Re: [Security-Discuss] Strange problem after latest php update (MDKSA-2005:152)

Quoting Stew Benedict <sbenedict-4qZELD6FgxhWk0Htik3J/[email protected]>:

>
> On Mon, 29 Aug 2005, Gianluca Faieta wrote:
>
>> Hi all,
>>
>> I found a very strange problem regarding the latest PHP update
>> on Mandrake 10.0: the following code gives "Zero Sized Reply" error
>> if run under Apache (http://my.host.name/preg1.php) while it runs
>> correctly from the command line (# php preg1.php).
>>
>> ---- begin code snippet -------------------------
>> <?php
>>   define( 'ANY_NAME', 'any value' );
>>   $a = preg_match('/^[A-Za-z0-9]*$/', $any_variable);
>>   echo "DONE!\n";
>> ?>
>> ---- end   code snippet -------------------------
>>
>> The "fantastic" thing is that commenting the define solves the
>> problem under Apache.
>>
>> It gave the same error on two different hosts, both of which are
>> always updated with the latest Mandriva patches. Neither the previous
>> update (4.5.100mdk) nor the stock packages have this problem.
>>
>> Php extensions on the affected hosts are the common ones (GD, MySQL,
>> IMAP, XML).
>>
>> Anyone experiencing the same problem?
>>
>> Maybe, updated packages should be rebuilt using the previous method
>> (private pcre) instead of the system pcre libs.
>>
>
> Well, the packages were rebuilt against the system pcre for a reason.
> There's a vulnerability in pcre. If I was to use the private pcre, I would
> be patching it in the same fashion, with possibly the same result, plus
> I'd be locked into forever patching both packages.

Absolutely right! I too prefer to have a single copy of everything, to 
simplify
maintenance.
Anyway I remember having a similar problem some times ago with some other
library. Building PHP with the system library resulted in various problems,
whereas the bundled one worked fine. Please, don't ask me further details ...
it was long time ago ;-)


> I'm currently investigating another issue with the updates, and will look
> at this too.

Ok, fine.

> Are you using:
>
> apache1 or apche2?
> php-cgi or mod_php?

I'm using apache2 with mod_php. I haven't tried but suspect that 
php-cgi should
work without problems (php-cli works).

I also digged in the error_log and found that apache segfaults when I 
try to run
the faulty script (the one with define).


  [Mon Aug 29 15:41:20 2005] [notice] child pid 11419 exit signal Segmentation
fault (11)
  [Mon Aug 29 15:41:22 2005] [notice] child pid 11421 exit signal Segmentation
fault (11)
  [Mon Aug 29 15:41:23 2005] [notice] child pid 11346 exit signal Segmentation
fault (11)


I think a big part of the problem is in Apache2, as php-cli runs fine; maybe
Apache2 does not like the system pcre. Or simply, Apache2 needs to be rebuilt
against the new pcre ... don't know, just thinking aloud.

This evening I'll do some more tests on my 10.0 devel host.


Thanks for your help,
Gianluca

____________________________________________________
Want to buy your Pack or Services from Mandriva? 
Go to http://store.mandriva.com
Join the Club : http://www.mandrivaclub.com
____________________________________________________