View Issue Details

Jump to Notes
IDProjectCategoryView StatusDate SubmittedLast Update
0002146XdebugUncategorizedpublic2022-12-12 11:192023-03-21 16:30
Reporterxpender Assigned To 
PrioritynormalSeveritycrashReproducibilityalways
Status closedResolutionfixed 
Product Version3.2.0 
Fixed in Version3.2.1 
Summary0002146: apache2 segfaulting with version 3.2.0 on PHP 8.0
Description

With xdebug version 3.2.0 we are seeing apache2 segfaults, and it seems to be related to the xdebug module. With version 3.1.5 it's works fine again.

Debian bullseye - arm64
Apache/2.4.54 (Debian) - 2022-11-29T14:56:10
PHP Version 8.0.26

For PHP & xdebug we are using packages from https://deb.sury.org/

I attached a phpinfo() output of the webserver.

valgrind output:

==5872== Invalid read of size 8
==5872== at 0x59387BC: register_compiled_variables (debugger.c:103)
==5872== by 0x5939137: xdebug_debugger_error_cb (debugger.c:432)
==5872== by 0x5947563: xdebug_develop_error_cb (stack.c:800)
==5872== by 0x5DE156F: ??? (in /usr/lib/apache2/modules/libphp8.0.so)
==5872== by 0x5DE1CCB: zend_error_zstr (in /usr/lib/apache2/modules/libphp8.0.so)
==5872== by 0x5DE055F: php_verror (in /usr/lib/apache2/modules/libphp8.0.so)
==5872== by 0x5DE06A7: php_error_docref (in /usr/lib/apache2/modules/libphp8.0.so)
==5872== by 0xAD12C8F: ??? (in /usr/lib/php/20200930/mbstring.so)
==5872== by 0x6026FA3: zend_alter_ini_entry_ex (in /usr/lib/apache2/modules/libphp8.0.so)
==5872== by 0x6027163: zend_alter_ini_entry_chars (in /usr/lib/apache2/modules/libphp8.0.so)
==5872== by 0x604BA97: ??? (in /usr/lib/apache2/modules/libphp8.0.so)
==5872== by 0x604AFC3: ??? (in /usr/lib/apache2/modules/libphp8.0.so)
==5872== Address 0x8 is not stack'd, malloc'd or (recently) free'd
==5872==
==5872==
==5872== Process terminating with default action of signal 11 (SIGSEGV)
==5872== Access not within mapped region at address 0x8
==5872== at 0x59387BC: register_compiled_variables (debugger.c:103)
==5872== by 0x5939137: xdebug_debugger_error_cb (debugger.c:432)
==5872== by 0x5947563: xdebug_develop_error_cb (stack.c:800)
==5872== by 0x5DE156F: ??? (in /usr/lib/apache2/modules/libphp8.0.so)
==5872== by 0x5DE1CCB: zend_error_zstr (in /usr/lib/apache2/modules/libphp8.0.so)
==5872== by 0x5DE055F: php_verror (in /usr/lib/apache2/modules/libphp8.0.so)
==5872== by 0x5DE06A7: php_error_docref (in /usr/lib/apache2/modules/libphp8.0.so)
==5872== by 0xAD12C8F: ??? (in /usr/lib/php/20200930/mbstring.so)
==5872== by 0x6026FA3: zend_alter_ini_entry_ex (in /usr/lib/apache2/modules/libphp8.0.so)
==5872== by 0x6027163: zend_alter_ini_entry_chars (in /usr/lib/apache2/modules/libphp8.0.so)
==5872== by 0x604BA97: ??? (in /usr/lib/apache2/modules/libphp8.0.so)
==5872== by 0x604AFC3: ??? (in /usr/lib/apache2/modules/libphp8.0.so)
==5872== If you believe this happened as a result of a stack
==5872== overflow in your program's main thread (unlikely but
==5872== possible), you can try to increase the size of the
==5872== main thread stack using the --main-stacksize= flag.
==5872== The main thread stack size used in this run was 8388608.

TagsNo tags attached.
Operating System
PHP Version8.0.20-8.0.29

Activities

derick

2022-12-13 17:46

administrator   ~0006482

I think I know what the problem is, and how to fix is.

However, I can not reproduce this. From what I can guess from your stack trace is, is that this happens when setting an mbstring related INI setting, which is deprecated. This deprecation throws a warning, but I can't see from the valgrind stack trace how and when. Could you run, and let me know, about:

  1. run valgrind once more on this, with also using --num-callers=32 (this will make it slower)
  2. if it's on the command line, show me your exact line that you called
  3. any specific settings that you have made in any of the ini files
  4. a reproducible short case perhaps?

xpender

2022-12-14 09:17

reporter   ~0006483

I think I can confirm it's related to the mbstring extension. If I'm disabling the mbstring extension completely the segfaults are gone.

Guess the root cause is, we've been setting "php_value mbstring.internal_encoding utf-8" via the Apache vhost configuration - when I remove this and reactivate mbstring again, the segfaults are still gone.

  1. I did, but don't really see an difference:

==1709== Invalid read of size 8
==1709== at 0x59387BC: register_compiled_variables (debugger.c:103)
==1709== by 0x5939137: xdebug_debugger_error_cb (debugger.c:432)
==1709== by 0x5947563: xdebug_develop_error_cb (stack.c:800)
==1709== by 0x5DE156F: ??? (in /usr/lib/apache2/modules/libphp8.0.so)
==1709== by 0x5DE1CCB: zend_error_zstr (in /usr/lib/apache2/modules/libphp8.0.so)
==1709== by 0x5DE055F: php_verror (in /usr/lib/apache2/modules/libphp8.0.so)
==1709== by 0x5DE06A7: php_error_docref (in /usr/lib/apache2/modules/libphp8.0.so)
==1709== by 0xAD12C8F: ??? (in /usr/lib/php/20200930/mbstring.so)
==1709== by 0x6026FA3: zend_alter_ini_entry_ex (in /usr/lib/apache2/modules/libphp8.0.so)
==1709== by 0x6027163: zend_alter_ini_entry_chars (in /usr/lib/apache2/modules/libphp8.0.so)
==1709== by 0x604BA97: ??? (in /usr/lib/apache2/modules/libphp8.0.so)
==1709== by 0x604AFC3: ??? (in /usr/lib/apache2/modules/libphp8.0.so)
==1709== by 0x17086F: ap_run_handler (in /usr/sbin/apache2)
==1709== by 0x170F77: ap_invoke_handler (in /usr/sbin/apache2)
==1709== by 0x1896C7: ap_process_async_request (in /usr/sbin/apache2)
==1709== by 0x189877: ap_process_request (in /usr/sbin/apache2)
==1709== by 0x1857DF: ??? (in /usr/sbin/apache2)
==1709== by 0x17A54F: ap_run_process_connection (in /usr/sbin/apache2)
==1709== by 0x522416F: ??? (in /usr/lib/apache2/modules/mod_mpm_prefork.so)
==1709== by 0x52244B3: ??? (in /usr/lib/apache2/modules/mod_mpm_prefork.so)
==1709== by 0x522521F: ??? (in /usr/lib/apache2/modules/mod_mpm_prefork.so)
==1709== by 0x150613: ap_run_mpm (in /usr/sbin/apache2)
==1709== by 0x147CF3: main (in /usr/sbin/apache2)
==1709== Address 0x8 is not stack'd, malloc'd or (recently) free'd

  1. Not on command line, also been not able to reproduce this on cmd line

  2. & 4. As written, looks like related to "php_value mbstring.internal_encoding utf-8" - when setting this, we are doing it inside an <VirtualHost> entry, I have the feeling that there is a chance of 50:50 that any PHP script will segfault.

We'll remove the mbstring.internal_encoding as it's anyway deprecated. Thanks for your help already. But still it think it would be better that this doesn't result in a segfault.

derick

2022-12-14 11:33

administrator   ~0006486

I could reproduce it with this additional information, and CI is now testing a fix: https://github.com/xdebug/xdebug/pull/875