Debian Bug report logs - #817917
Segfault in zval_scan_black

version graph

Package: php5; Maintainer for php5 is (unknown);

Reported by: d.sanader@planet-work.com

Date: Fri, 11 Mar 2016 15:06:02 UTC

Severity: normal

Found in version php5/5.6.17+dfsg-0+deb8u1

Fixed in version 5.6.26+dfsg-1+rm

Done: Debian FTP Masters <ftpmaster@ftp-master.debian.org>

Bug is archived. No further changes may be made.

Toggle useless messages

View this report as an mbox folder, status mbox, maintainer mbox

Report forwarded to debian-bugs-dist@lists.debian.org, Debian PHP Maintainers <pkg-php-maint@lists.alioth.debian.org>:
Bug#817917; Package php5. (Fri, 11 Mar 2016 15:06:06 GMT) (full text, mbox, link).

Acknowledgement sent to d.sanader@planet-work.com:
New Bug report received and forwarded. Copy sent to Debian PHP Maintainers <pkg-php-maint@lists.alioth.debian.org>. (Fri, 11 Mar 2016 15:06:06 GMT) (full text, mbox, link).

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Dejan SANADER <d.sanader@planet-work.com>
To: submit@bugs.debian.org
Subject: Segfault in zval_scan_black
Date: Fri, 11 Mar 2016 14:39:33 +0100
Package: php5
Version: 5.6.17+dfsg-0+deb8u1

Hello,

I'm experiencing a systematic segfault on a peculiar page of a PHP app.

I've obtained the following backtrace.

I suppose more useful input might be needed, please advize me in that 
case on what must be retrieved and how.

Regards.


Program received signal SIGSEGV, Segmentation fault.
0x00007ffff36acb4e in zval_scan_black (pz=<optimized out>) at 
/build/php5-5.6.17+dfsg/Zend/zend_gc.c:313
313 /build/php5-5.6.17+dfsg/Zend/zend_gc.c: No such file or directory.
#0  0x00007ffff36acb4e in zval_scan_black (pz=<optimized out>) at 
/build/php5-5.6.17+dfsg/Zend/zend_gc.c:313
#1  0x00007ffff36acee4 in zobj_scan_black (pz=<optimized out>, 
pz@entry=0x7fffffe36740, obj=<optimized out>)
    at /build/php5-5.6.17+dfsg/Zend/zend_gc.c:347
#2  0x00007ffff36ada7e in zobj_scan (pz=0x7fffffe36740) at 
/build/php5-5.6.17+dfsg/Zend/zend_gc.c:580
#3  gc_scan_roots () at /build/php5-5.6.17+dfsg/Zend/zend_gc.c:620
#4  gc_collect_cycles () at /build/php5-5.6.17+dfsg/Zend/zend_gc.c:791
#5  0x00007ffff36adb8f in gc_zobj_possible_root (zv=0x555555e5c8b0) at 
/build/php5-5.6.17+dfsg/Zend/zend_gc.c:216
#6  0x00007ffff373b01d in gc_zval_check_possible_root (z=<optimized out>)
    at /build/php5-5.6.17+dfsg/Zend/zend_gc.h:183
#7  i_zval_ptr_dtor (zval_ptr=<optimized out>) at 
/build/php5-5.6.17+dfsg/Zend/zend_execute.h:86
#8  zend_vm_stack_clear_multiple (nested=<optimized out>) at 
/build/php5-5.6.17+dfsg/Zend/zend_execute.h:308
#9  zend_do_fcall_common_helper_SPEC (execute_data=0x5555585a1f48)
    at /build/php5-5.6.17+dfsg/Zend/zend_vm_execute.h:650
#10 0x00007ffff36c9dc0 in execute_ex (execute_data=0x5555585a1f48)
    at /build/php5-5.6.17+dfsg/Zend/zend_vm_execute.h:363
#11 0x00007ffff367b5b8 in dtrace_execute_ex (execute_data=0x5555585a1f48)
    at /build/php5-5.6.17+dfsg/Zend/zend_dtrace.c:73
[...]
#15138 0x00007ffff373b953 in zend_do_fcall_common_helper_SPEC 
(execute_data=0x7ffff7eac210)
    at /build/php5-5.6.17+dfsg/Zend/zend_vm_execute.h:592
#15139 0x00007ffff36c9dc0 in execute_ex (execute_data=0x7ffff7eac210)
    at /build/php5-5.6.17+dfsg/Zend/zend_vm_execute.h:363
#15140 0x00007ffff367b5b8 in dtrace_execute_ex (execute_data=0x7ffff7eac210)
    at /build/php5-5.6.17+dfsg/Zend/zend_dtrace.c:73
#15141 0x00007ffff368e0b0 in zend_execute_scripts (type=1441122480, 
type@entry=8, retval=0x7fffffe36660,
    retval@entry=0x0, file_count=0, file_count@entry=3) at 
/build/php5-5.6.17+dfsg/Zend/zend.c:1341
#15142 0x00007ffff3629c60 in php_execute_script 
(primary_file=primary_file@entry=0x7fffffffde20)
    at /build/php5-5.6.17+dfsg/main/main.c:2597
#15143 0x00007ffff373cffa in php_handler (r=<optimized out>)
    at /build/php5-5.6.17+dfsg/sapi/apache2handler/sapi_apache2.c:667
#15144 0x00005555555ac2a0 in ap_run_handler (r=r@entry=0x7ffff7e2c0a0) 
at config.c:169
#15145 0x00005555555ac7e9 in ap_invoke_handler (r=0x7ffff7e2c0a0) at 
config.c:433
#15146 0x00005555555c2682 in ap_process_async_request (r=0x7ffff7e2c0a0) 
at http_request.c:317
#15147 0x00005555555c2820 in ap_process_request (r=0x7ffff7e2c0a0) at 
http_request.c:363
#15148 0x00005555555bf122 in ap_process_http_sync_connection 
(c=0x7ffff7e32290) at http_core.c:190
#15149 ap_process_http_connection (c=0x7ffff7e32290) at http_core.c:231
#15150 0x00005555555b5b10 in ap_run_process_connection 
(c=0x7ffff7e32290) at connection.c:41
#15151 0x00007ffff405f7ba in child_main (child_num_arg=1441122480) at 
prefork.c:704
#15152 0x00007ffff405f9c7 in make_child (s=0x7ffff7fc0de0, slot=0) at 
prefork.c:746
#15153 0x00007ffff406070d in prefork_run (_pconf=0x5555557f2f38 
<ap_server_conf>, plog=0x7ffff7fbc028,
    s=0x7ffff7fc0de0) at prefork.c:956
#15154 0x0000555555591e7e in ap_run_mpm (pconf=0x7ffff7fee028, 
plog=0x7ffff7fbc028, s=0x7ffff7fc0de0)
    at mpm_common.c:94
#15155 0x000055555558b3c3 in main (argc=2, argv=0x7fffffffe578) at 
main.c:777

Information forwarded to debian-bugs-dist@lists.debian.org, Debian PHP Maintainers <pkg-php-maint@lists.alioth.debian.org>:
Bug#817917; Package php5. (Fri, 11 Mar 2016 19:33:04 GMT) (full text, mbox, link).

Acknowledgement sent to Ondřej Surý <ondrej@sury.org>:
Extra info received and forwarded to list. Copy sent to Debian PHP Maintainers <pkg-php-maint@lists.alioth.debian.org>. (Fri, 11 Mar 2016 19:33:04 GMT) (full text, mbox, link).

Message #10 received at 817917@bugs.debian.org (full text, mbox, reply):

From: Ondřej Surý <ondrej@sury.org>
To: Dejan SANADER <d.sanader@planet-work.com>, 817917@bugs.debian.org
Subject: Re: [php-maint] Bug#817917: Segfault in zval_scan_black
Date: Fri, 11 Mar 2016 20:29:14 +0100
Dejan,

[now with cc to BTS]

as a first option, could you please install (on testing machine where
you can reproduce the error), update PHP from here:

https://packages.sury.org/php5-5.6/

and also install php5-dbg package. Then try reproduce the error again.
If you are successful it might be worth reporting the crash to upstream
bug tracker here: https://bugs.php.net/ using instructions here:
https://bugs.php.net/how-to-report.php

as you are the one who can reproduce the issue, so it's best if you have
a contact with upstream developers directly.

