbus dot com
Updated type in title
 [2016-10-21 14:42 UTC] cmb@php.net
> `apc_cache_info()` (attached)

It appears this is missing. Note that directly attaching files to
the ticket might not work (it's actually meant for patches/diffs).
If it doesn't, please make the file available somewhere else and
post a link.
 [2016-10-25 15:17 UTC] cmb@php.net
-Status: Open +Status: Feedback -Assigned To: +Assigned To: cmb
 [2016-11-06 04:22 UTC] php-bugs at lists dot php dot net
No feedback was provided. The bug is being suspended because
we assume that you are no longer experiencing the problem.
If this is not the case and you are able to provide the
information that was requested earlier, please do so and
change the status of the bug back to "Re-Opened". Thank you.
 
PHP Copyright © 2001-2019 The PHP Group
All rights reserved.
Last updated: Tue Nov 19 19:01:41 2019 UTC