Skip to content

PHP CLI segfault when INI file is not readable #7883

Closed
Closed
PHP CLI segfault when INI file is not readable#7883
Labels
BugCategory: EngineStatus: Verified

Description

@milo
milo
opened on Jan 4, 2022

Description

Redirected there by oerdnj/deb.sury.org#1703

When mods-available INI file, e.g. /etc/php/8.1/mods-available/opcache.ini, has no sufficient permission to read by user, PHP CLI ends by segmentation fault.

php8.1[5509]: segfault at 0 ip 00007f4a768c97e4 sp 00007ffdae393780 error 4 in libc-2.28.so[7f4a7687c000+148000]

I've removed INI file permission by mistake and had no glue what happend to CLI scripts.

Steps to reproduce the behavior:

# Probably not needed, this is default after installation
chown root:root /etc/php/8.1/mods-available/opcache.ini

# Remove read permission for others
chmod 640 /etc/php/8.1/mods-available/opcache.ini

# Run php as non-root user
su username -c php8.1

Segmentation fault

Expected behavior
Not segafult. Probably, extension should not be loaded, or emit warning.

Distribution

  • Linux alfa-01 4.19.0-18-amd64 #1 SMP Debian 4.19.208-1 (2021-09-29) x86_64 GNU/Linux
  • OS: Debian 10.11
  • Architecture: amd64
  • Repository: deb https://packages.sury.org/php/ buster main

Last lines of strace:

stat("/etc/php/8.1/cli/conf.d/10-opcache.ini", {st_mode=S_IFREG|0640, st_size=79, ...}) = 0
openat(AT_FDCWD, "/etc/php/8.1/cli/conf.d/10-opcache.ini", O_RDONLY) = -1 EACCES (Permission denied)
--- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
+++ killed by SIGSEGV +++

PHP Version

PHP 8.1.1

Operating System

Debian 10.11

Activity

  1. milo
    added
    Bug
    Status: Needs Triage
    on Jan 4, 2022

  2. provtemp commented on Jan 7, 2022

    @provtemp
    provtemp
    on Jan 7, 2022

    Introduced by c732ab4#diff-3a12521d1fb28a95d8894ccdd98d1ec238b722eb45e8849624b52bd3c276480e

    Crashes through

    php-src/main/php_ini.c

    Line 699 in 90b7bde

    zend_destroy_file_handle(&fh); 

    Program terminated with signal 11, Segmentation fault.
#0  _IO_new_fclose (fp=0x0) at iofclose.c:53
53	  if (fp->_IO_file_flags & _IO_IS_FILEBUF)
(gdb) bt
#0  _IO_new_fclose (fp=0x0) at iofclose.c:53
#1  0x000000000077d788 in zend_file_handle_dtor (fh=fh@entry=0x7888caf007b0) at /usr/src/debug/php-8.1.1/Zend/zend_stream.c:217
#2  0x000000000077df80 in zend_destroy_file_handle (file_handle=file_handle@entry=0x7888caf007b0) at /usr/src/debug/php-8.1.1/Zend/zend_stream.c:273
#3  0x00000000006b0c1c in php_init_config () at /usr/src/debug/php-8.1.1/main/php_ini.c:699

  3. cmb69 commented on Jan 11, 2022

    @cmb69
    cmb69
    on Jan 11, 2022
    Member

    According to @provtemp's comment above, this would be related to #7910.

  4. cmb69
    added
    Category: Engine
    on Jan 11, 2022

  5. remicollet commented on Jan 17, 2022

    @remicollet
    remicollet
    on Jan 17, 2022
    Member

    PHP 8.0 is not affected.

    
$ gdb php81
(gdb) run -i
Program received signal SIGSEGV, Segmentation fault.
(gdb) bt
#0  0x00007ffff76e4c1b in _IO_new_fclose (fp=0x0) at iofclose.c:48
#1  0x0000555555859a60 in zend_file_handle_dtor (fh=0x7fffffffb3e0) at /usr/src/debug/php81-php-8.1.2~RC1-1.fc35.remi.x86_64/Zend/zend_stream.c:217
#2  0x000055555585a096 in zend_destroy_file_handle (file_handle=<optimized out>) at /usr/src/debug/php81-php-8.1.2~RC1-1.fc35.remi.x86_64/Zend/zend_stream.c:273
#3  0x000055555578996c in php_init_config () at /usr/src/debug/php81-php-8.1.2~RC1-1.fc35.remi.x86_64/main/php_ini.c:699
#4  0x0000555555782abc in php_module_startup (sf=<optimized out>, additional_modules=0x0, num_additional_modules=<optimized out>) at /usr/src/debug/php81-php-8.1.2~RC1-1.fc35.remi.x86_64/main/main.c:2191
#5  0x00005555558ce641 in php_cli_startup (sapi_module=<optimized out>) at /usr/src/debug/php81-php-8.1.2~RC1-1.fc35.remi.x86_64/sapi/cli/php_cli.c:409
#6  0x000055555563a9b9 in main (argc=2, argv=0x555555e10c50) at /usr/src/debug/php81-php-8.1.2~RC1-1.fc35.remi.x86_64/sapi/cli/php_cli.c:1334

  6. remicollet commented on Jan 17, 2022

    @remicollet
    remicollet
    on Jan 17, 2022
    Member

    Related to c732ab400af

    @@ -693,6 +692,7 @@ int php_init_config(void)
 									zend_llist_add_element(&scanned_ini_list, &p);
 								}
 							}
+							zend_destroy_file_handle(&fh);
 						}
 					}
 					free(namelist[i]);

    In previous version, fh was not freed, it is not freed, even if null.

  7. remicollet
    added a commit that references this issue on Jan 17, 2022

    Fix phpGH-7883 don't close not open file handle

    bd25fa0

  8. remicollet commented on Jan 17, 2022

    @remicollet
    remicollet
    on Jan 17, 2022
    Member

    PR #7956 should fix this one

  9. remicollet
    added
    Status: Verified
    and removed
    Status: Needs Triage
    on Jan 17, 2022
  10. remicollet
    changed the title [-]PHP CLI segafult when INI file is not readable[/-] [+]PHP CLI segfault when INI file is not readable[/+] on Jan 18, 2022
  11. remicollet
    added a commit that references this issue on Jan 18, 2022

    Fix GH-7883 don't close not open file handle

    cdfc4d3
  12. remicollet
    closed this as completedin cdfc4d3on Jan 18, 2022
  13. remicollet
    added a commit that references this issue on Jan 18, 2022

    Merge branch 'PHP-8.1'

    ac1c2dc

  14. milo commented on Jan 18, 2022

    @milo
    milo
    on Jan 18, 2022
    Author

    Thank you.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    BugCategory: EngineStatus: Verified

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions