|
|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
[2008-04-30 17:19 UTC] mattr at shoplet dot com
Description: ------------ The execution of the attached script halts unexpectedly with "ALERT - canary mismatch on efree() - heap overflow detected (attacker 'REMOTE_ADDR not set', file '../library/Zend/Db/Statement/Mysqli.php', line 113)" in the apache error log. PHP Info: ----------------------- PHP Version => 5.2.5 System => FreeBSD localhost 6.2-RELEASE FreeBSD 6.2-RELEASE #0: Fri Jan 12 11:05:30 UTC 2007 [email protected] alo.edu:/usr/obj/usr/src/sys/SMP i386 Configure Command => './configure' '--with-layout=GNU' '--with-config-file-scan-dir=/usr/local/etc/php' '--disable-all' '--e nable-libxml' '--with-libxml-dir=/usr/local' '--enable-reflection' '--program-prefix=' '--enable-fastcgi' '--with-apxs=/usr/lo cal/sbin/apxs' '--with-regex=php' '--with-zend-vm=CALL' '--enable-debug' '--enable-zend-multibyte' '--prefix=/usr/local' '--ma ndir=/usr/local/man' '--infodir=/usr/local/info/' PHP API => 20041225 PHP Extension => 20060613 Zend Extension => 220060519 Debug Build => yes Thread Safety => disabled Zend Memory Manager => enabled IPv6 Support => enabled This server is protected with the Suhosin Patch 0.9.6.2 Copyright (c) 2006 Hardened-PHP Project ----------------------- Script fails on another machine running Debian 4 in the same reproducible manner with and without the Suhosin patch. Reproduce code: --------------- #!/usr/local/bin/php <?php set_include_path('../library/'. PATH_SEPARATOR . '../application/lib/' . PATH_SEPARATOR . get_include_path()); require_once('Zend/Db.php'); // Zend Db classes can be found here: http://framework.zend.com // Can attach to the ticket later if needed. date_default_timezone_set('America/New_York'); $db = Zend_Db::factory('mysqli',Array('host'=>'localhost','username'=>'','password'=>'','dbname'=>'eproc')); $order_num = 1208212550; $sql = $db->quoteInto("SELECT * FROM `eproc`.`Orders` WHERE `order_num`=? LIMIT 1",$order_num); $q = $db->fetchAll($sql); $batch_status = $db->fetchOne("SELECT `to_po` FROM `eproc2`.`batch_status` WHERE `status`='done' ORDER BY `to_po` DESC LIMIT 1"); $items = $db->fetchAll("SELECT * FROM `eproc`.`Order_Item` WHERE `order_num`='{$order_num}' ORDER BY `line_num` ASC"); $notes = $db->fetchAll("SELECT * FROM `eproc`.`notes` WHERE `order_num`='{$order_num}' ORDER BY `sticky` DESC, `date_modified` ASC"); $emails = $db->fetchAll("SELECT `message_id`,`from_email`,`to_email`,`subject`,`date_received` FROM `email_store`.`email` WHERE `order_num`='{$order_num}' ORDER BY `date_received` ASC"); $attachments = $db->fetchAll("SELECT * FROM `files`.`order_attachments` WHERE `order_num`='{$order_num}' ORDER BY `timestampAdded` ASC"); print_r($q); print_r($order_id); print_r($batch_status); print_r($items); print_r($notes); print_r($emails); print_r($attachments); Expected result: ---------------- Several Arrays of database results Actual result: -------------- Execution: [Wed Apr 30 12:45:01 2008] Script: './index.php' --------------------------------------- /usr/ports/lang/php5/work/php-5.2.5/Zend/zend_opcode.c(238) : Block 0x0828d0e0 status: Invalid pointer: ((prev=0x00000045) != (prev.size=0x00000000)) --------------------------------------- [Wed Apr 30 12:45:01 2008] Script: './index.php' --------------------------------------- /usr/ports/lang/php5/work/php-5.2.5/Zend/zend_variables.h(35) : Block 0x0828d09c status: /usr/ports/lang/php5/work/php-5.2.5/Zend/zend_variables.c(36) : Actual location (location was relayed) Invalid pointer: ((size=0x00000000) != (next.prev=0x0000003d)) --------------------------------------- [Wed Apr 30 12:45:01 2008] Script: './index.php' /usr/ports/databases/php5-mysqli/work/php-5.2.5/ext/mysqli/mysqli_api.c(362) : Freeing 0x0828D060 (0 bytes), script=./index.php zend_mm_heap corrupted Segmentation fault (core dumped) Backtrace: #0 0x28583ecb in kill () from /lib/libc.so.6 #1 0x08150f51 in zend_mm_panic (message=0x8252700 "zend_mm_heap corrupted") at /usr/ports/lang/php5/work/php-5.2.5/Zend/zend_alloc.c:94 #2 