flaupretre/pecl-pcs

PCS Segmentation Fault on PHP Interactive Mode

Closed this issue · 6 comments

madhancock-zz commented

When running php -a with PCS installed on php 5.6.29 on Debian I'm seeing a segmentation fault.

Tested 1.3.0 and 1.3.1 - same result for both.

Discovered when adding PCS as a dependancy for PHP Couchbase. Quite likely associated with #6 and the issue that links to.

flaupretre commented

You may try again with version 1.3.2. This version fixes issue #6.

Unfortunately, I'm not sure your issue is related to #6. If the problem persists, can you please :

  • recompile pecl-pcs after uncommenting the '#define PCS_DEBUG' line in php_pcs.c',
  • and send a gdb backtrace ('gdb php / run -a / where')

Thanks

madhancock-zz commented

Hi Francois,

Still having the issue. The segfault is on a Debian server with PCS installed via PECL. I may be able to recompile when I've got time to manually install the module.

Here's a backtrace for how it is now:

(gdb) run -a
Starting program: /usr/bin/php -a
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
[New Thread 0x7fffede8a700 (LWP 351)]
[Thread 0x7fffede8a700 (LWP 351) exited]
Interactive mode enabled


Program received signal SIGSEGV, Segmentation fault.
0x0000000000736bee in execute_ex ()
(gdb) where
#0  0x0000000000736bee in execute_ex ()
#1  0x00000000006e7d58 in dtrace_execute_ex ()
#2  0x00000000006ea85a in execute_new_code ()
#3  0x00000000006bb28d in zendparse ()
#4  0x00000000006c0995 in compile_file ()
#5  0x00000000006e7cda in dtrace_compile_file ()
#6  0x00000000005572e5 in ?? ()
#7  0x00007fffeedf2528 in PCS_Loader_loadNode (throw=1, node=<optimized out>, node=<optimized out>) at /tmp/pear/temp/pcs/src/PCS_Loader.c:290
#8  0x00007fffeedf2ec1 in PCS_Loader_Init () at /tmp/pear/temp/pcs/src/PCS_Loader.c:639
#9  RINIT_PCS_Loader () at /tmp/pear/temp/pcs/src/PCS_Loader.c:702
#10 zm_activate_pcs (type=-134606616, module_number=0) at /tmp/pear/temp/pcs/php_pcs.c:166
#11 0x0000000000700c20 in zend_activate_modules ()
#12 0x000000000069404f in php_request_startup ()
#13 0x00000000007aa24c in ?? ()
#14 0x0000000000462c0d in main ()
flaupretre commented

Hi,

If I remember well, I compiled the pecl module on RHEL 7. In theory, it should be compatible with debian but weird things are always possible.

I'll instal a debian host and try to reproduce the issue. Can you tell me the OS version you're using ?

madhancock-zz commented

Thanks. Here's OS info.

SMP Debian 3.16.39-1 (2016-12-30) x86_64 GNU/Linux

Distributor ID:	Debian
Description:	Debian GNU/Linux 8.7 (jessie)
Release:	8.7
Codename:	jessie
flaupretre commented

Strange. Crash happens only on debian-provided php5 package and exclusively when setting the '-a' flag. Issue does not appear on a freshly-recompiled PHP 5.6.29 CLI interpreter.

I keep searching what is different in this package.

flaupretre commented

Hi. After investigating a little more, it appears that the issue is coming from changes introduced by debian packagers. I recompiled both original and modified source trees, as provided in the Debian PHP 5.6.29 source package. The original code works well, while the debian-modified code (named php5_5.6.29+dfsg-0+deb8u1.debian) crashes.

Unfortunately, the number of changes to the source code introduced by packagers is so huge that the best solution now, IMO, is to transfer them the issue. Actually, I am used with changes related to paths and configuration, but modifying the interpreter low-level code goes too far. As there's no comment, it is even impossible to check whether these patches were reported back to the PHP development.

Here is a debug trace with line numbers :

(gdb) run -a
Starting program: /usr/bin/php -a
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Interactive mode enabled

Program received signal SIGSEGV, Segmentation fault.
0x00000000008698a0 in execute_ex (execute_data=0x7ffff7fa81b0)
    at /share/src/php5-5.6.29+dfsg/Zend/zend_vm_execute.h:363
363                     if ((ret = OPLINE->handler(execute_data TSRMLS_CC)) > 0) {
(gdb) where
#0  0x00000000008698a0 in execute_ex (execute_data=0x7ffff7fa81b0)
    at /share/src/php5-5.6.29+dfsg/Zend/zend_vm_execute.h:363
#1  0x0000000000869935 in zend_execute (op_array=0x7ffff7fd9008)
    at /share/src/php5-5.6.29+dfsg/Zend/zend_vm_execute.h:388
#2  0x0000000000811336 in execute_new_code ()
    at /share/src/php5-5.6.29+dfsg/Zend/zend_execute_API.c:1203
#3  0x00000000007c0715 in zendparse ()
    at /share/src/php5-5.6.29+dfsg/Zend/zend_language_parser.c:3822
#4  0x00000000007c85fe in compile_file (file_handle=0x7fffffffd4d0, type=8)
    at Zend/zend_language_scanner.l:586
#5  0x0000000000660eac in phar_compile_file (file_handle=0x7fffffffd4d0,
    type=8) at /share/src/php5-5.6.29+dfsg/ext/phar/phar.c:3371
#6  0x00007ffff5f696e1 in PCS_Loader_loadNode (node=0x11a3d90, throw=1)
    at /share/pecl-pcs/src/PCS_Loader.c:290
#7  0x00007ffff5f6a6b6 in PCS_Loader_Init ()
    at /share/pecl-pcs/src/PCS_Loader.c:639
#8  0x00007ffff5f6a80c in RINIT_PCS_Loader ()
    at /share/pecl-pcs/src/PCS_Loader.c:702
#9  0x00007ffff5f6b9bc in zm_activate_pcs (type=1, module_number=26)
    at /share/pecl-pcs/php_pcs.c:166
#10 0x000000000082f5b1 in zend_activate_modules ()
    at /share/src/php5-5.6.29+dfsg/Zend/zend_API.c:2459
#11 0x000000000078dd35 in php_request_startup ()
    at /share/src/php5-5.6.29+dfsg/main/main.c:1686
#12 0x00000000008d8aa5 in do_cli (argc=2, argv=0x101f3d0)
    at /share/src/php5-5.6.29+dfsg/sapi/cli/php_cli.c:969
#13 0x00000000008d9d78 in main (argc=2, argv=0x101f3d0)
    at /share/src/php5-5.6.29+dfsg/sapi/cli/php_cli.c:1382