php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #74030 Segfaults when running PHP7.1 with both Opcache and Oauth extensions
Submitted: 2017-02-02 02:44 UTC Modified: 2017-02-02 03:36 UTC
Votes:4
Avg. Score:5.0 ± 0.0
Reproduced:4 of 4 (100.0%)
Same Version:2 (50.0%)
Same OS:2 (50.0%)
From: tmwilder at gmail dot com Assigned:
Status: Open Package: oauth (PECL)
PHP Version: 7.1.1 OS: Ubuntu 14.04.2
Private report: No CVE-ID: None
Have you experienced this issue?
Rate the importance of this bug to you:

 [2017-02-02 02:44 UTC] tmwilder at gmail dot com
Description:
------------
Using latest packages from the Ondrej Sury PPA, I get prod reproducible but never non-prod segfaults when making requests via the mod php7.1 apache module.


Below is a bt using the debug symbols deb the sury ppa publishes for mod php.

I've tried a number of things to get a local repro with no success, but prod traffic will consistently immediately cause the issue.

Setting opcache.enabled = false causes the issue to go away.

The php redis extension was producing almost the same symptoms, here is the ticket for that: https://github.com/phpredis/phpredis/issues/1088

Expected result:
----------------
No segfault ;).

Actual result:
--------------
gdb /usr/sbin/apache2 ./CoreDump
GNU gdb (Ubuntu 7.7.1-0ubuntu5~14.04.2) 7.7.1
Copyright (C) 2014 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /usr/sbin/apache2...(no debugging symbols found)...done.
[New LWP 5160]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Core was generated by `/usr/sbin/apache2 -k start'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x00007efd7519b2f2 in zend_hash_find_bucket (ht=<optimized out>, ht=<optimized out>, key=0x7efd55bbd7f8) at /build/php7.1-eG1AJw/php7.1-7.1.1/Zend/zend_hash.c:481
481	/build/php7.1-eG1AJw/php7.1-7.1.1/Zend/zend_hash.c: No such file or directory.
(gdb) bt full
#0  0x00007efd7519b2f2 in zend_hash_find_bucket (ht=<optimized out>, ht=<optimized out>, key=0x7efd55bbd7f8) at /build/php7.1-eG1AJw/php7.1-7.1.1/Zend/zend_hash.c:481
        nIndex = 4294967294
        idx = <optimized out>
        p = <optimized out>
        arData = 0x7efd5b180ba0
#1  _zend_hash_add_or_update_i (flag=1, pData=0x7ffd488766e0, key=0x7efd55bbd7f8, ht=0x7efd622ef098) at /build/php7.1-eG1AJw/php7.1-7.1.1/Zend/zend_hash.c:556
        nIndex = <optimized out>
        idx = <optimized out>
        h = <optimized out>
        p = <optimized out>
#2  _zend_hash_str_update (ht=ht@entry=0x7efd622ef098, str=str@entry=0x7efd68623e40 "Authorization", len=13, pData=pData@entry=0x7ffd488766e0) at /build/php7.1-eG1AJw/php7.1-7.1.1/Zend/zend_hash.c:651
        key = 0x7efd55bbd7f8
#3  0x00007efd68618402 in add_arg_for_req (ht=ht@entry=0x7efd622ef098, arg=arg@entry=0x7efd68623e40 "Authorization", val=val@entry=0x7efd5f2b0800 "OAuth oauth_consumer_key=\"ZgAXfQvWsBWts6Vnyz4r\",oauth_signature_method=\"HMAC-SHA1\",oauth_nonce=\"335649404958928fe868b6b7.45230685\",oauth_timestamp=\"1486000104\",oauth_version=\"1.0\",oauth_token=\"nqZkRen"...)
    at /build/php-oauth-Iy3Bty/php-oauth-2.0.2+1.2.3/build-7.1/oauth.c:699
        varg = {value = {lval = 139626530129088, dval = 6.8984671784800132e-310, counted = 0x7efd55bac4c0, str = 0x7efd55bac4c0, arr = 0x7efd55bac4c0, obj = 0x7efd55bac4c0, res = 0x7efd55bac4c0, ref = 0x7efd55bac4c0, ast = 0x7efd55bac4c0, zv = 0x7efd55bac4c0, ptr = 0x7efd55bac4c0, ce = 0x7efd55bac4c0, func = 0x7efd55bac4c0, ww = {w1 = 1438303424, w2 = 32509}},
          u1 = {v = {type = 6 '\006', type_flags = 20 '\024', const_flags = 0 '\000', reserved = 0 '\000'}, type_info = 5126}, u2 = {next = 0, cache_slot = 0, lineno = 0, num_args = 0, fe_pos = 0, fe_iter_idx = 0, access_flags = 0, property_guard = 0}}
#4  0x00007efd6861db85 in oauth_add_signature_header (request_headers=request_headers@entry=0x7efd622ef098, oauth_args=oauth_args@entry=0x7efd55bc80a8, header=header@entry=0x0) at /build/php-oauth-Iy3Bty/php-oauth-2.0.2+1.2.3/build-7.1/oauth.c:741
        sheader = {c = 0x7efd5f2b0800 "OAuth oauth_consumer_key=\"ZgAXfQvWsBWts6Vnyz4r\",oauth_signature_method=\"HMAC-SHA1\",oauth_nonce=\"335649404958928fe868b6b7.45230685\",oauth_timestamp=\"1486000104\",oauth_version=\"1.0\",oauth_token=\"nqZkRen"..., len = 267, a = 341}
        prepend_comma = 1 '\001'
        curval = 0x0
        param_name = <optimized out>
        param_val = <optimized out>
        cur_key = 0x7efd55bbd960
        num_key = 139626843046914
#5  0x00007efd6861e98f in oauth_fetch (soo=soo@entry=0x7efd5f63b380, url=<optimized out>, method=<optimized out>, request_params=<optimized out>, request_headers=<optimized out>, init_oauth_args=init_oauth_args@entry=0x0, fetch_flags=fetch_flags@entry=9) at /build/php-oauth-Iy3Bty/php-oauth-2.0.2+1.2.3/build-7.1/oauth.c:1562
