Bug #68921 [Com]: segfault

Edit report at https://bugs.php.net/bug.php?id=68921&edit=1

 ID:                 68921
 Comment by:         jboffel at gmail dot com
 Reported by:        public at grik dot net
 Summary:            segfault
 Status:             Open
 Type:               Bug
 Package:            Reproducible crash
 Operating System:   Cent OS 6
 PHP Version:        5.6.6
 Block user comment: N
 Private report:     N

 New Comment:

Confirmed still on 5.6.21

The content-type header criteria is not relevant.

You just need a post request with an empty body using php-fpm.
It does not happen with Apache php mod.


Previous Comments:
------------------------------------------------------------------------
[2016-01-09 14:21:40] der at internethering dot de

Yet not fixed in 5.6.16:

curl -d '' -H 'Content-Type:' https://le-h.de/t.php

-> Error 503

#0  0x0000000000adcc79 in _zval_dtor_func (zvalue=0x7f03c5b5d268, __zend_filename=0x10cb078 "/tmp/distccd_ghnfGr/var/phpbuild/portage/dev-lang/php-5.6.16/work/sapis-build/fpm/Zend/zend_execute.h", __zend_lineno=79)
    at /var/phpbuild/portage/dev-lang/php-5.6.16/work/sapis-build/fpm/Zend/zend_variables.c:36
36				CHECK_ZVAL_STRING_REL(zvalue);
(gdb) bt
#0  0x0000000000adcc79 in _zval_dtor_func (zvalue=0x7f03c5b5d268, __zend_filename=0x10cb078 "/tmp/distccd_ghnfGr/var/phpbuild/portage/dev-lang/php-5.6.16/work/sapis-build/fpm/Zend/zend_execute.h", __zend_lineno=79)
    at /var/phpbuild/portage/dev-lang/php-5.6.16/work/sapis-build/fpm/Zend/zend_variables.c:36
#1  0x0000000000ac4769 in _zval_dtor (zvalue=0x7f03c5b5d268, __zend_filename=0x10cb078 "/tmp/distccd_ghnfGr/var/phpbuild/portage/dev-lang/php-5.6.16/work/sapis-build/fpm/Zend/zend_execute.h", __zend_lineno=79)
    at /tmp/distccd_ghnfGr/var/phpbuild/portage/dev-lang/php-5.6.16/work/sapis-build/fpm/Zend/zend_variables.h:35
#2  0x0000000000ac4861 in i_zval_ptr_dtor (zval_ptr=0x7f03c5b5d268, __zend_filename=0x10cd470 "/var/phpbuild/portage/dev-lang/php-5.6.16/work/sapis-build/fpm/Zend/zend_variables.c", __zend_lineno=188, tsrm_ls=0x2baf0c0)
    at /tmp/distccd_ghnfGr/var/phpbuild/portage/dev-lang/php-5.6.16/work/sapis-build/fpm/Zend/zend_execute.h:79
#3  0x0000000000ac6aa5 in _zval_ptr_dtor (zval_ptr=0x7f03c5b5d560, __zend_filename=0x10cd470 "/var/phpbuild/portage/dev-lang/php-5.6.16/work/sapis-build/fpm/Zend/zend_variables.c", __zend_lineno=188)
    at /var/phpbuild/portage/dev-lang/php-5.6.16/work/sapis-build/fpm/Zend/zend_execute_API.c:424
#4  0x0000000000add256 in _zval_ptr_dtor_wrapper (zval_ptr=0x7f03c5b5d560) at /var/phpbuild/portage/dev-lang/php-5.6.16/work/sapis-build/fpm/Zend/zend_variables.c:188
#5  0x0000000000af589c in i_zend_hash_bucket_delete (ht=0x2bb2928, p=0x7f03c5b5d548) at /var/phpbuild/portage/dev-lang/php-5.6.16/work/sapis-build/fpm/Zend/zend_hash.c:182
#6  0x0000000000af5976 in zend_hash_bucket_delete (ht=0x2bb2928, p=0x7f03c5b5d548) at /var/phpbuild/portage/dev-lang/php-5.6.16/work/sapis-build/fpm/Zend/zend_hash.c:192
#7  0x0000000000af783a in zend_hash_graceful_reverse_destroy (ht=0x2bb2928) at /var/phpbuild/portage/dev-lang/php-5.6.16/work/sapis-build/fpm/Zend/zend_hash.c:613
#8  0x0000000000ac5b27 in shutdown_executor (tsrm_ls=0x2baf0c0) at /var/phpbuild/portage/dev-lang/php-5.6.16/work/sapis-build/fpm/Zend/zend_execute_API.c:244
#9  0x0000000000ae0893 in zend_deactivate (tsrm_ls=0x2baf0c0) at /var/phpbuild/portage/dev-lang/php-5.6.16/work/sapis-build/fpm/Zend/zend.c:960
#10 0x0000000000a19882 in php_request_shutdown (dummy=0x0) at /var/phpbuild/portage/dev-lang/php-5.6.16/work/sapis-build/fpm/main/main.c:1883
#11 0x0000000000bcdba6 in main (argc=4, argv=0x7ffddd839a68) at /var/phpbuild/portage/dev-lang/php-5.6.16/work/sapis-build/fpm/sapi/fpm/fpm/fpm_main.c:1992

------------------------------------------------------------------------
[2015-06-12 09:47:21] andrey at kostin dot email

Not fixed in 5.6.10:

curl -X POST http://example.com/script.php

WARNING: [pool www] child 12008 exited on signal 11 (SIGSEGV - core dumped) after 1166.718710 seconds from start

------------------------------------------------------------------------
[2015-06-03 21:59:32] andrey at kostin dot email

I experience the same problem with PHP 5.6.9 under Ubuntu 14.04 with no 3rd-party libraries installed. Test script contains the following code:
<?php
echo 'ok';
?>

Request: curl --data "param1=value1" http://example.com/script.php
Response: ok

Request: curl --data "" http://example.com/script.php
Response:
  <html>
  <head><title>502 Bad Gateway</title></head>
  <body bgcolor="white">
  <center><h1>502 Bad Gateway</h1></center>
  <hr><center>nginx/1.8.0</center>
  </body>
  </html>

PHP log contains the following:
[04-Jun-2015 00:54:07] WARNING: [pool www] child 16781 exited on signal 11 (SIGSEGV - core dumped) after 45.570352 seconds from start

Setting always_populate_raw_post_data to -1 solves the problem.

------------------------------------------------------------------------
[2015-03-06 15:27:14] public at grik dot net

The t.php file is empty. The issue is not relevant to the content of a script.

I compiled 5.6 over 5.5 and did not update php.ini. In 5.5 the value for always_populate_raw_post_data was "no", for in 5.6 it has to be "-1"

------------------------------------------------------------------------
[2015-03-06 14:41:45] [email protected]

please show us what the t.php 's contents is

------------------------------------------------------------------------


The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at

    https://bugs.php.net/bug.php?id=68921


--
Edit this bug report at https://bugs.php.net/bug.php?id=68921&edit=1