There is a core dump when running "php-cgi -i" on mips device

Description

The following code:

Running "php-cgi -i" on mips device

Resulted in this output:

<tr><td class="e">TERM </td><td class="v">vt100 </td></tr>
<tr><td class="e">SHELL </td><td class="v">/bin/bash </td></tr>
<tr><td class="e">OLDPWD </td><td class="v">/ </td></tr>
<tr><td class="e">USER </td><td class="v">admin </td></tr>
<tr><td class="e">PROMPTLENGTH </td><td class="v">11 </td></tr>
<tr><td class="e">ALU_SESMGR_RSP_SESS_IDX </td><td class="v">0 </td></tr>
<tr><td class="e">ALIASES </td><td class="v">sh=&quot;show&quot; </td></tr>
<tr><td class="e">ALU_SESMGR_RSP_AUTH_RD0 </td><td class="v">0x00000000 </td></tr>
<tr><td class="e">PATH </td><td class="v">/flash:/bin:/sbin:/usr/bin:/usr/sbin </td></tr>
<tr><td class="e">ALU_SESMGR_RSP_AUTH_RD1 </td><td class="v">0x00000000 </td></tr>
<tr><td class="e">ALU_SESMGR_RSP_AUTH_RD2 </td><td class="v">0x00000000 </td></tr>
<tr><td class="e">ALU_SESMGR_RSP_AUTH_RD3 </td><td class="v">0x00000000 </td></tr>
<tr><td class="e">PWD </td><td class="v">/flash </td></tr>
<tr><td class="e">PS1 </td><td class="v">TAURUS #-&gt;  </td></tr>
<tr><td class="e">HISTIGNORE </td><td class="v">&amp;:*password* </td></tr>
<tr><td class="e">PS2 </td><td class="v">(Continue command from previous line or Ctrl/C) -&gt;  </td></tr>
<tr><td class="e">HOME </td><td class="v">/flash </td></tr>
<tr><td class="e">SHLVL </td><td class="v">2 </td></tr>
<tr><td class="e">ALU_SESMGR_RSP_AAA_OPTS </td><td class="v">0 </td></tr>
<tr><td class="e">LOGNAME </td><td class="v">admin </td></tr>
<tr><td class="e">PROMPT_COMMAND </td><td class="v">stty echo icrnl &amp;&amp; setPrompt </td></tr>
<tr><td class="e">_ </td><td class="v">./php-cgi </td></tr>
</table>
<h2>PHP Variables</h2>
<table>
<tr class="h"><th>Variable</th><th>Value</th></tr>

Fri Jun 14 02:47:57 : COREDUMPER  ALRM message:
Segmentation fault (core dumped)

_emalloc_48 will cause the panic , and is there any solution for it?

But I expected this output instead:

Normal running

PHP Version

PHP 8.3.4

Operating System

linux 4.4 and arch is mips

Thanks for your report, would you be able to give a backtrace eventually ?

Thanks for your report, would you be able to give a backtrace eventually ?

GNU gdb (GDB) 7.6.1 Copyright (C) 2013 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "mips-linux-gnu". For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>... Reading symbols from /flash/pmd/bin/php-cgi...(no debugging symbols found)...done. [New LWP 4670] Failed to read a valid object file image from memory. Core was generated by php-cgi -i'.
Program terminated with signal 11, Segmentation fault.
#0 0x55972c6c in _emalloc_48 ()
(gdb) bt
#0 0x55972c6c in _emalloc_48 ()
#1 0x559c7bd0 in _zend_new_array_0 ()
#2 0x559294c0 in ?? ()
warning: GDB can't find the start of the function at 0x559294be.

`

Is your php instance compiled from source ? if yes, it would be helpful to compile with debug symbols enabled (--enable-debug configure option).

Is your php instance compiled from source ? if yes, it would be helpful to compile with debug symbols enabled (--enable-debug configure option).

When adding the debug symbol, the backtrace is bellowing:
GNU gdb (GDB) 7.6.1 Copyright (C) 2013 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "mips-linux-gnu". For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>... Reading symbols from /flash/pmd/bin/php-cgi...(no debugging symbols found)...done. [New LWP 4622] Failed to read a valid object file image from memory. Core was generated by php-cgi -i'.
Program terminated with signal 11, Segmentation fault.
#0 0x55ce5014 in zend_hash_find ()
(gdb) bt
#0 0x55ce5014 in zend_hash_find ()
#1 0x55c91c9c in zend_is_auto_global ()
#2 0x55e31000 in ?? ()
warning: GDB can't find the start of the function at 0x55e30ffe.
`

does not seem to be the case because

...
Reading symbols from /flash/pmd/bin/php-cgi...(no debugging symbols found)
...