        bufz = 0x0
        sbs = <optimized out>
        sig = <optimized out>
        final_http_method = 0x7efd55bbfdf8 "GET"
        token = <optimized out>
        ts = 0x7efd55bb4c20
        token_secret = <optimized out>
        zret = {value = {lval = 1486000104, dval = 7.3418160110291953e-315, counted = 0x58928fe8, str = 0x58928fe8, arr = 0x58928fe8, obj = 0x58928fe8, res = 0x58928fe8, ref = 0x58928fe8, ast = 0x58928fe8, zv = 0x58928fe8, ptr = 0x58928fe8, ce = 0x58928fe8, func = 0x58928fe8, ww = {w1 = 1486000104, w2 = 0}}, u1 = {v = {type = 107 'k', type_flags = 139 '\213',
              const_flags = 6 '\006', reserved = 0 '\000'}, type_info = 428907}, u2 = {next = 0, cache_slot = 0, lineno = 0, num_args = 0, fe_pos = 0, fe_iter_idx = 0, access_flags = 0, property_guard = 0}}
        oauth_args = 0x7efd55bc80a8
        rargs = 0x7efd622ef060
        rheaders = 0x7efd622ef098
        http_response_code = -1
        auth_type = 3
        surl = {c = 0x7efd72a82a80 "https://remitly.desk.com/api/v2/cases/search.json?email=carls6624%40hotmail.com", len = 79, a = 207}
        payload = {c = 0x0, len = 0, a = 0}
        postdata = {c = 0x0, len = 0, a = 0}
        is_redirect = 0
        follow_redirects = 1
        need_to_free_rheaders = 0
#6  0x00007efd6861ff44 in zim_oauth_fetch (execute_data=<optimized out>, return_value=0x7ffd488769d0) at /build/php-oauth-Iy3Bty/php-oauth-2.0.2+1.2.3/build-7.1/oauth.c:2375
        soo = 0x7efd5f63b380
        fetchurl_len = 79
        http_method_len = 3
        fetchurl = 0x7efd5f5b7b08 "https://remitly.desk.com/api/v2/cases/search.json?email=carls6624%40hotmail.com"
        zret = {value = {lval = 139627014985936, dval = 6.898491133591188e-310, counted = 0x7efd72a118d0, str = 0x7efd72a118d0, arr = 0x7efd72a118d0, obj = 0x7efd72a118d0, res = 0x7efd72a118d0, ref = 0x7efd72a118d0, ast = 0x7efd72a118d0, zv = 0x7efd72a118d0, ptr = 0x7efd72a118d0, ce = 0x7efd72a118d0, func = 0x7efd72a118d0, ww = {w1 = 1923160272, w2 = 32509}},
          u1 = {v = {type = 176 '\260', type_flags = 24 '\030', const_flags = 161 '\241', reserved = 114 'r'}, type_info = 1923160240}, u2 = {next = 32509, cache_slot = 32509, lineno = 32509, num_args = 32509, fe_pos = 32509, fe_iter_idx = 32509, access_flags = 32509, property_guard = 32509}}
        request_args = 0x7efd72a11940
        request_headers = 0x7efd72a11960
        http_method = 0x7efd55bbfdf8 "GET"
        retcode = <optimized out>
#7  0x00007efd75224686 in ZEND_DO_FCALL_SPEC_RETVAL_UNUSED_HANDLER () at /build/php7.1-eG1AJw/php7.1-7.1.1/Zend/zend_vm_execute.h:970
        retval = {value = {lval = 139627060464480, dval = 6.8984933805298093e-310, counted = 0x7efd75570b60 <executor_globals>, str = 0x7efd75570b60 <executor_globals>, arr = 0x7efd75570b60 <executor_globals>, obj = 0x7efd75570b60 <executor_globals>, res = 0x7efd75570b60 <executor_globals>, ref = 0x7efd75570b60 <executor_globals>,
            ast = 0x7efd75570b60 <executor_globals>, zv = 0x7efd75570b60 <executor_globals>, ptr = 0x7efd75570b60 <executor_globals>, ce = 0x7efd75570b60 <executor_globals>, func = 0x7efd75570b60 <executor_globals>, ww = {w1 = 1968638816, w2 = 32509}}, u1 = {v = {type = 1 '\001', type_flags = 0 '\000', const_flags = 0 '\000', reserved = 0 '\000'},
            type_info = 1}, u2 = {next = 32509, cache_slot = 32509, lineno = 32509, num_args = 32509, fe_pos = 32509, fe_iter_idx = 32509, access_flags = 32509, property_guard = 32509, extra = 32509}}
        call = 0x7efd72a118e0
        fbc = 0x7efd79777f00
        object = <optimized out>
        ret = 0x7ffd488769d0
#8  0x00007efd751d349b in execute_ex (ex=<optimized out>) at /build/php7.1-eG1AJw/php7.1-7.1.1/Zend/zend_vm_execute.h:429
        orig_opline = 0x7efd799266a0
        orig_execute_data = 0x7efd72a11750
#9  0x00007efd68a5007b in nr_php_execute_enabled () at /home/hudson/slave-workspace/workspace/php-release-agent/label/centos5-64-nrcamp/agent/php_execute.c:1177
No locals.
#10 0x00007efd68a506c2 in nr_php_execute () at /home/hudson/slave-workspace/workspace/php-release-agent/label/centos5-64-nrcamp/agent/php_execute.c:1287
No locals.
#11 0x00007efd75223f45 in ZEND_DO_FCALL_SPEC_RETVAL_USED_HANDLER () at /build/php7.1-eG1AJw/php7.1-7.1.1/Zend/zend_vm_execute.h:1076
        call = 0x7efd72a117d0
        fbc = 0x7efd5f38bfb8
        object = 0x7efd5f38bfb8
        ret = <optimized out>
#12 0x00007efd751d349b in execute_ex (ex=<optimized out>) at /build/php7.1-eG1AJw/php7.1-7.1.1/Zend/zend_vm_execute.h:429
        orig_opline = 0x7efd799266a0
        orig_execute_data = 0x7efd72a116d0
#13 0x00007efd68a5007b in nr_php_execute_enabled () at /home/hudson/slave-workspace/workspace/php-release-agent/label/centos5-64-nrcamp/agent/php_execute.c:1177
