php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #76844 PHP crashes on big file with array inside
Submitted: 2018-09-05 17:03 UTC Modified: 2018-09-06 08:40 UTC
From: denis at bitrix dot ru Assigned:
Status: Open Package: opcache
PHP Version: 7.2.9 OS: Ubuntu 14.04.5 LTS
Private report: No CVE-ID: None
View Add Comment Developer Edit
Anyone can comment on a bug. Have a simpler test case? Does it work for you on a different platform? Let us know!
Just going to say 'Me too!'? Don't clutter the database with that please — but make sure to vote on the bug!
Your email address:
MUST BE VALID
Solve the problem:
12 - 2 = ?
Subscribe to this entry?

 
 [2018-09-05 17:03 UTC] denis at bitrix dot ru 
Description:
------------
I have auto generated 12M script which causes segmentation fault with opcache enabled.

$ gdb -ex=r --args php restore.file_list.php
GNU gdb (Ubuntu 7.7.1-0ubuntu5~14.04.3) 7.7.1
Copyright (C) 2014 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from php...Reading symbols from /usr/lib/debug/.build-id/c0/4daf2c7bc6200e0a02e127d552d4290d6678e0.debug...done.
done.
Starting program: /usr/bin/php restore.file_list.php
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".

Program received signal SIGSEGV, Segmentation fault.
zend_ssa_check_scc_var (op_array=op_array@entry=0x7ffff5883008, ssa=ssa@entry=0x7ffff59de028, var=65384, index=index@entry=0x7fffffffa48c, dfs=dfs@entry=0x7fffe9801000, 
    root=root@entry=0x7fffe9a01000, stack=stack@entry=0x7fffffffa490) at /build/php7.2-pz0P3X/php7.2-7.2.9/ext/opcache/Optimizer/zend_inference.c:173
173	{
(gdb) bt 10
#0  zend_ssa_check_scc_var (op_array=op_array@entry=0x7ffff5883008, ssa=ssa@entry=0x7ffff59de028, var=65384, index=index@entry=0x7fffffffa48c, dfs=dfs@entry=0x7fffe9801000, 
    root=root@entry=0x7fffe9a01000, stack=stack@entry=0x7fffffffa490) at /build/php7.2-pz0P3X/php7.2-7.2.9/ext/opcache/Optimizer/zend_inference.c:173
#1  0x00007ffff4a7eed6 in zend_ssa_check_scc_var (op_array=op_array@entry=0x7ffff5883008, ssa=ssa@entry=0x7ffff59de028, var=<optimized out>, index=index@entry=0x7fffffffa48c, 
    dfs=dfs@entry=0x7fffe9801000, root=root@entry=0x7fffe9a01000, stack=stack@entry=0x7fffffffa490) at /build/php7.2-pz0P3X/php7.2-7.2.9/ext/opcache/Optimizer/zend_inference.c:182
#2  0x00007ffff4a7eed6 in zend_ssa_check_scc_var (op_array=op_array@entry=0x7ffff5883008, ssa=ssa@entry=0x7ffff59de028, var=<optimized out>, index=index@entry=0x7fffffffa48c, 
    dfs=dfs@entry=0x7fffe9801000, root=root@entry=0x7fffe9a01000, stack=stack@entry=0x7fffffffa490) at /build/php7.2-pz0P3X/php7.2-7.2.9/ext/opcache/Optimizer/zend_inference.c:182
#3  0x00007ffff4a7eed6 in zend_ssa_check_scc_var (op_array=op_array@entry=0x7ffff5883008, ssa=ssa@entry=0x7ffff59de028, var=<optimized out>, index=index@entry=0x7fffffffa48c, 
    dfs=dfs@entry=0x7fffe9801000, root=root@entry=0x7fffe9a01000, stack=stack@entry=0x7fffffffa490) at /build/php7.2-pz0P3X/php7.2-7.2.9/ext/opcache/Optimizer/zend_inference.c:182
#4  0x00007ffff4a7eed6 in zend_ssa_check_scc_var (op_array=op_array@entry=0x7ffff5883008, ssa=ssa@entry=0x7ffff59de028, var=<optimized out>, index=index@entry=0x7fffffffa48c, 
    dfs=dfs@entry=0x7fffe9801000, root=root@entry=0x7fffe9a01000, stack=stack@entry=0x7fffffffa490) at /build/php7.2-pz0P3X/php7.2-7.2.9/ext/opcache/Optimizer/zend_inference.c:182
#5  0x00007ffff4a7eed6 in zend_ssa_check_scc_var (op_array=op_array@entry=0x7ffff5883008, ssa=ssa@entry=0x7ffff59de028, var=<optimized out>, index=index@entry=0x7fffffffa48c, 
    dfs=dfs@entry=0x7fffe9801000, root=root@entry=0x7fffe9a01000, stack=stack@entry=0x7fffffffa490) at /build/php7.2-pz0P3X/php7.2-7.2.9/ext/opcache/Optimizer/zend_inference.c:182
#6  0x00007ffff4a7eed6 in zend_ssa_check_scc_var (op_array=op_array@entry=0x7ffff5883008, ssa=ssa@entry=0x7ffff59de028, var=<optimized out>, index=index@entry=0x7fffffffa48c, 
    dfs=dfs@entry=0x7fffe9801000, root=root@entry=0x7fffe9a01000, stack=stack@entry=0x7fffffffa490) at /build/php7.2-pz0P3X/php7.2-7.2.9/ext/opcache/Optimizer/zend_inference.c:182
#7  0x00007ffff4a7eed6 in zend_ssa_check_scc_var (op_array=op_array@entry=0x7ffff5883008, ssa=ssa@entry=0x7ffff59de028, var=<optimized out>, index=index@entry=0x7fffffffa48c, 
    dfs=dfs@entry=0x7fffe9801000, root=root@entry=0x7fffe9a01000, stack=stack@entry=0x7fffffffa490) at /build/php7.2-pz0P3X/php7.2-7.2.9/ext/opcache/Optimizer/zend_inference.c:182
#8  0x00007ffff4a7eed6 in zend_ssa_check_scc_var (op_array=op_array@entry=0x7ffff5883008, ssa=ssa@entry=0x7ffff59de028, var=<optimized out>, index=index@entry=0x7fffffffa48c, 
    dfs=dfs@entry=0x7fffe9801000, root=root@entry=0x7fffe9a01000, stack=stack@entry=0x7fffffffa490) at /build/php7.2-pz0P3X/php7.2-7.2.9/ext/opcache/Optimizer/zend_inference.c:182
#9  0x00007ffff4a7eed6 in zend_ssa_check_scc_var (op_array=op_array@entry=0x7ffff5883008, ssa=ssa@entry=0x7ffff59de028, var=<optimized out>, index=index@entry=0x7fffffffa48c, 
    dfs=dfs@entry=0x7fffe9801000, root=root@entry=0x7fffe9a01000, stack=stack@entry=0x7fffffffa490) at /build/php7.2-pz0P3X/php7.2-7.2.9/ext/opcache/Optimizer/zend_inference.c:182
(More stack frames follow...)
(gdb) bt -1
#65394 0x00005555556422be in main (argc=2, argv=0x555555bfd6e0) at /build/php7.2-pz0P3X/php7.2-7.2.9/sapi/cli/php_cli.c:1404
(gdb) zbacktrace 
(gdb) 