Cheers,
-- 
Ondřej Surý <ondrej@sury.org>
Knot DNS (https://www.knot-dns.cz/) – a high-performance DNS server

On Fri, Mar 11, 2016, at 14:39, Dejan SANADER wrote:
> Package: php5
> Version: 5.6.17+dfsg-0+deb8u1
> 
> Hello,
> 
> I'm experiencing a systematic segfault on a peculiar page of a PHP app.
> 
> I've obtained the following backtrace.
> 
> I suppose more useful input might be needed, please advize me in that 
> case on what must be retrieved and how.
> 
> Regards.
> 
> 
> Program received signal SIGSEGV, Segmentation fault.
> 0x00007ffff36acb4e in zval_scan_black (pz=<optimized out>) at 
> /build/php5-5.6.17+dfsg/Zend/zend_gc.c:313
> 313 /build/php5-5.6.17+dfsg/Zend/zend_gc.c: No such file or directory.
> #0  0x00007ffff36acb4e in zval_scan_black (pz=<optimized out>) at 
> /build/php5-5.6.17+dfsg/Zend/zend_gc.c:313
> #1  0x00007ffff36acee4 in zobj_scan_black (pz=<optimized out>, 
> pz@entry=0x7fffffe36740, obj=<optimized out>)
>      at /build/php5-5.6.17+dfsg/Zend/zend_gc.c:347
> #2  0x00007ffff36ada7e in zobj_scan (pz=0x7fffffe36740) at 
> /build/php5-5.6.17+dfsg/Zend/zend_gc.c:580
> #3  gc_scan_roots () at /build/php5-5.6.17+dfsg/Zend/zend_gc.c:620
> #4  gc_collect_cycles () at /build/php5-5.6.17+dfsg/Zend/zend_gc.c:791
> #5  0x00007ffff36adb8f in gc_zobj_possible_root (zv=0x555555e5c8b0) at 
> /build/php5-5.6.17+dfsg/Zend/zend_gc.c:216
> #6  0x00007ffff373b01d in gc_zval_check_possible_root (z=<optimized out>)
>      at /build/php5-5.6.17+dfsg/Zend/zend_gc.h:183
> #7  i_zval_ptr_dtor (zval_ptr=<optimized out>) at 
> /build/php5-5.6.17+dfsg/Zend/zend_execute.h:86
> #8  zend_vm_stack_clear_multiple (nested=<optimized out>) at 
> /build/php5-5.6.17+dfsg/Zend/zend_execute.h:308
> #9  zend_do_fcall_common_helper_SPEC (execute_data=0x5555585a1f48)
>      at /build/php5-5.6.17+dfsg/Zend/zend_vm_execute.h:650
> #10 0x00007ffff36c9dc0 in execute_ex (execute_data=0x5555585a1f48)
>      at /build/php5-5.6.17+dfsg/Zend/zend_vm_execute.h:363
> #11 0x00007ffff367b5b8 in dtrace_execute_ex (execute_data=0x5555585a1f48)
>      at /build/php5-5.6.17+dfsg/Zend/zend_dtrace.c:73
> [...]
> #15138 0x00007ffff373b953 in zend_do_fcall_common_helper_SPEC 
> (execute_data=0x7ffff7eac210)
>      at /build/php5-5.6.17+dfsg/Zend/zend_vm_execute.h:592
> #15139 0x00007ffff36c9dc0 in execute_ex (execute_data=0x7ffff7eac210)
>      at /build/php5-5.6.17+dfsg/Zend/zend_vm_execute.h:363
> #15140 0x00007ffff367b5b8 in dtrace_execute_ex
> (execute_data=0x7ffff7eac210)
>      at /build/php5-5.6.17+dfsg/Zend/zend_dtrace.c:73
> #15141 0x00007ffff368e0b0 in zend_execute_scripts (type=1441122480, 
> type@entry=8, retval=0x7fffffe36660,
>      retval@entry=0x0, file_count=0, file_count@entry=3) at 
> /build/php5-5.6.17+dfsg/Zend/zend.c:1341
> #15142 0x00007ffff3629c60 in php_execute_script 
> (primary_file=primary_file@entry=0x7fffffffde20)
>      at /build/php5-5.6.17+dfsg/main/main.c:2597
> #15143 0x00007ffff373cffa in php_handler (r=<optimized out>)
>      at /build/php5-5.6.17+dfsg/sapi/apache2handler/sapi_apache2.c:667
> #15144 0x00005555555ac2a0 in ap_run_handler (r=r@entry=0x7ffff7e2c0a0) 
> at config.c:169
> #15145 0x00005555555ac7e9 in ap_invoke_handler (r=0x7ffff7e2c0a0) at 
> config.c:433
> #15146 0x00005555555c2682 in ap_process_async_request (r=0x7ffff7e2c0a0) 
> at http_request.c:317
> #15147 0x00005555555c2820 in ap_process_request (r=0x7ffff7e2c0a0) at 
> http_request.c:363
> #15148 0x00005555555bf122 in ap_process_http_sync_connection 
> (c=0x7ffff7e32290) at http_core.c:190
> #15149 ap_process_http_connection (c=0x7ffff7e32290) at http_core.c:231
> #15150 0x00005555555b5b10 in ap_run_process_connection 
> (c=0x7ffff7e32290) at connection.c:41
> #15151 0x00007ffff405f7ba in child_main (child_num_arg=1441122480) at 
> prefork.c:704
> #15152 0x00007ffff405f9c7 in make_child (s=0x7ffff7fc0de0, slot=0) at 
> prefork.c:746
> #15153 0x00007ffff406070d in prefork_run (_pconf=0x5555557f2f38 
> <ap_server_conf>, plog=0x7ffff7fbc028,
>      s=0x7ffff7fc0de0) at prefork.c:956
> #15154 0x0000555555591e7e in ap_run_mpm (pconf=0x7ffff7fee028, 
> plog=0x7ffff7fbc028, s=0x7ffff7fc0de0)
>      at mpm_common.c:94
> #15155 0x000055555558b3c3 in main (argc=2, argv=0x7fffffffe578) at 
> main.c:777
> 
> _______________________________________________
> pkg-php-maint mailing list
> pkg-php-maint@lists.alioth.debian.org
> http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-php-maint