No locals.
#14 0x00007efd68a506c2 in nr_php_execute () at /home/hudson/slave-workspace/workspace/php-release-agent/label/centos5-64-nrcamp/agent/php_execute.c:1287
---Type <return> to continue, or q <return> to quit---
No locals.
#15 0x00007efd75223f45 in ZEND_DO_FCALL_SPEC_RETVAL_USED_HANDLER () at /build/php7.1-eG1AJw/php7.1-7.1.1/Zend/zend_vm_execute.h:1076
        call = 0x7efd72a11750
        fbc = 0x7efd5f38bc78
        object = 0x7efd5f38bc78
        ret = <optimized out>
#16 0x00007efd751d349b in execute_ex (ex=<optimized out>) at /build/php7.1-eG1AJw/php7.1-7.1.1/Zend/zend_vm_execute.h:429
        orig_opline = 0x7efd799266a0
        orig_execute_data = 0x7efd72a115e0
#17 0x00007efd68a5007b in nr_php_execute_enabled () at /home/hudson/slave-workspace/workspace/php-release-agent/label/centos5-64-nrcamp/agent/php_execute.c:1177
No locals.
#18 0x00007efd68a506c2 in nr_php_execute () at /home/hudson/slave-workspace/workspace/php-release-agent/label/centos5-64-nrcamp/agent/php_execute.c:1287
No locals.
#19 0x00007efd75223f45 in ZEND_DO_FCALL_SPEC_RETVAL_USED_HANDLER () at /build/php7.1-eG1AJw/php7.1-7.1.1/Zend/zend_vm_execute.h:1076
        call = 0x7efd72a116d0
        fbc = 0x7efd5f38d4d8
        object = 0x7efd5f38d4d8
        ret = <optimized out>
#20 0x00007efd751d349b in execute_ex (ex=<optimized out>) at /build/php7.1-eG1AJw/php7.1-7.1.1/Zend/zend_vm_execute.h:429
        orig_opline = 0x7efd799266a0
        orig_execute_data = 0x7efd72a11250
#21 0x00007efd68a5007b in nr_php_execute_enabled () at /home/hudson/slave-workspace/workspace/php-release-agent/label/centos5-64-nrcamp/agent/php_execute.c:1177
No locals.
#22 0x00007efd68a506c2 in nr_php_execute () at /home/hudson/slave-workspace/workspace/php-release-agent/label/centos5-64-nrcamp/agent/php_execute.c:1287
No locals.
#23 0x00007efd75223f45 in ZEND_DO_FCALL_SPEC_RETVAL_USED_HANDLER () at /build/php7.1-eG1AJw/php7.1-7.1.1/Zend/zend_vm_execute.h:1076
        call = 0x7efd72a115e0
        fbc = 0x7efd5f38e718
        object = 0x7efd5f38e718
        ret = <optimized out>
#24 0x00007efd751d349b in execute_ex (ex=<optimized out>) at /build/php7.1-eG1AJw/php7.1-7.1.1/Zend/zend_vm_execute.h:429
        orig_opline = 0x7efd799266a0
        orig_execute_data = 0x7efd72a110d0
#25 0x00007efd68a5007b in nr_php_execute_enabled () at /home/hudson/slave-workspace/workspace/php-release-agent/label/centos5-64-nrcamp/agent/php_execute.c:1177
No locals.
#26 0x00007efd68a506c2 in nr_php_execute () at /home/hudson/slave-workspace/workspace/php-release-agent/label/centos5-64-nrcamp/agent/php_execute.c:1287
No locals.
#27 0x00007efd752243c5 in ZEND_DO_FCALL_SPEC_RETVAL_UNUSED_HANDLER () at /build/php7.1-eG1AJw/php7.1-7.1.1/Zend/zend_vm_execute.h:949
        call = 0x7efd72a11250
        fbc = 0x7efd72af9c58
        object = <optimized out>
        ret = 0x0
#28 0x00007efd751d349b in execute_ex (ex=<optimized out>) at /build/php7.1-eG1AJw/php7.1-7.1.1/Zend/zend_vm_execute.h:429
        orig_opline = 0x7efd68ce3040 <all_frameworks>
        orig_execute_data = 0x7efd68ce3040 <all_frameworks>
#29 0x00007efd68a501ba in nr_php_execute_file () at /home/hudson/slave-workspace/workspace/php-release-agent/label/centos5-64-nrcamp/agent/php_execute.c:837
No locals.
#30 nr_php_execute_enabled () at /home/hudson/slave-workspace/workspace/php-release-agent/label/centos5-64-nrcamp/agent/php_execute.c:1059
No locals.
#31 0x00007efd68a506c2 in nr_php_execute () at /home/hudson/slave-workspace/workspace/php-release-agent/label/centos5-64-nrcamp/agent/php_execute.c:1287
No locals.
#32 0x00007efd752211af in ZEND_INCLUDE_OR_EVAL_SPEC_TMPVAR_HANDLER () at /build/php7.1-eG1AJw/php7.1-7.1.1/Zend/zend_vm_execute.h:51627
        return_value = <optimized out>
        new_op_array = 0x7efd72a820e0
        free_op1 = <optimized out>
        inc_filename = 0x7efd72a110d0
#33 0x00007efd751d349b in execute_ex (ex=<optimized out>) at /build/php7.1-eG1AJw/php7.1-7.1.1/Zend/zend_vm_execute.h:429
        orig_opline = 0x7efd68ce3040 <all_frameworks>
        orig_execute_data = 0x7efd68ce3040 <all_frameworks>
#34 0x00007efd68a501ba in nr_php_execute_file () at /home/hudson/slave-workspace/workspace/php-release-agent/label/centos5-64-nrcamp/agent/php_execute.c:837
No locals.
#35 nr_php_execute_enabled () at /home/hudson/slave-workspace/workspace/php-release-agent/label/centos5-64-nrcamp/agent/php_execute.c:1059
No locals.
#36 0x00007efd68a506c2 in nr_php_execute () at /home/hudson/slave-workspace/workspace/php-release-agent/label/centos5-64-nrcamp/agent/php_execute.c:1287
No locals.
