0001277: Crash when another extension calls call_user_function() with params during RINIT

View Issue Details [ Jump to Notes ]

[ Issue History ] [ Print ]

Project

Category

View Status

Date Submitted

Last Update

0001277

Xdebug

(No Category)

public

2016-03-02 05:22

2016-03-04 15:32

Reporter

bittercookie

Assigned To

derick

Priority

normal

Severity

crash

Reproducibility

always

Status

closed

Resolution

fixed

Platform

OS Version

Product Version

2.4.0rc4

Target Version

Fixed in Version

2.4.1

Summary

0001277: Crash when another extension calls call_user_function() with params during RINIT

Description

(PHP 5.5.30) When trying to use xdebug and my extension, php during first RINIT without executing anything.

Program received signal SIGSEGV, Segmentation fault.

    /lib/x86_64-linux-gnu/libc.so.6(+0x36eb0) [0x7fc25c258eb0]
    /SpyTest/PHP/Compatibility/PHP_Runtime/PHP/lib/php/extensions/no-debug-non-zts-20121212/xdebug.so(xdebug_hash_extended_find+0x5b) [0x7fc255286e6b]
    /SpyTest/PHP/Compatibility/PHP_Runtime/PHP/lib/php/extensions/no-debug-non-zts-20121212/xdebug.so(+0x1f5ad) [0x7fc2552875ad]
    /SpyTest/PHP/Compatibility/PHP_Runtime/PHP/lib/php/extensions/no-debug-non-zts-20121212/xdebug.so(xdebug_profiler_function_user_end+0x15b) [0x7fc255287acb]
    /SpyTest/PHP/Compatibility/PHP_Runtime/PHP/lib/php/extensions/no-debug-non-zts-20121212/xdebug.so(xdebug_execute_internal+0x308) [0x7fc255277d58]
    php-fpm: pool www(zend_call_function+0xc8d) [0x76815d]
    php-fpm: pool www(call_user_function_ex+0x5f) [0x76821f]
    php-fpm: pool www(call_user_function+0x46) [0x768296]
    ...

the pseudocode in RINIT is:

zval rs_function_name, rs_function_ret;
INIT_ZVAL_STRING(rs_function_name, "register_shutdown_function");
CALL_PARAM rs_param[1];
CALL_PARAM_STRING(rs_param[0], "my_rshutdowncall");
if (call_user_function(EG(function_table), NULL, &rs_function_name, &rs_function_ret, 1, rs_param TSRMLS_CC) == SUCCESS) {
}
DTOR_ZVAL_PTR(&rs_function_name);
DTOR_ZVAL_PTR(&rs_function_ret);
zval_ptr_dtor(&rs_param[0]);

Tags

No tags attached.

Operating System

CentOS

PHP Version

5.5.30-5.5.34

Attached Files

xdebug-crush-extension.rar [^] (1,938 bytes) 2016-03-03 04:53

Relationships

Notes
(0003538) derick (administrator) 2016-03-02 11:12	Please provide working code, I do not have to time to rewrite part of your extension to reproduce a crash. Besides the working extension code, I'd also need a way how to reproduce this on the command line - likely, your php.ini settings have an influence on this (I am guessing the profiler related ones).

(0003539) bittercookie (reporter) 2016-03-03 04:57 edited on: 2016-03-03 05:02	"xdebug-crush-extension.rar" for the bug. You must add the following configuration xdebug.profiler_enable=1 xdebug.profiler_output_dir="/tmp" add a php script to your website: echo "<?php phpinfo(); ?>" > /var/www/html/info.php visite info.php in browser

(0003540) derick (administrator) 2016-03-04 15:32	Thanks, with that I could reproduce it. I did need two requests though, and not just one. It's fixed on GitHub now and ready for 2.4.1.

Issue History
Date Modified	Username	Field	Change
2016-03-02 05:22	bittercookie	New Issue
2016-03-02 11:12	derick	Note Added: 0003538
2016-03-02 11:12	derick	Assigned To	=> derick
2016-03-02 11:12	derick	Status	new => feedback
2016-03-03 04:53	bittercookie	File Added: xdebug-crush-extension.rar
2016-03-03 04:57	bittercookie	Note Added: 0003539
2016-03-03 04:57	bittercookie	Status	feedback => assigned
2016-03-03 04:57	bittercookie	Note Edited: 0003539	View Revisions
2016-03-03 05:02	bittercookie	Note Edited: 0003539	View Revisions
2016-03-04 15:32	derick	Note Added: 0003540
2016-03-04 15:32	derick	Status	assigned => closed
2016-03-04 15:32	derick	Resolution	open => fixed
2016-03-04 15:32	derick	Fixed in Version	=> 2.4.1
2016-07-31 13:35	derick	Category	Debug client (console) => debugclient (debugging tool)
2016-07-31 13:35	derick	Category	debugclient (debugging tool) => (No Category)