[PHP-DEV] PHP 4.0 Bug #5615: SIGSEGV combining PHP/OCI8/SSL From: greg <email protected>
Date: 07/14/00

From: greg <email protected>
Operating system: Linux RedHat 6.2
PHP version: 4.0.1pl2
PHP Bug Type: Reproduceable crash
Bug description: SIGSEGV combining PHP/OCI8/SSL

We're observing silent crashes combining Apache+Mod_SSL+EasySoft+OCI8 as DSO's

Attempting to build all modules as DSO's, included modules: default Apache, rewrite, mod_ssl, php4.

Observed problem: SIGSEGV, segmentation fault deep in PHP code, modf() calls when first loading Apache.

Various combinations and results:
1. Configure Apache-mods (DSO), SSL (DSO), PHP/oci8 (DSO). Problem = Described above--SIGSEGV. (GDBM trace provided)

2. Configure Apache-mods (DSO), SSL (DSO), PHP (DSO), remove OCI8. Apache works fine.

3. Configure Apache-mods (static), SSL (DSO), PHP/oci8 (DSO). Problem = Apache loads and responds to requests, including Easysoft and Oracle. However, when sending a sigHUP (reload) to Apache a similar SIGSEGV fault happens (2nd GDBM trace provided).

4. Configure Apache-mods (static), SSL (static), PHP/oci8 (DSO). Problem = same as #3. Works but crashes on sigHUP.

5. Configure Apache-mods (DSO), PHP/oci8 (DSO), eliminate SSL. Apache works fine, DB's work fine.

6. Configure Apache-mods (static), PHP/oci8 (DSO), eliminate SSL. Works fine also.

Have tried many variations on PHP configuration switches with no variation in the observed results. Have not seriously considered compiling PHP statically due to its 2MB+ size and resulting performance hit.

Looking at the GDB trace, it's obvious values are getting clobbered in some kind of memory/buffer overrun. Removing SSL or OCI8 eliminates the problem, yet the traces don't suggest any specific interaction problems. It looks more like some memory management problem/conflict.

*****Apache 1.3.12 Config (all modules DSO):*****

OPTIM="-g -ggdb3" \
LDFLAGS="-lpthread" \
SSL_BASE="/home/gpaul/packages/openssl-0.9.5" \
RSA_BASE="/home/gpaul/packages/rsaref-2.0/local" \
./configure \
"--with-layout=Apache" \
"--with-perl=/usr/bin/perl" \
"--enable-module=rewrite" \
"--enable-module=ssl" \
"--enable-shared=ssl" \
"--enable-shared=max" \
"--enable-module=so" \
"--prefix=/usr/local/apache" \
"--disable-rule=SSL_COMPAT" \

*****PHP 4.0.1pl2 Config:*****

./configure \
  --enable-xml \
  --enable-wddx \
  --with-esoob=/usr/local/easysoft/oob/client \
  --enable-track-vars \
  --enable-magic-quotes \
  --with-apxs=/usr/local/apache/bin/apxs \
  --with-config-file-path=/usr/local/apache/conf \
  --enable-sigchild \
  --with-gnu-ld \
  --with-oci8=/home/oracle \
  --enable-shared \
  --libexecdir=/usr/local/apache/libexec

*****GDBM Crash Trace with all modules configured as DSO:*****

(gdb) run -X -DSSL
Starting program: /usr/local/apache/bin/httpd -X -DSSL

Program received signal SIGSEGV, Segmentation fault.
0x403ceb90 in modf () from /usr/local/apache/libexec/libphp4.so
(gdb) bt
#0 0x403ceb90 in modf () from /usr/local/apache/libexec/libphp4.so
#1 0x8072977 in ap_cvt (arg=47.640187918506648, ndigits=0, decpt=0xbffff708,
    sign=0xbffff77c, eflag=-1073744200, buf=0x402e19b0 "Ø£\r")
    at ap_snprintf.c:144
#2 0x8072c47 in ap_fcvt (arg=47.640187918506648, ndigits=0, decpt=0xbffff708,
    sign=0xbffff77c, buf=0xbffff6b8 "\034ø¿\eøÃ") at ap_snprintf.c:209
#3 0x807330b in conv_fp (format=102 'f', num=47.640187918506648, add_dp=NO,
    precision=0, is_negative=0xbffff77c,
    buf=0xbffff79d "=\032@\002#\002@< \002 <email protected>\032@`=\032 <email protected>\r@\001",
    len=0xbffff9c8) at ap_snprintf.c:516
#4 0x8073f94 in ap_vformatter (flush_func=0x807464c <snprintf_flush>,
    vbuff=0xbffff9e8, fmt=0x402c4b31 "f", ap=0xbffffa14) at ap_snprintf.c:930
#5 0x8074698 in ap_snprintf (
    buf=0xbffffa20 "\213\227^ÌEz;D\022\205Œ}Ö6\223¤ì\eÃã¹d' <email protected>ú¿\004", len=50,
    format=0x402c4b2e "%.0f") at ap_snprintf.c:1164
#6 0x4023ebf4 in ssl_io_data_cb (bio=0x0, cmd=127, argp=0x402e19b0 "Ø£\r",
    argi=1073786464, argl=17484, rc=963629086) at ssl_engine_io.c:693
#7 0x4023e98e in ssl_io_data_dump (srvr=0x80b6cc4,
    s=0x80b6c9c "\220l\013\b¤Y\017\b `\017\b", len=1) at ssl_engine_io.c:662
#8 0x40239e67 in ssl_init_ConfigureServer (s=0x80b6cc4, p=0x80b6c9c,
    sc=0x401a51ec) at ssl_engine_init.c:713
#9 0x8056db9 in ap_init_modules (p=0x80b6c9c, s=0x80b6cc4)
    at http_config.c:1568
#10 0x8060835 in standalone_main (argc=3, argv=0xbffffca4) at http_main.c:4719
#11 0x8061053 in main (argc=3, argv=0xbffffca4) at http_main.c:5092
(gdb)