#37 0x00007efd752263a4 in zend_execute (op_array=op_array@entry=0x7efd72a82000, return_value=return_value@entry=0x0) at /build/php7.1-eG1AJw/php7.1-7.1.1/Zend/zend_vm_execute.h:474
No locals.
#38 0x00007efd7518e754 in zend_execute_scripts (type=type@entry=8, retval=retval@entry=0x0, file_count=file_count@entry=3) at /build/php7.1-eG1AJw/php7.1-7.1.1/Zend/zend.c:1474
        files = {{gp_offset = 40, fp_offset = 32509, overflow_arg_area = 0x7ffd488773a0, reg_save_area = 0x7ffd48877330}}
        i = 1
        file_handle = 0x7ffd488795f0
        op_array = 0x7efd72a82000
#39 0x00007efd7512e698 in php_execute_script (primary_file=primary_file@entry=0x7ffd488795f0) at /build/php7.1-eG1AJw/php7.1-7.1.1/main/main.c:2537
        realfile = "\034\000\000\000\000\000\000\000\005", '\000' <repeats 11 times>, "\375\177\000\000\240\213\207H\375\177\000\000\261\245GS=\231\021\000\017H\253h\375~\000\000\177\003\253h\375~\000\000*\244\346v\375~\000\000\060\204\207H\375\177\000\000p\204\207H\375\177\000\000\260\204\207H\375\177\000\000\002", '\000' <repeats 15 times>, "\372\377\377\377f\000\000\000\001\000\000\000\375\177", '\000' <repeats 18 times>, "\060\214\207H\375\177\000\000\060\214\207H\375\177\000\000 \214\207H\375\177\000\000i\337\346v\375~\000\000\306V\253h\375~\000\000P\214\207H\375\177\000\000@\214\207H\375\177\000\000i\337\346v\375~\000\000"...
        __orig_bailout = 0x7ffd48879660
        __bailout = {{__jmpbuf = {139627103162528, -4373643611897119661, 139627103162528, 139627104407456, 0, 139627103220368, -4373643608745100205, -4517733418350855085}, __mask_was_saved = 0, __saved_mask = {__val = {0, 9223372032559808614, 0, 7, 140725820294128, 4294967296, 140725820294136, 140725820295072, 0, 140725820294096, 139627087914158, 0,
                140725820296240, 140725820294106, 1, 4598625186089009145}}}}
        prepend_file_p = 0x0
        append_file_p = 0x0
        prepend_file = {handle = {fd = 0, fp = 0x0, stream = {handle = 0x0, isatty = 0, mmap = {len = 0, pos = 0, map = 0x0, buf = 0x0, old_handle = 0x0, old_closer = 0x0}, reader = 0x0, fsizer = 0x0, closer = 0x0}}, filename = 0x0, opened_path = 0x0, type = ZEND_HANDLE_FILENAME, free_filename = 0 '\000'}
        append_file = {handle = {fd = 0, fp = 0x0, stream = {handle = 0x0, isatty = 0, mmap = {len = 0, pos = 0, map = 0x0, buf = 0x0, old_handle = 0x0, old_closer = 0x0}, reader = 0x0, fsizer = 0x0, closer = 0x0}}, filename = 0x0, opened_path = 0x0, type = ZEND_HANDLE_FILENAME, free_filename = 0 '\000'}
---Type <return> to continue, or q <return> to quit---
        old_cwd = 0x7ffd488773a0 "/"
        retval = 0
#40 0x00007efd752282f2 in php_handler (r=<optimized out>) at /build/php7.1-eG1AJw/php7.1-7.1.1/sapi/apache2handler/sapi_apache2.c:712
        zfd = {handle = {fd = 0, fp = 0x0, stream = {handle = 0x0, isatty = 2012061288, mmap = {len = 139627075408711, pos = 139627092600174, map = 0x100000001, buf = 0x0, old_handle = 0x7efd77ed1358, old_closer = 0x7efd77ed9e68}, reader = 0x7efd77ed9e68, fsizer = 0x7efd77e290a0, closer = 0x1}},
          filename = 0x7efd77e27248 "/var/deploy/apps/crm/latest/src/app/index.php", opened_path = 0x0, type = ZEND_HANDLE_FILENAME, free_filename = 0 '\000'}
        __orig_bailout = 0x0
        __bailout = {{__jmpbuf = {139627103162528, 4375004327540243539, 139627103162528, 139627104407456, 0, 139627103220368, -4373643611903411117, -4517733826066432941}, __mask_was_saved = 0, __saved_mask = {__val = {139627104056280, 139627103895592, 139627103156376, 1, 139627103895592, 139627103156384, 0, 0, 0, 139627103220368, 139627064728739,
                139627103154805, 139627103838600, 0, 139627103162528, 139627104407456}}}}
        ctx = 0x7efd77e278e0
        conf = <optimized out>
        brigade = 0x7efd77e28788
        bucket = <optimized out>
        rv = <optimized out>
        parent_req = 0x0
#41 0x00007efd77d14be0 in ap_run_handler ()
No symbol table info available.
#42 0x00007efd77d15129 in ap_invoke_handler ()
No symbol table info available.
#43 0x00007efd77d2a6fa in ap_process_async_request ()
No symbol table info available.
#44 0x00007efd77d2a9d4 in ap_process_request ()
No symbol table info available.
#45 0x00007efd77d27472 in ?? ()
No symbol table info available.
#46 0x00007efd77d1e250 in ap_run_process_connection ()
No symbol table info available.
#47 0x00007efd73bdb767 in ?? () from /usr/lib/apache2/modules/mod_mpm_prefork.so
No symbol table info available.
#48 0x00007efd73bdb9a6 in ?? () from /usr/lib/apache2/modules/mod_mpm_prefork.so
No symbol table info available.
#49 0x00007efd73bdc60e in ?? () from /usr/lib/apache2/modules/mod_mpm_prefork.so
No symbol table info available.
#50 0x00007efd77cfb8ae in ap_run_mpm ()
No symbol table info available.
#51 0x00007efd77cf5046 in main ()
No symbol table info available.