Note that you do not need to replace the installed binary in /flash/pmd/bin, just running the instance sapi/cgi/php-cgi -i from your source directory should do.

thanks, but what I m saying

#0 0x55a25090 in php_autoglobal_merge (dest=0x772560a0, src=0x0)

src should not be NULL, we need to figure out the root cause which occur somewhere else do not know well enough the engine but I ll go back at it in few days.

thanks, but what I m saying

#0 0x55a25090 in php_autoglobal_merge (dest=0x772560a0, src=0x0)

src should not be NULL, we need to figure out the root cause which occur somewhere else do not know well enough the engine but I ll go back at it in few days.

Ok, look forward to your reply.

@VerifyL

@VerifyL, let s try to move to the previous step. would it be possible for you to put a breakpoint to php_auto_globals_create_get and go step by step within ?

@devnexen

@devnexen
Yes, i can.
However the php_auto_globals_create_get wasn't executed. It means that the php is corrupted before executing the php_auto_globals_create_get .
And I found that it will skip the loop in zend_activate_auto_globals(),
ZEND_HASH_MAP_FOREACH_PTR(CG(auto_globals), auto_global) is false whereas the autoglobals is not NULL.

ZEND_API void zend_activate_auto_globals(void) /* {{{ */
 {
     zend_auto_global *auto_global;

     ZEND_HASH_MAP_FOREACH_PTR(CG(auto_globals), auto_global) {
         if (auto_global->jit) {
              auto_global->armed = 1;
         } else if (auto_global->auto_global_callback) {
              auto_global->armed = auto_global->auto_global_callback(auto_global->name);
         } else {
              auto_global->armed = 0;
          }
     } ZEND_HASH_FOREACH_END();
 }



Program received signal SIGSEGV, Segmentation fault.
0x55a25090 in php_autoglobal_merge (dest=0x772560a0, src=0x0)
    at php/main/php_variables.c:752
752     in php/main/php_variables.c

(gdb) info b
Num     Type           Disp Enb Address    What
1       breakpoint     keep y   0x55a2555c in php_auto_globals_create_get
                                           at php/main/php_variables.c:789
(gdb) bt
#0  0x55a25090 in php_autoglobal_merge (dest=0x772560a0, src=0x0)
    at php/main/php_variables.c:752
#1  0x55a26264 in php_auto_globals_create_request (name=0x55f15e58)
    at php/main/php_variables.c:936
#2  0x55aaeefc in zend_is_auto_global (name=0x77258038)
    at php/Zend/zend_compile.c:1913
#3  0x55934400 in php_print_gpcse_array (name=0x55e14a14 "_REQUEST",
    name_length=8)
    at php/ext/standard/info.c:175
#4  0x559363ec in php_print_info (flag=-1)
    at php/ext/standard/info.c:1023
#5  0x55d4ab78 in main (argc=2, argv=0x7ffffbd4)
    at php/sapi/cgi/cgi_main.c:2319



(gdb) p *compiler_globals.auto_globals
$2 = {gc = {refcount = 1, u = {type_info = 151}}, u = {v = {flags = 0 '\000',
      _unused = 0 '\000', nIteratorsCount = 0 '\000', _unused2 = 16 '\020'},
    flags = 16}, nTableMask = 4294967280, {arHash = 0x55f25e88,
    arData = 0x55f25e88, arPacked = 0x55f25e88}, nNumUsed = 8,
  nNumOfElements = 8, nTableSize = 8, nInternalPointer = 0,
  nNextFreeElement = -2147483648, pDestructor = 0x55b054e8 <auto_global_dtor>}

However the php_auto_globals_create_get wasn't executed

Thanks for confirming my suspicion this was the only way I could reproduce locally by disabling this call. Now, needs to figure out why..

Hi, is zend_register_auto_global ever called by any chance ?

@devnexen

@devnexen Hello, the issue has solved. Need set as Big-endian. Thanks

Navigation Menu

Repository navigation

There is a core dump when running "php-cgi -i" on mips device #14567

Description

PHP Version

Operating System

50 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

There is a core dump when running "php-cgi -i" on mips device #14567

Description

Description

PHP Version

Operating System

Activity

devnexen commented on Jun 14, 2024

VerifyL commented on Jun 18, 2024

devnexen commented on Jun 18, 2024

VerifyL commented on Jun 18, 2024

devnexen commented on Jun 18, 2024

50 remaining items

devnexen commented on Jul 18, 2024

VerifyL commented on Jul 18, 2024

devnexen commented on Jul 20, 2024

VerifyL commented on Jul 22, 2024

devnexen commented on Jul 22, 2024

devnexen commented on Aug 4, 2024

VerifyL commented on Jan 2, 2025

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions