Skip to content

dl() segfaults when module is already loaded #9589

Description

@michael-o

Description

The following code:

<?php
print("enable_dl: ".ini_get("enable_dl"));
dl("xml.so");

Resulted in this output:

enable_dl: 1
Warning: Module "xml" is already loaded in Unknown on line 0
Segmentation fault (core dumped)

But I expected this output instead:

enable_dl: 1
Warning: Module "xml" is already loaded in Unknown on line 0

Working example:

% php --version
PHP 8.1.10 (cli) (built: Sep 16 2022 15:09:44) (NTS)
Copyright (c) The PHP Group
Zend Engine v4.1.10, Copyright (c) Zend Technologies
% php -m
[PHP Modules]
Core
date
hash
json
libxml
mysqlnd
openssl
pcre
Reflection
SPL
standard
xml
zlib

[Zend Modules]
% cat > sigsegv.php <<EOF
? <?php
? print("enable_dl: ".ini_get("enable_dl"));
? dl("xml.so");
? EOF
% php sigsegv.php
enable_dl: 1
Warning: Module "xml" is already loaded in Unknown on line 0

Failing example:

% php --version
PHP 8.2.0RC2 (cli) (built: Sep 20 2022 20:24:30) (NTS)
Copyright (c) The PHP Group
Zend Engine v4.2.0RC2, Copyright (c) Zend Technologies
% php -m
[PHP Modules]
Core
date
hash
json
libxml
mysqlnd
openssl
pcre
random
Reflection
SPL
standard
xml
zlib

[Zend Modules]

% cat > sigsegv.php <<EOF
? <?php
? print("enable_dl: ".ini_get("enable_dl"));
? dl("xml.so");
? EOF
% php sigsegv.php
enable_dl: 1
Warning: Module "xml" is already loaded in Unknown on line 0
Segmentation fault (core dumped)
% lldb --core php.core  /usr/local/bin/php
(lldb) target create "/usr/local/bin/php" --core "php.core"
Core file '/tmp/php.core' (x86_64) was loaded.
Could not load history file
(lldb) bt all
* thread #1, name = 'php', stop reason = signal SIGSEGV
  * frame #0: 0x00000000006939c3 php`___lldb_unnamed_symbol3142$$php + 19
    frame #1: 0x000000000069b396 php`zend_hash_apply_with_argument + 118
    frame #2: 0x000000000068e884 php`___lldb_unnamed_symbol3137$$php + 84
    frame #3: 0x000000000069ac68 php`zend_hash_graceful_reverse_destroy + 536
    frame #4: 0x0000000000683cc8 php`___lldb_unnamed_symbol3117$$php + 24
    frame #5: 0x000000000060c189 php`php_module_shutdown + 41
    frame #6: 0x0000000000772858 php`___lldb_unnamed_symbol4788$$php + 696
    frame #7: 0x0000000000418fe0 php`_start + 256
(lldb)

It looks like a regression to me from 8.1 to 8.2.

PHP Version

PHP 8.2.0 RC2

Operating System

FreeBSD: 12.3-RELEASE-p7

Setup

Clean Poudriere throwaway Jails from FreeBSD ports, main branch.

Metadata

Metadata

Assignees

Type

No type
No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions