Debian Bug report logs - #726295
php5: segfault on zend_deactivate

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: William Dauchy <wdauchy@gmail.com>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: php5: segfault on zend_deactivate

Date: Mon, 14 Oct 2013 09:53:11 +0200

Package: php5
Version: php5 5.4.4-14+deb7u5
Severity: normal
Tags: patch

We are sometines getting segfault with the following trace:

==22607== Invalid read of size 4
==22607==    at 0x84EA438: _zval_dtor_func (zend_variables.c:46)
==22607==    by 0x84DAA42: _zval_dtor (zend_variables.h:35)
==22607==    by 0x84DAAEF: i_zval_ptr_dtor (zend_execute.h:81)
==22607==    by 0x84DB851: _zval_ptr_dtor (zend_execute_API.c:428)
==22607==    by 0x84E032A: cleanup_user_class_data (zend_opcode.c:169)
==22607==    by 0x84E0419: zend_cleanup_user_class_data (zend_opcode.c:202)
==22607==    by 0x84FC771: zend_hash_reverse_apply (zend_hash.c:799)
==22607==    by 0x84DB4BE: shutdown_executor (zend_execute_API.c:289)
==22607==    by 0x84EC528: zend_deactivate (zend.c:939)
==22607==    by 0x84744D6: php_request_shutdown (main.c:1800)
==22607==    by 0x8585386: do_cli (php_cli.c:1176)
==22607==    by 0x8585B2F: main (php_cli.c:1377)
==22607==  Address 0x4949fa8 is 0 bytes inside a block of size 20 free'd
==22607==    at 0x4007F0F: free (vg_replace_malloc.c:446)
==22607==    by 0x84BFEA5: _efree (zend_alloc.c:2437)
==22607==    by 0x851CDEB: i_zval_ptr_dtor (zend_execute.h:82)
==22607==    by 0x8541EA6: ZEND_UNSET_DIM_SPEC_VAR_CONST_HANDLER (zend_vm_execute.h:15900)
==22607==    by 0x8521499: execute_ex (zend_vm_execute.h:356)
==22607==    by 0x85214FD: zend_execute (zend_vm_execute.h:381)
==22607==    by 0x84DD3D5: zend_call_function (zend_execute_API.c:941)
==22607==    by 0x85080A9: zend_call_method (zend_interfaces.c:97)
==22607==    by 0x8515232: zend_objects_destroy_object (zend_objects.c:123)
==22607==    by 0x851B546: zend_objects_store_del_ref_by_handle_ex (zend_objects_API.c:207)
==22607==    by 0x851B426: zend_objects_store_del_ref (zend_objects_API.c:173)
==22607==    by 0x84EA474: _zval_dtor_func (zend_variables.c:54)

It appears that we found a related bug upstream:
https://bugs.php.net/64720

The patch attached is here
http://git.php.net/?p=php-src.git;a=commit;h=77fffff15762137e2d8173df9b733b4cb70fc996

The patch seems more than needed for the wheezy version.

Thanks,
-- 
William

Message #10 received at 726295-done@bugs.debian.org (full text, mbox, reply):

From: Thijs Kinkhorst <thijs@debian.org>

To: 725868-done@bugs.debian.org, 725890-done@bugs.debian.org, 725972-done@bugs.debian.org, 726033-done@bugs.debian.org, 726037-done@bugs.debian.org, 726295-done@bugs.debian.org, 726320-done@bugs.debian.org, 726379-done@bugs.debian.org, 726627-done@bugs.debian.org, 726633-done@bugs.debian.org

Subject: fixed in php5 5.4.4-14+deb7u6

Date: Thu, 12 Dec 2013 21:57:49 +0100

[Message part 1 (text/plain, inline)]

Version: 5.4.4-14+deb7u6

php5 (5.4.4-14+deb7u6) stable; urgency=low

  [ William Dauchy ]
  * upstream fix: curl memory leak (Closes: #725868)
  * upstream fix: allow root to run php-fpm (Closes: #725890)
  * upstream fix: remove annoying warnings with php-fpm and user usage
    (Closes: #725972)
  * upstream fix: memoryleak in function declaration (Closes: #726033)
  * upstream fix: munmap() is called with the incorrect length (Closes: 
#726037)
  * upstream fix: segfault on zend_deactivate (Closes: #726295)
  * upstream fix: Possible null dereference (Closes: #726320)
  * upstream fix: Phar::buildFromDirectory creates corrupt archives
    (Closes: #726379)
  * upstream fix: segfault while loading extensions (Closes: #726627)
  * upstream fix: (un)serialize() leaves dangling pointers, causes crashes
    (Closes: #726633)

[signature.asc (application/pgp-signature, inline)]

Send a report that this bug log contains spam.