Information forwarded to debian-bugs-dist@lists.debian.org, Debian PHP Maintainers <pkg-php-maint@lists.alioth.debian.org>:
Bug#817917; Package php5. (Sat, 12 Mar 2016 23:42:15 GMT) (full text, mbox, link).

Acknowledgement sent to d.sanader@planet-work.com:
Extra info received and forwarded to list. Copy sent to Debian PHP Maintainers <pkg-php-maint@lists.alioth.debian.org>. (Sat, 12 Mar 2016 23:42:15 GMT) (full text, mbox, link).

Message #15 received at 817917@bugs.debian.org (full text, mbox, reply):

From: Dejan SANADER <d.sanader@planet-work.com>
To: 817917@bugs.debian.org
Subject: Re: [php-maint] Bug#817917: Segfault in zval_scan_black
Date: Sat, 12 Mar 2016 23:52:04 +0100
Le 11/03/2016 20:20, Ondřej Surý a écrit :

> Dejan,

Hello Ondřej,

> as a first option, could you please install (on testing machine where
> you can reproduce the error), update PHP from here:
>
> https://packages.sury.org/php5-5.6/

I've tried your packages as well, and ended up with the same result.

I've spent some time trying to isolate the issue in order to provide a 
smaller sample of the code to upstream. By doing so I discovered that 
this segfault was caused by an infinite recursion... :/

I guess you can close this bug report now (sorry for the disturbance).

Regards.


-- 
Dejan

Information forwarded to debian-bugs-dist@lists.debian.org, Debian PHP Maintainers <pkg-php-maint@lists.alioth.debian.org>:
Bug#817917; Package php5. (Sun, 13 Mar 2016 05:27:03 GMT) (full text, mbox, link).

Acknowledgement sent to Ondřej Surý <ondrej@sury.org>:
Extra info received and forwarded to list. Copy sent to Debian PHP Maintainers <pkg-php-maint@lists.alioth.debian.org>. (Sun, 13 Mar 2016 05:27:03 GMT) (full text, mbox, link).

Message #20 received at 817917@bugs.debian.org (full text, mbox, reply):

From: Ondřej Surý <ondrej@sury.org>
To: 817917@bugs.debian.org
Subject: Re: [php-maint] Bug#817917: Segfault in zval_scan_black
Date: Sun, 13 Mar 2016 06:23:35 +0100
[Message part 1 (text/plain, inline)]
Closing per OP request. 

-- 
Ondřej Surý 



On 12 Mar 2016 23:42, at 23:42, Dejan SANADER <d.sanader@planet-work.com> wrote:
>Le 11/03/2016 20:20, Ondřej Surý a écrit :
>
>> Dejan,
>
>Hello Ondřej,
>
>> as a first option, could you please install (on testing machine where
>> you can reproduce the error), update PHP from here:
>>
>> https://packages.sury.org/php5-5.6/
>
>I've tried your packages as well, and ended up with the same result.
>
>I've spent some time trying to isolate the issue in order to provide a 
>smaller sample of the code to upstream. By doing so I discovered that 
>this segfault was caused by an infinite recursion... :/
>
>I guess you can close this bug report now (sorry for the disturbance).
>
>Regards.
>
>
>-- 
>Dejan

[Message part 2 (text/html, inline)]

Reply sent to Debian FTP Masters <ftpmaster@ftp-master.debian.org>:
You have taken responsibility. (Fri, 13 Jan 2017 13:07:46 GMT) (full text, mbox, link).

Notification sent to d.sanader@planet-work.com:
Bug acknowledged by developer. (Fri, 13 Jan 2017 13:07:46 GMT) (full text, mbox, link).

Message #25 received at 817917-done@bugs.debian.org (full text, mbox, reply):

From: Debian FTP Masters <ftpmaster@ftp-master.debian.org>
To: 413713-done@bugs.debian.org,440775-done@bugs.debian.org,447764-done@bugs.debian.org,500087-done@bugs.debian.org,618462-done@bugs.debian.org,628079-done@bugs.debian.org,639268-done@bugs.debian.org,643282-done@bugs.debian.org,697800-done@bugs.debian.org,715264-done@bugs.debian.org,727143-done@bugs.debian.org,730067-done@bugs.debian.org,731055-done@bugs.debian.org,752100-done@bugs.debian.org,759195-done@bugs.debian.org,760454-done@bugs.debian.org,774154-done@bugs.debian.org,774975-done@bugs.debian.org,776564-done@bugs.debian.org,778596-done@bugs.debian.org,782778-done@bugs.debian.org,783246-done@bugs.debian.org,788060-done@bugs.debian.org,789442-done@bugs.debian.org,789702-done@bugs.debian.org,790472-done@bugs.debian.org,790841-done@bugs.debian.org,792239-done@bugs.debian.org,795572-done@bugs.debian.org,797799-done@bugs.debian.org,799136-done@bugs.debian.org,799851-done@bugs.debian.org,800564-done@bugs.debian.org,801831-done@bugs.debian.org,803260-done@bugs.debian.org,803305-done@bugs.debian.org,805591-done@bugs.debian.org,810244-done@bugs.debian.org,811130-done@bugs.debian.org,814907-done@bugs.debian.org,815794-done@bugs.debian.org,815797-done@bugs.debian.org,817917-done@bugs.debian.org,819139-done@bugs.debian.org,827486-done@bugs.debian.org,828498-done@bugs.debian.org,833133-done@bugs.debian.org,833543-done@bugs.debian.org,834579-done@bugs.debian.org,841618-done@bugs.debian.org,845890-done@bugs.debian.org,846244-done@bugs.debian.org,848661-done@bugs.debian.org,849767-done@bugs.debian.org,664595-done@bugs.debian.org,
Cc: php5@packages.debian.org, php5@packages.qa.debian.org
Subject: Bug#841781: Removed package(s) from unstable
Date: Fri, 13 Jan 2017 13:05:30 +0000
Version: 5.6.26+dfsg-1+rm

Dear submitter,

as the package php5 has just been removed from the Debian archive
unstable we hereby close the associated bug reports.  We are sorry
that we couldn't deal with your issue properly.

For details on the removal, please see https://bugs.debian.org/841781

The version of this package that was in Debian prior to this removal
can still be found using http://snapshot.debian.org/.

This message was generated automatically; if you believe that there is
a problem with it please contact the archive administrators by mailing
ftpmaster@ftp-master.debian.org.

Debian distribution maintenance software
pp.
Scott Kitterman (the ftpmaster behind the curtain)

Bug archived. Request was from Debbugs Internal Request <owner@bugs.debian.org> to internal_control@bugs.debian.org. (Sat, 11 Feb 2017 07:27:42 GMT) (full text, mbox, link).

Send a report that this bug log contains spam.

Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Sun Jul 2 02:23:05 2023; Machine Name: buxtehude

Debian Bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.