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2017-02-02 03:36 UTC] tmwilder at gmail dot com
Description:
------------
Using latest packages from the Ondrej Sury PPA, I get prod reproducible but never non-prod segfaults when making requests via the mod php7.1 apache module.


Below is a bt using the debug symbols deb the sury ppa publishes for mod php.

I've tried a number of things to get a local repro with no success, but prod traffic will consistently immediately cause the issue.

Setting opcache.enabled = false causes the issue to go away.

The php redis extension was producing almost the same symptoms, here is the ticket for that: https://github.com/phpredis/phpredis/issues/1088

Expected result:
----------------
No segfault ;).

Actual result:
--------------
gdb /usr/sbin/apache2 ./CoreDump
GNU gdb (Ubuntu 7.7.1-0ubuntu5~14.04.2) 7.7.1
Copyright (C) 2014 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /usr/sbin/apache2...(no debugging symbols found)...done.
[New LWP 5160]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Core was generated by `/usr/sbin/apache2 -k start'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x00007efd7519b2f2 in zend_hash_find_bucket (ht=<optimized out>, ht=<optimized out>, key=0x7efd55bbd7f8) at /build/php7.1-eG1AJw/php7.1-7.1.1/Zend/zend_hash.c:481
481	/build/php7.1-eG1AJw/php7.1-7.1.1/Zend/zend_hash.c: No such file or directory.
(gdb) bt full
#0  0x00007efd7519b2f2 in zend_hash_find_bucket (ht=<optimized out>, ht=<optimized out>, key=0x7efd55bbd7f8) at /build/php7.1-eG1AJw/php7.1-7.1.1/Zend/zend_hash.c:481
        nIndex = 4294967294
        idx = <optimized out>
        p = <optimized out>
        arData = 0x7efd5b180ba0
#1  _zend_hash_add_or_update_i (flag=1, pData=0x7ffd488766e0, key=0x7efd55bbd7f8, ht=0x7efd622ef098) at /build/php7.1-eG1AJw/php7.1-7.1.1/Zend/zend_hash.c:556
        nIndex = <optimized out>
        idx = <optimized out>
        h = <optimized out>
        p = <optimized out>
#2  _zend_hash_str_update (ht=ht@entry=0x7efd622ef098, str=str@entry=0x7efd68623e40 "Authorization", len=13, pData=pData@entry=0x7ffd488766e0) at /build/php7.1-eG1AJw/php7.1-7.1.1/Zend/zend_hash.c:651
        key = 0x7efd55bbd7f8
#3  0x00007efd68618402 in add_arg_for_req (ht=ht@entry=0x7efd622ef098, arg=arg@entry=0x7efd68623e40 "Authorization", val=val@entry=0x7efd5f2b0800 "OAuth oauth_consumer_key=\"ZgAXfQvWsBWts6Vnyz4r\",oauth_signature_method=\"HMAC-SHA1\",oauth_nonce=\"335649404958928fe868b6b7.45230685\",oauth_timestamp=\"1486000104\",oauth_version=\"1.0\",oauth_token=\"<readacted>"...)
    at /build/php-oauth-Iy3Bty/php-oauth-2.0.2+1.2.3/build-7.1/oauth.c:699
        varg = {value = {lval = 139626530129088, dval = 6.8984671784800132e-310, counted = 0x7efd55bac4c0, str = 0x7efd55bac4c0, arr = 0x7efd55bac4c0, obj = 0x7efd55bac4c0, res = 0x7efd55bac4c0, ref = 0x7efd55bac4c0, ast = 0x7efd55bac4c0, zv = 0x7efd55bac4c0, ptr = 0x7efd55bac4c0, ce = 0x7efd55bac4c0, func = 0x7efd55bac4c0, ww = {w1 = 1438303424, w2 = 32509}},
          u1 = {v = {type = 6 '\006', type_flags = 20 '\024', const_flags = 0 '\000', reserved = 0 '\000'}, type_info = 5126}, u2 = {next = 0, cache_slot = 0, lineno = 0, num_args = 0, fe_pos = 0, fe_iter_idx = 0, access_flags = 0, property_guard = 0}}
#4  0x00007efd6861db85 in oauth_add_signature_header (request_headers=request_headers@entry=0x7efd622ef098, oauth_args=oauth_args@entry=0x7efd55bc80a8, header=header@entry=0x0) at /build/php-oauth-Iy3Bty/php-oauth-2.0.2+1.2.3/build-7.1/oauth.c:741
        sheader = {c = 0x7efd5f2b0800 "OAuth oauth_consumer_key=\"ZgAXfQvWsBWts6Vnyz4r\",oauth_signature_method=\"HMAC-SHA1\",oauth_nonce=\"335649404958928fe868b6b7.45230685\",oauth_timestamp=\"1486000104\",oauth_version=\"1.0\",oauth_token=\"<readacted>"..., len = 267, a = 341}
        prepend_comma = 1 '\001'
        curval = 0x0
        param_name = <optimized out>
        param_val = <optimized out>
        cur_key = 0x7efd55bbd960
        num_key = 139626843046914
#5  0x00007efd6861e98f in oauth_fetch (soo=soo@entry=0x7efd5f63b380, url=<optimized out>, method=<optimized out>, request_params=<optimized out>, request_headers=<optimized out>, init_oauth_args=init_oauth_args@entry=0x0, fetch_flags=fetch_flags@entry=9) at /build/php-oauth-Iy3Bty/php-oauth-2.0.2+1.2.3/build-7.1/oauth.c:1562
        bufz = 0x0
        sbs = <optimized out>
        sig = <optimized out>
        final_http_method = 0x7efd55bbfdf8 "GET"
        token = <optimized out>
        ts = 0x7efd55bb4c20
        token_secret = <optimized out>
        zret = {value = {lval = 1486000104, dval = 7.3418160110291953e-315, counted = 0x58928fe8, str = 0x58928fe8, arr = 0x58928fe8, obj = 0x58928fe8, res = 0x58928fe8, ref = 0x58928fe8, ast = 0x58928fe8, zv = 0x58928fe8, ptr = 0x58928fe8, ce = 0x58928fe8, func = 0x58928fe8, ww = {w1 = 1486000104, w2 = 0}}, u1 = {v = {type = 107 'k', type_flags = 139 '\213',
              const_flags = 6 '\006', reserved = 0 '\000'}, type_info = 428907}, u2 = {next = 0, cache_slot = 0, lineno = 0, num_args = 0, fe_pos = 0, fe_iter_idx = 0, access_flags = 0, property_guard = 0}}
        oauth_args = 0x7efd55bc80a8
        rargs = 0x7efd622ef060
        rheaders = 0x7efd622ef098
        http_response_code = -1
        auth_type = 3
        surl = {c = 0x7efd72a82a80 "https://remitly.desk.com/api/v2/cases/search.json?email=carls6624%40hotmail.com", len = 79, a = 207}
        payload = {c = 0x0, len = 0, a = 0}
        postdata = {c = 0x0, len = 0, a = 0}
        is_redirect = 0
        follow_redirects = 1
        need_to_free_rheaders = 0
#6  0x00007efd6861ff44 in zim_oauth_fetch (execute_data=<optimized out>, return_value=0x7ffd488769d0) at /build/php-oauth-Iy3Bty/php-oauth-2.0.2+1.2.3/build-7.1/oauth.c:2375
        soo = 0x7efd5f63b380
        fetchurl_len = 79
        http_method_len = 3
        fetchurl = 0x7efd5f5b7b08 "https://remitly.desk.com/api/v2/cases/search.json?email=carls6624%40hotmail.com"
        zret = {value = {lval = 139627014985936, dval = 6.898491133591188e-310, counted = 0x7efd72a118d0, str = 0x7efd72a118d0, arr = 0x7efd72a118d0, obj = 0x7efd72a118d0, res = 0x7efd72a118d0, ref = 0x7efd72a118d0, ast = 0x7efd72a118d0, zv = 0x7efd72a118d0, ptr = 0x7efd72a118d0, ce = 0x7efd72a118d0, func = 0x7efd72a118d0, ww = {w1 = 1923160272, w2 = 32509}},
          u1 = {v = {type = 176 '\260', type_flags = 24 '\030', const_flags = 161 '\241', reserved = 114 'r'}, type_info = 1923160240}, u2 = {next = 32509, cache_slot = 32509, lineno = 32509, num_args = 32509, fe_pos = 32509, fe_iter_idx = 32509, access_flags = 32509, property_guard = 32509}}
        request_args = 0x7efd72a11940
        request_headers = 0x7efd72a11960
        http_method = 0x7efd55bbfdf8 "GET"
        retcode = <optimized out>
#7  0x00007efd75224686 in ZEND_DO_FCALL_SPEC_RETVAL_UNUSED_HANDLER () at /build/php7.1-eG1AJw/php7.1-7.1.1/Zend/zend_vm_execute.h:970
        retval = {value = {lval = 139627060464480, dval = 6.8984933805298093e-310, counted = 0x7efd75570b60 <executor_globals>, str = 0x7efd75570b60 <executor_globals>, arr = 0x7efd75570b60 <executor_globals>, obj = 0x7efd75570b60 <executor_globals>, res = 0x7efd75570b60 <executor_globals>, ref = 0x7efd75570b60 <executor_globals>,
            ast = 0x7efd75570b60 <executor_globals>, zv = 0x7efd75570b60 <executor_globals>, ptr = 0x7efd75570b60 <executor_globals>, ce = 0x7efd75570b60 <executor_globals>, func = 0x7efd75570b60 <executor_globals>, ww = {w1 = 1968638816, w2 = 32509}}, u1 = {v = {type = 1 '\001', type_flags = 0 '\000', const_flags = 0 '\000', reserved = 0 '\000'},
            type_info = 1}, u2 = {next = 32509, cache_slot = 32509, lineno = 32509, num_args = 32509, fe_pos = 32509, fe_iter_idx = 32509, access_flags = 32509, property_guard = 32509, extra = 32509}}
        call = 0x7efd72a118e0
        fbc = 0x7efd79777f00
        object = <optimized out>
        ret = 0x7ffd488769d0
#8  0x00007efd751d349b in execute_ex (ex=<optimized out>) at /build/php7.1-eG1AJw/php7.1-7.1.1/Zend/zend_vm_execute.h:429
        orig_opline = 0x7efd799266a0
        orig_execute_data = 0x7efd72a11750
#9  0x00007efd68a5007b in nr_php_execute_enabled () at /home/hudson/slave-workspace/workspace/php-release-agent/label/centos5-64-nrcamp/agent/php_execute.c:1177
No locals.
#10 0x00007efd68a506c2 in nr_php_execute () at /home/hudson/slave-workspace/workspace/php-release-agent/label/centos5-64-nrcamp/agent/php_execute.c:1287
No locals.
#11 0x00007efd75223f45 in ZEND_DO_FCALL_SPEC_RETVAL_USED_HANDLER () at /build/php7.1-eG1AJw/php7.1-7.1.1/Zend/zend_vm_execute.h:1076
        call = 0x7efd72a117d0
        fbc = 0x7efd5f38bfb8
        object = 0x7efd5f38bfb8
        ret = <optimized out>
#12 0x00007efd751d349b in execute_ex (ex=<optimized out>) at /build/php7.1-eG1AJw/php7.1-7.1.1/Zend/zend_vm_execute.h:429
        orig_opline = 0x7efd799266a0
        orig_execute_data = 0x7efd72a116d0
#13 0x00007efd68a5007b in nr_php_execute_enabled () at /home/hudson/slave-workspace/workspace/php-release-agent/label/centos5-64-nrcamp/agent/php_execute.c:1177
No locals.
#14 0x00007efd68a506c2 in nr_php_execute () at /home/hudson/slave-workspace/workspace/php-release-agent/label/centos5-64-nrcamp/agent/php_execute.c:1287
---Type <return> to continue, or q <return> to quit---
No locals.
#15 0x00007efd75223f45 in ZEND_DO_FCALL_SPEC_RETVAL_USED_HANDLER () at /build/php7.1-eG1AJw/php7.1-7.1.1/Zend/zend_vm_execute.h:1076
        call = 0x7efd72a11750
        fbc = 0x7efd5f38bc78
        object = 0x7efd5f38bc78