*****GDBM Crash Trace with only SSL and PHP configured as DSO when a sigHUP is receieved:*****

Attaching to program: /usr/local/apache/bin/httpd, Pid 12299
Reading symbols from /lib/libpthread.so.0...done.
Reading symbols from /lib/libm.so.6...done.
Reading symbols from /lib/libcrypt.so.1...done.
Reading symbols from /lib/libdb.so.3...done.
Reading symbols from /lib/libdl.so.2...done.
Reading symbols from /lib/libc.so.6...done.
Reading symbols from /lib/ld-linux.so.2...done.
Reading symbols from /lib/libresolv.so.2...done.
Reading symbols from /lib/libnss_files.so.2...done.
Reading symbols from /lib/libnss_dns.so.2...done.
Reading symbols from /usr/local/apache/libexec/libssl.so...done.
Reading symbols from /usr/local/apache/libexec/libphp4.so...done.
Reading symbols from /usr/lib/libgdbm.so.2...done.
Reading symbols from /usr/local/easysoft/oob/client/libesoobclient.so...done.
Reading symbols from /lib/libpam.so.0...done.
Reading symbols from /home/oracle/lib/libclntsh.so.1.0...done.
---Type <return> to continue, or q <return> to quit---
Reading symbols from /usr/lib/libttf.so.2...done.
Reading symbols from /usr/lib/libgd.so.1...done.
Reading symbols from /lib/libnsl.so.1...done.
Reading symbols from /usr/local/easysoft/lib/libesrpc.so...done.
Reading symbols from /usr/local/easysoft/lib/libsupport.so...done.
Reading symbols from /usr/local/easysoft/lib/libextra.so...done.
0x4016217e in __select () from /lib/libc.so.6
(gdb) c
Continuing.

Program received signal SIGHUP, Hangup.
0x4016217e in __select () from /lib/libc.so.6
(gdb) c
Continuing.

Program received signal SIGHUP, Hangup.
0x400d3d41 in __kill () from /lib/libc.so.6
(gdb) c
Continuing.

Program received signal SIGSEGV, Segmentation fault.
0x40370b90 in modf () from /usr/local/apache/libexec/libphp4.so
(gdb) bt
#0 0x40370b90 in modf () from /usr/local/apache/libexec/libphp4.so
#1 0x8094c87 in ap_cvt (arg=112.64734500211074, ndigits=0, decpt=0xbffff738,
    sign=0xbffff7ac, eflag=-1073744152, buf=0x402839b0 "Ø£\r")
    at ap_snprintf.c:144
#2 0x8094f57 in ap_fcvt (arg=112.64734500211074, ndigits=0, decpt=0xbffff738,
    sign=0xbffff7ac, buf=0xbffff6e8 "Lø¿KøÃ") at ap_snprintf.c:209
#3 0x809561b in conv_fp (format=102 'f', num=112.64734500211074, add_dp=NO,
    precision=0, is_negative=0xbffff7ac,
    buf=0xbffff7cd "=\032@\002#\002@< \002 <email protected>\032@`=\032 <email protected>\r@\001",
    len=0xbffff9f8) at ap_snprintf.c:516
#4 0x80962a4 in ap_vformatter (flush_func=0x809695c <snprintf_flush>,
    vbuff=0xbffffa18, fmt=0x40266b31 "f", ap=0xbffffa44) at ap_snprintf.c:930
#5 0x80969a8 in ap_snprintf (
    buf=0xbffffa50 "\226*Œ>µÎµ\ex\230\002»\210AªÈÚRGä¹\204!@ ú¿\004", len=50,
    format=0x40266b2e "%.0f") at ap_snprintf.c:1164
#6 0x401e0bf4 in ssl_io_data_cb (bio=0x0, cmd=127, argp=0x402839b0 "Ø£\r",
    argi=1073786464, argl=12299, rc=963630078) at ssl_engine_io.c:693
#7 0x401e098e in ssl_io_data_dump (srvr=0x80e4ee4,
    s=0x80e4ebc "°N\016\bh¢\021\btÁ\021\b", len=1) at ssl_engine_io.c:662
#8 0x401dbe67 in ssl_init_ConfigureServer (s=0x80e4ee4, p=0x80e4ebc,
    sc=0x401a51ec) at ssl_engine_init.c:713
#9 0x80790c9 in ap_init_modules (p=0x80e4ebc, s=0x80e4ee4)
    at http_config.c:1568
#10 0x8082b45 in standalone_main (argc=2, argv=0xbffffcd4) at http_main.c:4719
#11 0x8083363 in main (argc=2, argv=0xbffffcd4) at http_main.c:5092
(gdb) 

-- 
PHP Development Mailing List <http://www.php.net/>
To unsubscribe, e-mail: php-dev-unsubscribe <email protected>
For additional commands, e-mail: php-dev-help <email protected>
To contact the list administrators, e-mail: php-list-admin <email protected>