Ticket #244 (assigned defect)

Opened 3 months ago

Last modified 3 months ago

Replicator import causes memory corruption with uneven number of languages

Reported by: rambo Assigned to: piotras (accepted)
Priority: critical Milestone:
Component: Midgard PHP Version: 1.8
Keywords: Cc:

Description

To reproduce:

  1. Make sure you can replicate one/two language version of the object
  2. disable midcom_services_cron on staging server, start apache in gdb on live
  3. add third language and get the object spooled
  4. point browser to http://example.com/midcom-exec-midcom.helper.replicator/import_post.php
  5. copy-paste the XML from spool to the form
  6. Watch browser hang, something like below can be seen with gdb:
*** glibc detected *** /usr/sbin/httpd: free(): invalid next size (fast): 0x0a591d80 ***

Program received signal SIGTSTP, Stopped (user).
[Switching to Thread -1208334576 (LWP 9601)]
0x00f5c402 in __kernel_vsyscall ()
(gdb) backtrace
#0  0x00f5c402 in __kernel_vsyscall ()
#1  0x0025b5ee in __lll_mutex_lock_wait () from /lib/libc.so.6
#2  0x001ead78 in _L_lock_14118 () from /lib/libc.so.6
#3  0x001ea024 in free () from /lib/libc.so.6
#4  0x008021a4 in _dl_map_object_deps () from /lib/ld-linux.so.2
#5  0x00806afd in dl_open_worker () from /lib/ld-linux.so.2
#6  0x00802e36 in _dl_catch_error () from /lib/ld-linux.so.2
#7  0x00806482 in _dl_open () from /lib/ld-linux.so.2
#8  0x00284722 in do_dlopen () from /lib/libc.so.6
#9  0x00802e36 in _dl_catch_error () from /lib/ld-linux.so.2
#10 0x002848d5 in __libc_dlopen_mode () from /lib/libc.so.6
#11 0x00261b09 in init () from /lib/libc.so.6
#12 0x0017143b in pthread_once () from /lib/libpthread.so.0
#13 0x00261c08 in backtrace () from /lib/libc.so.6
#14 0x001dee71 in __libc_message () from /lib/libc.so.6
#15 0x001e6b16 in _int_free () from /lib/libc.so.6
#16 0x001ea030 in free () from /lib/libc.so.6
#17 0x0744f5f1 in g_free () from /lib/libglib-2.0.so.0
#18 0x056c7eed in php_midgard_replicator_init ()
   from /usr/lib/php/modules/midgard.so
#19 0x011b6f20 in zend_get_user_opcode_handler ()
   from /etc/httpd/modules/libphp5.so
#20 0x011b83a8 in execute () from /etc/httpd/modules/libphp5.so
---Type <return> to continue, or q <return> to quit---
#21 0x011b684c in zend_get_user_opcode_handler ()
   from /etc/httpd/modules/libphp5.so
#22 0x011b83a8 in execute () from /etc/httpd/modules/libphp5.so
#23 0x011b684c in zend_get_user_opcode_handler ()
   from /etc/httpd/modules/libphp5.so
#24 0x011b83a8 in execute () from /etc/httpd/modules/libphp5.so
#25 0x011b684c in zend_get_user_opcode_handler ()
   from /etc/httpd/modules/libphp5.so
#26 0x011b83a8 in execute () from /etc/httpd/modules/libphp5.so
#27 0x011eb732 in zend_get_zval_ptr_ptr () from /etc/httpd/modules/libphp5.so
#28 0x011b83a8 in execute () from /etc/httpd/modules/libphp5.so
#29 0x011b684c in zend_get_user_opcode_handler ()
   from /etc/httpd/modules/libphp5.so
#30 0x011b83a8 in execute () from /etc/httpd/modules/libphp5.so
#31 0x011b684c in zend_get_user_opcode_handler ()
   from /etc/httpd/modules/libphp5.so
#32 0x011b83a8 in execute () from /etc/httpd/modules/libphp5.so
#33 0x011b684c in zend_get_user_opcode_handler ()
   from /etc/httpd/modules/libphp5.so
#34 0x011b83a8 in execute () from /etc/httpd/modules/libphp5.so
#35 0x01198880 in zend_execute_scripts () from /etc/httpd/modules/libphp5.so
#36 0x01158125 in php_execute_script () from /etc/httpd/modules/libphp5.so
#37 0x0121b7a5 in php_ap2_register_hook () from /etc/httpd/modules/libphp5.so
---Type <return> to continue, or q <return> to quit---
#38 0x0034597d in ap_run_handler () from /usr/sbin/httpd
#39 0x00349338 in ap_invoke_handler () from /usr/sbin/httpd
#40 0x003553de in ap_process_request () from /usr/sbin/httpd
#41 0x003521bf in ap_register_input_filter () from /usr/sbin/httpd
#42 0x0034d85d in ap_run_process_connection () from /usr/sbin/httpd
#43 0x0034d95c in ap_process_connection () from /usr/sbin/httpd
#44 0x003599a2 in ap_graceful_stop_signalled () from /usr/sbin/httpd
#45 0x00359c14 in ap_graceful_stop_signalled () from /usr/sbin/httpd
#46 0x0035ab29 in ap_mpm_run () from /usr/sbin/httpd
#47 0x00331147 in main () from /usr/sbin/httpd
  1. kill the apache, see browser return blank
  2. add 4th language and get object spooled etc
  3. Watch as import works
  4. Add 5th language and watch import fail.
  5. Add 6th language and watch import work.

Change History

06/10/08 09:04:46 changed by piotras

  • status changed from new to assigned.

#18 0x056c7eed in php_midgard_replicator_init ()

from /usr/lib/php/modules/midgard.so

This is invoked *only* when module is loaded. Can you double check if module is loaded via php.ini ?

It seems impossible to happen if it segfaults with such message between requests without loading module via dl. Other option is that gdb is fooled somehow. Can valgrind be used there?

valgrind -v --log-file=some_file.log apache2 -X