        ret = <optimized out>
#16 0x00007efd751d349b in execute_ex (ex=<optimized out>) at /build/php7.1-eG1AJw/php7.1-7.1.1/Zend/zend_vm_execute.h:429
        orig_opline = 0x7efd799266a0
        orig_execute_data = 0x7efd72a115e0
#17 0x00007efd68a5007b in nr_php_execute_enabled () at /home/hudson/slave-workspace/workspace/php-release-agent/label/centos5-64-nrcamp/agent/php_execute.c:1177
No locals.
#18 0x00007efd68a506c2 in nr_php_execute () at /home/hudson/slave-workspace/workspace/php-release-agent/label/centos5-64-nrcamp/agent/php_execute.c:1287
No locals.
#19 0x00007efd75223f45 in ZEND_DO_FCALL_SPEC_RETVAL_USED_HANDLER () at /build/php7.1-eG1AJw/php7.1-7.1.1/Zend/zend_vm_execute.h:1076
        call = 0x7efd72a116d0
        fbc = 0x7efd5f38d4d8
        object = 0x7efd5f38d4d8
        ret = <optimized out>
#20 0x00007efd751d349b in execute_ex (ex=<optimized out>) at /build/php7.1-eG1AJw/php7.1-7.1.1/Zend/zend_vm_execute.h:429
        orig_opline = 0x7efd799266a0
        orig_execute_data = 0x7efd72a11250
#21 0x00007efd68a5007b in nr_php_execute_enabled () at /home/hudson/slave-workspace/workspace/php-release-agent/label/centos5-64-nrcamp/agent/php_execute.c:1177
No locals.
#22 0x00007efd68a506c2 in nr_php_execute () at /home/hudson/slave-workspace/workspace/php-release-agent/label/centos5-64-nrcamp/agent/php_execute.c:1287
No locals.
#23 0x00007efd75223f45 in ZEND_DO_FCALL_SPEC_RETVAL_USED_HANDLER () at /build/php7.1-eG1AJw/php7.1-7.1.1/Zend/zend_vm_execute.h:1076
        call = 0x7efd72a115e0
        fbc = 0x7efd5f38e718
        object = 0x7efd5f38e718
        ret = <optimized out>
#24 0x00007efd751d349b in execute_ex (ex=<optimized out>) at /build/php7.1-eG1AJw/php7.1-7.1.1/Zend/zend_vm_execute.h:429
        orig_opline = 0x7efd799266a0
        orig_execute_data = 0x7efd72a110d0
#25 0x00007efd68a5007b in nr_php_execute_enabled () at /home/hudson/slave-workspace/workspace/php-release-agent/label/centos5-64-nrcamp/agent/php_execute.c:1177
No locals.
#26 0x00007efd68a506c2 in nr_php_execute () at /home/hudson/slave-workspace/workspace/php-release-agent/label/centos5-64-nrcamp/agent/php_execute.c:1287
No locals.
#27 0x00007efd752243c5 in ZEND_DO_FCALL_SPEC_RETVAL_UNUSED_HANDLER () at /build/php7.1-eG1AJw/php7.1-7.1.1/Zend/zend_vm_execute.h:949
        call = 0x7efd72a11250
        fbc = 0x7efd72af9c58
        object = <optimized out>
        ret = 0x0
#28 0x00007efd751d349b in execute_ex (ex=<optimized out>) at /build/php7.1-eG1AJw/php7.1-7.1.1/Zend/zend_vm_execute.h:429
        orig_opline = 0x7efd68ce3040 <all_frameworks>
        orig_execute_data = 0x7efd68ce3040 <all_frameworks>
#29 0x00007efd68a501ba in nr_php_execute_file () at /home/hudson/slave-workspace/workspace/php-release-agent/label/centos5-64-nrcamp/agent/php_execute.c:837
No locals.
#30 nr_php_execute_enabled () at /home/hudson/slave-workspace/workspace/php-release-agent/label/centos5-64-nrcamp/agent/php_execute.c:1059
No locals.
#31 0x00007efd68a506c2 in nr_php_execute () at /home/hudson/slave-workspace/workspace/php-release-agent/label/centos5-64-nrcamp/agent/php_execute.c:1287
No locals.
#32 0x00007efd752211af in ZEND_INCLUDE_OR_EVAL_SPEC_TMPVAR_HANDLER () at /build/php7.1-eG1AJw/php7.1-7.1.1/Zend/zend_vm_execute.h:51627
        return_value = <optimized out>
        new_op_array = 0x7efd72a820e0
        free_op1 = <optimized out>
        inc_filename = 0x7efd72a110d0
#33 0x00007efd751d349b in execute_ex (ex=<optimized out>) at /build/php7.1-eG1AJw/php7.1-7.1.1/Zend/zend_vm_execute.h:429
        orig_opline = 0x7efd68ce3040 <all_frameworks>
        orig_execute_data = 0x7efd68ce3040 <all_frameworks>
#34 0x00007efd68a501ba in nr_php_execute_file () at /home/hudson/slave-workspace/workspace/php-release-agent/label/centos5-64-nrcamp/agent/php_execute.c:837
No locals.
#35 nr_php_execute_enabled () at /home/hudson/slave-workspace/workspace/php-release-agent/label/centos5-64-nrcamp/agent/php_execute.c:1059
No locals.
#36 0x00007efd68a506c2 in nr_php_execute () at /home/hudson/slave-workspace/workspace/php-release-agent/label/centos5-64-nrcamp/agent/php_execute.c:1287
No locals.
#37 0x00007efd752263a4 in zend_execute (op_array=op_array@entry=0x7efd72a82000, return_value=return_value@entry=0x0) at /build/php7.1-eG1AJw/php7.1-7.1.1/Zend/zend_vm_execute.h:474
No locals.
#38 0x00007efd7518e754 in zend_execute_scripts (type=type@entry=8, retval=retval@entry=0x0, file_count=file_count@entry=3) at /build/php7.1-eG1AJw/php7.1-7.1.1/Zend/zend.c:1474
        files = {{gp_offset = 40, fp_offset = 32509, overflow_arg_area = 0x7ffd488773a0, reg_save_area = 0x7ffd48877330}}
        i = 1
        file_handle = 0x7ffd488795f0
        op_array = 0x7efd72a82000