0x08151ef5 in zend_mm_find_leaks (segment=0x827e000, b=0x828d02c) at /usr/ports/lang/php5/work/php-5.2.5/Zend/zend_alloc.c:1223 #3 0x08152070 in zend_mm_check_leaks (heap=0x827d400) at /usr/ports/lang/php5/work/php-5.2.5/Zend/zend_alloc.c:1277 #4 0x08152aaf in zend_mm_shutdown (heap=0x827d400, full_shutdown=0, silent=0) at /usr/ports/lang/php5/work/php-5.2.5/Zend/zend_alloc.c:1632 #5 0x08154a76 in shutdown_memory_manager (silent=0, full_shutdown=0) at /usr/ports/lang/php5/work/php-5.2.5/Zend/zend_alloc.c:2553 #6 0x0812479b in php_request_shutdown (dummy=0x0) at /usr/ports/lang/php5/work/php-5.2.5/main/main.c:1510 #7 0x081d7677 in main (argc=2, argv=0xbfbfeca0) at /usr/ports/lang/php5/work/php-5.2.5/sapi/cli/php_cli.c:1327 PatchesPull RequestsHistoryAllCommentsChangesGit/SVN commits
|
|||||||||||||||||||||||||||||||||||||
Copyright © 2001-2025 The PHP GroupAll rights reserved. |
Last updated: Wed Dec 24 16:00:02 2025 UTC |
php version = 5.2.4-2ubuntu5.3 I am getting this same problem with the following bit of code //class I wrote to make doing things on a remote machine easier $ssh->init($server, $port, $username, $password); $command = "if [ -d '$path' ]; then echo \"true\"; else echo \"false\"; fi 2> /dev/null"; //this executes the command above on the remote and gathers a true or false answer form the ssh stream $answer = $ssh->execute_return($command); //this line is where it barfes all over the memory if ($answer === "true\n"){ return true; } else { return false; }I'm experiencing the same bug using PHP 5.2.4-2ubuntu5.3 with Suhosin-Patch 0.9.6.2 (cli) on a Ubuntu Hardy 8.0.4 server. The following simplified example shows the problem, the last echo row is not executed because of mssql_free_result() fails: <?php $link = mssql_connect('xxxx.xx', 'xxx', 'xxxx'); if(is_resource($link)) { if(mssql_select_db('kursbok', $link)) { $result = mssql_query('select * from Utbildningsprogram order by up_nr'); if(is_resource($result)) { $obj = mssql_fetch_object($result); echo $obj->up_nr."\n"; mssql_free_result($result); } } } echo "Here I am - NOT!"; ?> OUTPUT ================================================================== 201000 ALERT - canary mismatch on efree() - heap overflow detected (attacker 'REMOTE_ADDR not set', file '/var/www/xxxx/TestMsSQL.php', line 16)I have the same error when running certain queries with mssql_query(). There seems to be no way to predict which queries will run and which fail - although if a query fails it always fails and if it runs then it alway runs. The more complex the query, the more likely to fail. I am running PHP Version 5.2.4-2ubuntu5.5 with Suhosin Patch 0.9.6.2. Example code that trips the switch: $dbhandle = mssql_connect($myServer, $myUser, $myPass); $selected = mssql_select_db($myDB, $dbhandle); $query = "SELECT * FROM sims.curr_group INNER JOIN sims.curr_class_period ON sims.curr_group.base_group_id = sims.curr_class_period.base_group_id INNER JOIN sims.sims_person ON sims.sims_person.person_id = sims.curr_class_period.person_id WHERE (sims.curr_group.short_name = '9b/It1')"; $result = mssql_query($query); while($row = mssql_fetch_array($result)) { print_r($row); } //close the connection mssql_close($dbhandle);I also can reproduce this error (Suhosin Patch installed). Very simple test script: <?php $demo_user[]=(object)array("first" => 1); $demo_user[]=(object)array("second" => 2); $demo_user[]=(object)array("third" => 3); echo "<pre>"; var_dump($demo_user); echo "</pre>"; ?> Error Log: [Fri Aug 07 14:38:06 2009] [error] [client xx.xx.xx.xx] ALERT - canary mismatch on efree() - heap overflow detected (attacker 'xx.xx.xx.xx', file '/somedir/somedir/htdocs/f.php', line 2) Version Info: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.6 with Suhosin-Patch proxy_html/3.0.0 Server at xxxxxx Port 80I also tried the code suggested : <?php $demo_user[]=(object)array("first" => 1); $demo_user[]=(object)array("second" => 2); $demo_user[]=(object)array("third" => 3); echo "<pre>"; var_dump($demo_user); echo "</pre>"; ?> This doesnt trigger any error message here