Test script:
---------------
The script is uploaded to https://my.pcloud.com/publink/show?code=XZMTED7ZcA3xXabVtHSiwtefBkWj74HBSY1y

It is 12M length but very simple:

$ head restore.file_list.php 
<?
$a['modules/main/include/virtual_file_system.php'] = 1;
$a['modules/main/include/epilog_popup_admin.php'] = 1;
$a['modules/main/include/prolog_before.php'] = 1;
$a['modules/main/include/condition.php'] = 1;
$a['modules/main/include/mainpage.php'] = 1;
$a['modules/main/include/epilog.php'] = 1;
$a['modules/main/include/include_statistics_before.php'] = 1;
$a['modules/main/include/include_statistics.php'] = 1;
$a['modules/main/include/dbconn_error.php'] = 1;

$ tail restore.file_list.php
$a['components/bitrix/lists.element.edit/lang/en/ajax.php'] = 1;
$a['components/bitrix/lists.element.edit/lang/en/component.php'] = 1;
$a['components/bitrix/lists.element.edit/lang/en/.description.php'] = 1;
$a['components/bitrix/lists.element.edit/.description.php'] = 1;
$a['components/bitrix/tasks.interface.header/templates/.default/template.php'] = 1;
$a['components/bitrix/tasks.interface.header/templates/.default/script.js'] = 1;
$a['components/bitrix/tasks.interface.header/templates/.default/style.min.css'] = 1;
$a['components/bitrix/tasks.interface.header/templates/.default/script.map.js'] = 1;
$a['components/bitrix/tasks.interface.header/templates/.default/script.min.js'] = 1;
$a['components/bitrix/tasks.interface.header/class.php'] = 1;


Actual result:
--------------
$ php -d opcache.enable_cli=0 restore.file_list.php 
$ 
$ php -d opcache.enable_cli=1 restore.file_list.php 
Segmentation fault

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2018-09-05 17:13 UTC] spam2 at rhsoft dot net 
check your opcache settings especially interned strings buffer
 [2018-09-05 18:13 UTC] cmb@php.net 
On a quick glance, this looks like a stack overflow.
 [2018-09-06 08:24 UTC] denis at bitrix dot ru 
opcache.interned_strings_buffer doesn't seem to affect:

$ php -i|grep opcache.interned_strings_buffer
opcache.interned_strings_buffer => 8 => 8
$ php -d opcache.enable_cli=1 -d opcache.interned_strings_buffer=16 restore.file_list.php 
Segmentation fault

I guess, 16M should be enough for 12M file. And further I got an error:

$ php -d opcache.enable_cli=1 -d opcache.interned_strings_buffer=18 restore.file_list.php 
Thu Sep  6 10:19:14 2018 (12707): Fatal Error Zend OPcache cannot allocate buffer for interned strings
 [2018-09-06 08:31 UTC] spam2 at rhsoft dot net 
"Fatal Error Zend OPcache cannot allocate buffer for interned strings" clearly indicates that "opcache.memory_consumption" is way too small

frankly if you can allocate 18 MB i guess someone has lowered the default value

------

-rw-r--r-- 1 root root 198K 2018-03-05 16:37 /usr/share/phpMyAdmin/vendor/tecnickcom/tcpdf/fonts/dejavusans.ph

/usr/share/phpMyAdmin/vendor/tecnickcom/tcpdf/fonts/dejavusans.php allocates 1,36 MB in opcache so your guess 16M should be enough for 12M file is pretty wrong
 [2018-09-06 08:40 UTC] nikic@php.net 
@rhsoft: The interned strings buffer is not really relevant to this issue. As @cmb pointed out, this is a stack overflow in zend_ssa_check_scc_var. The test script has a very long (and linear) chain of uses, each of which results in another recursive call. This could be resolved either by making the algorithm non-recursive or adding / changing some limits. E.g. we might want to punt on SSA optimizations if there are too many SSA vars.
 [2019-06-29 13:09 UTC] cmb@php.net 
Related To: Bug #77620
 
PHP Copyright © 2001-2021 The PHP Group
All rights reserved. 		Last updated: Mon Jan 25 08:02:19 2021 UTC