#39 0x00007efd7512e698 in php_execute_script (primary_file=primary_file@entry=0x7ffd488795f0) at /build/php7.1-eG1AJw/php7.1-7.1.1/main/main.c:2537
        realfile = "\034\000\000\000\000\000\000\000\005", '\000' <repeats 11 times>, "\375\177\000\000\240\213\207H\375\177\000\000\261\245GS=\231\021\000\017H\253h\375~\000\000\177\003\253h\375~\000\000*\244\346v\375~\000\000\060\204\207H\375\177\000\000p\204\207H\375\177\000\000\260\204\207H\375\177\000\000\002", '\000' <repeats 15 times>, "\372\377\377\377f\000\000\000\001\000\000\000\375\177", '\000' <repeats 18 times>, "\060\214\207H\375\177\000\000\060\214\207H\375\177\000\000 \214\207H\375\177\000\000i\337\346v\375~\000\000\306V\253h\375~\000\000P\214\207H\375\177\000\000@\214\207H\375\177\000\000i\337\346v\375~\000\000"...
        __orig_bailout = 0x7ffd48879660
        __bailout = {{__jmpbuf = {139627103162528, -4373643611897119661, 139627103162528, 139627104407456, 0, 139627103220368, -4373643608745100205, -4517733418350855085}, __mask_was_saved = 0, __saved_mask = {__val = {0, 9223372032559808614, 0, 7, 140725820294128, 4294967296, 140725820294136, 140725820295072, 0, 140725820294096, 139627087914158, 0,
                140725820296240, 140725820294106, 1, 4598625186089009145}}}}
        prepend_file_p = 0x0
        append_file_p = 0x0
        prepend_file = {handle = {fd = 0, fp = 0x0, stream = {handle = 0x0, isatty = 0, mmap = {len = 0, pos = 0, map = 0x0, buf = 0x0, old_handle = 0x0, old_closer = 0x0}, reader = 0x0, fsizer = 0x0, closer = 0x0}}, filename = 0x0, opened_path = 0x0, type = ZEND_HANDLE_FILENAME, free_filename = 0 '\000'}
        append_file = {handle = {fd = 0, fp = 0x0, stream = {handle = 0x0, isatty = 0, mmap = {len = 0, pos = 0, map = 0x0, buf = 0x0, old_handle = 0x0, old_closer = 0x0}, reader = 0x0, fsizer = 0x0, closer = 0x0}}, filename = 0x0, opened_path = 0x0, type = ZEND_HANDLE_FILENAME, free_filename = 0 '\000'}
---Type <return> to continue, or q <return> to quit---
        old_cwd = 0x7ffd488773a0 "/"
        retval = 0
#40 0x00007efd752282f2 in php_handler (r=<optimized out>) at /build/php7.1-eG1AJw/php7.1-7.1.1/sapi/apache2handler/sapi_apache2.c:712
        zfd = {handle = {fd = 0, fp = 0x0, stream = {handle = 0x0, isatty = 2012061288, mmap = {len = 139627075408711, pos = 139627092600174, map = 0x100000001, buf = 0x0, old_handle = 0x7efd77ed1358, old_closer = 0x7efd77ed9e68}, reader = 0x7efd77ed9e68, fsizer = 0x7efd77e290a0, closer = 0x1}},
          filename = 0x7efd77e27248 "/var/deploy/apps/crm/latest/src/app/index.php", opened_path = 0x0, type = ZEND_HANDLE_FILENAME, free_filename = 0 '\000'}
        __orig_bailout = 0x0
        __bailout = {{__jmpbuf = {139627103162528, 4375004327540243539, 139627103162528, 139627104407456, 0, 139627103220368, -4373643611903411117, -4517733826066432941}, __mask_was_saved = 0, __saved_mask = {__val = {139627104056280, 139627103895592, 139627103156376, 1, 139627103895592, 139627103156384, 0, 0, 0, 139627103220368, 139627064728739,
                139627103154805, 139627103838600, 0, 139627103162528, 139627104407456}}}}
        ctx = 0x7efd77e278e0
        conf = <optimized out>
        brigade = 0x7efd77e28788
        bucket = <optimized out>
        rv = <optimized out>
        parent_req = 0x0
#41 0x00007efd77d14be0 in ap_run_handler ()
No symbol table info available.
#42 0x00007efd77d15129 in ap_invoke_handler ()
No symbol table info available.
#43 0x00007efd77d2a6fa in ap_process_async_request ()
No symbol table info available.
#44 0x00007efd77d2a9d4 in ap_process_request ()
No symbol table info available.
#45 0x00007efd77d27472 in ?? ()
No symbol table info available.
#46 0x00007efd77d1e250 in ap_run_process_connection ()
No symbol table info available.
#47 0x00007efd73bdb767 in ?? () from /usr/lib/apache2/modules/mod_mpm_prefork.so
No symbol table info available.
#48 0x00007efd73bdb9a6 in ?? () from /usr/lib/apache2/modules/mod_mpm_prefork.so
No symbol table info available.
#49 0x00007efd73bdc60e in ?? () from /usr/lib/apache2/modules/mod_mpm_prefork.so
No symbol table info available.
#50 0x00007efd77cfb8ae in ap_run_mpm ()
No symbol table info available.
#51 0x00007efd77cf5046 in main ()
No symbol table info available.
 [2018-03-31 21:22 UTC] jjoker0110 at gmail dot com
I'm having this issue on PHP7.2 running on Ubuntu 16.04.4. When I restart apache the first request works and then every following request says its getting a 500 but if I disable opcache it works every time no problem. 

I tried blacklisting the files that make the call to the oauth library but it still fails.
 [2018-05-21 20:09 UTC] james at dunarri dot com
Probably a duplicate of this https://bugs.php.net/bug.php?id=73310
 
PHP Copyright © 2001-2019 The PHP Group
All rights reserved.
Last updated: Fri Dec 06 08:01:24 2019 UTC