Bug 722418 - php-pecl-memcache causes memory corruption after unserialising objects
Summary: php-pecl-memcache causes memory corruption after unserialising objects
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: php-pecl-memcache
Version: 6.0
Hardware: All
OS: Linux
urgent
high
Target Milestone: rc
: ---
Assignee: Vojtech Vitek
QA Contact: David Kutálek
URL:
Whiteboard:
Depends On:
Blocks: 727267 747123 756082
TreeView+ depends on / blocked
 
Reported: 2011-07-15 10:00 UTC by Paul Clifford
Modified: 2018-11-26 18:56 UTC (History)
10 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2012-06-20 14:29:13 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2012:0927 0 normal SHIPPED_LIVE php-pecl-memcache bug fix update 2012-06-19 21:00:44 UTC

Description Paul Clifford 2011-07-15 10:00:48 UTC
Description of problem:
php-pecl-memcache causes memory corruption during the PHP shutdown stage after fetching a value that needs to be unserialised.  This is causing segmentation faults in our Apache servers when they run PHP code.  See http://pecl.php.net/bugs/bug.php?id=22811 for the bug I filed upstream.


Version-Release number of selected component (if applicable):
Tested with php-pecl-memcache-3.0.4-3.2.el6.2, php-pecl-memcache-3.0.5-3.el6, and a hand-built 3.0.6 package.


How reproducible:

Steps to Reproduce:
1. Install memcached RPM and start on 127.0.0.1
2. Put the following code in a file called "test.php"
3. Run "php test.php" and get a segmentation fault (if not, duplicate the final line a few more times to increase the memory corruption)

test.php code:
<?php
$obj = new StdClass;
$obj->obj = $obj;
$memcache = new Memcache;
$memcache->connect('127.0.0.1', 11211);
$memcache->set('x', $obj, false, 300);
$x = $memcache->get('x');
$x = $memcache->get('x');
$x = $memcache->get('x');
  
Actual results:
Segmentation fault

Expected results:
No output


Additional info:
I included a possible patch in the PECL bug (http://pastebin.com/raw.php?i=p3sJXmEk) but it hasn't been reviewed by anyone familiar with the internals of PHP or the memcache extension.

Also, the 3.0.x series of the memcache extension is still listed as beta on the project page (http://pecl.php.net/package/memcache).  Would it be more appropriate to package the latest stable version (2.2.6) in RHEL 6 instead?  I've confirmed that this bug is not present in that version.

Comment 2 RHEL Program Management 2011-07-15 10:18:14 UTC
This request was evaluated by Red Hat Product Management for
inclusion in the current release of Red Hat Enterprise Linux.
Because the affected component is not scheduled to be updated
in the current release, Red Hat is unfortunately unable to
address this request at this time. Red Hat invites you to
ask your support representative to propose this request, if
appropriate and relevant, in the next release of Red Hat
Enterprise Linux. If you would like it considered as an
exception in the current release, please ask your support
representative.

Comment 3 Paul Clifford 2011-07-15 10:38:41 UTC
Can you confirm, are you saying it's not possible to package the stable version 2.2.6 rather than 3.0.x, or are you saying that it's not possible to release an update addressing the segmentation fault in the current 3.0.x package?

Comment 4 Joe Orton 2011-07-15 10:47:20 UTC
Paul, thanks for the analysis and sending the patch upstream.  The message above is automated and just means that new bug reports won't get fixed in the pending round of updates.  And that contacting your support representative will help us prioritize fixes for the next round of updates!

Comment 7 Kamal Maiti 2011-09-07 08:59:05 UTC
Hello,

Can we have any update of this bug?

Regards,
/kamal

Comment 17 errata-xmlrpc 2012-06-20 14:29:13 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2012-0927.html


Note You need to log in before you can comment on or make changes to this bug.