Custom Query (267 matches)

Reported by sskaje, 20 months ago.

Env:

linux CentOS 5.5 x64/Ubuntu 11.10 x86;
nginx;
php5-fpm 5.3.3/5.3.6;
xcache 1.3.1/1.3.2;

Code below:

<?php

class a{
    public $a = 1;
}
$a = array(
    'a' => 1,
);

if (!($b = xcache_get('key'))) {
    $b = array(
#        'b' =>  $a,
        'b' =>  new a,
    );

    xcache_set('key', $b, 2);
}

var_dump($b);

Do

curl  http://172.16.9.252:8080/1.php

twice in 1 second, Nginx would say a 502 at the second time.

Check out the fpm log

WARNING: [pool www] child 1380 exited on signal 11 (SIGSEGV - core dumped)

Use

    $b = array(
        'b' =>  $a,
#        'b' =>  new a,
    );

code above works well. Or, comment the var_dump line, no coredump reported.

BackTrace?:

(gdb) bt
#0  0x0833d35b in zend_std_get_properties ()
#1  0x0827b99c in php_var_dump ()
#2  0x0827bbdd in ?? ()
#3  0x08328236 in zend_hash_apply_with_arguments ()
#4  0x0827b8ed in php_var_dump ()
#5  0x0079a85c in zif_xdebug_var_dump (ht=1, return_value=0x99d178c, return_value_ptr=0x0, this_ptr=0x0, return_value_used=0)
    at /build/buildd/xdebug-2.1.0/build-php5/xdebug.c:1444
#6  0x083b2e75 in execute_internal ()
#7  0x0079a474 in xdebug_execute_internal (current_execute_data=0x9a096e4, return_value_used=0) at /build/buildd/xdebug-2.1.0/build-php5/xdebug.c:1339
#8  0x08397505 in ?? ()
#9  0x0834264e in execute ()
#10 0x0079a123 in xdebug_execute (op_array=0x99d116c) at /build/buildd/xdebug-2.1.0/build-php5/xdebug.c:1272
#11 0x0831b3a9 in zend_execute_scripts ()
#12 0x082c22de in php_execute_script ()
#13 0x0806a148 in ?? ()
#14 0x00b68113 in __libc_start_main () from /lib/i386-linux-gnu/libc.so.6
#15 0x0806ad99 in _start ()
(gdb) source /tmp/php5-5.3.6/.gdbinit
Redefine command "____executor_globals"? (y or n) [answered Y; input not from terminal]
Redefine command "print_cvs"? (y or n) [answered Y; input not from terminal]
Redefine command "dump_bt"? (y or n) [answered Y; input not from terminal]
Redefine command "printzv"? (y or n) [answered Y; input not from terminal]
Redefine command "____printzv_contents"? (y or n) [answered Y; input not from terminal]
Redefine command "____printzv"? (y or n) [answered Y; input not from terminal]
Redefine command "____print_const_table"? (y or n) [answered Y; input not from terminal]
Redefine command "print_const_table"? (y or n) [answered Y; input not from terminal]
Redefine command "____print_ht"? (y or n) [answered Y; input not from terminal]
Redefine command "print_ht"? (y or n) [answered Y; input not from terminal]
Redefine command "print_htptr"? (y or n) [answered Y; input not from terminal]
Redefine command "print_htstr"? (y or n) [answered Y; input not from terminal]
Redefine command "____print_ft"? (y or n) [answered Y; input not from terminal]
Redefine command "print_ft"? (y or n) [answered Y; input not from terminal]
Redefine command "____print_inh_class"? (y or n) [answered Y; input not from terminal]
Redefine command "____print_inh_iface"? (y or n) [answered Y; input not from terminal]
Redefine command "print_inh"? (y or n) [answered Y; input not from terminal]
Redefine command "print_pi"? (y or n) [answered Y; input not from terminal]
Redefine command "____print_str"? (y or n) [answered Y; input not from terminal]
Redefine command "printzn"? (y or n) [answered Y; input not from terminal]
Redefine command "printzops"? (y or n) [answered Y; input not from terminal]
Redefine command "zbacktrace"? (y or n) [answered Y; input not from terminal]
Redefine command "zmemcheck"? (y or n) [answered Y; input not from terminal]
(gdb) dump_bt
Missing argument 0 in user function.
(gdb)

Is this backtrace correct?

Reported by specky_rum, 5 months ago.

PHP 5.4.3 Apache 2.2.22 64bit. Win 2008 64bit xcache 2.0.1

We have several instance of the Drupal CMS installed on our server which means several copies of the same files and file structure, just in different base directories. We do this so we can break a development version and not affect live, however, they run through one Apache instance and therefore one PHP and xcache instance.

It appears that when xcache is enabled we get frequent but intermittent and apparently fairly random "cannot redeclare class" errors in the PHP error log. These are fatal errors so the page completely fails when this happens. Disabling xcache completely eliminates the problem.

Since these errors are usually caused by either loading the same file twice (include instead of include_once) or by loading two files which have the same class declared in them I wonder if xcache is not using the entire filepath to identify cached files? After all, we have several instances of the same file, each of which has the same size etc.

Evidence for this comes from the error stack which shows the source of the error itself from instance A where all the other entries in the stack are in instance B. This should never happen and as stated, when xcache is disabled, it doesn't.

Reported by sparrow@…, 6 years ago.

lighttpd-1.4.18

lighttpd.conf:

$HTTP["host"] =~ "^(www\.)?(.)(.*)\.abc\.de:81$" {
    server.document-root = "/home/abc_de"

    url.rewrite-once = (
        # files
--------->        "^/files/(.*)$" => "/users/%2/%2%3/files/$1",

        # site
        "^(.*)$" => "/users/%2/%2%3/index.php/$1"
    )
}

request:

telnet test.abc.de 81

---------> GET /files/../settings/myfile.gz HTTP/1.1
Host: abc.de:81
User-Agent: Mozilla/5.0 (X11; U; Linux i686; pl; rv:1.8.1.6) Gecko/20070830 Firefox/2.0.0.6
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language: pl,en-us;q=0.7,en;q=0.3
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-2,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive

log:

(response.c.205) -- splitting Request-URI

******************************************************************************************************
**** Rewrite: ^/files/(.*)$
******************************************************************************************************

(response.c.206) Request-URI  :  /files/../settings/myfile.gz
(response.c.207) URI-scheme   :  http
(response.c.208) URI-authority:  test.abc.de:81
(response.c.209) URI-path     :  /files/../settings/myfile.gz
(response.c.210) URI-query    :
(response.c.205) -- splitting Request-URI
(response.c.206) Request-URI  :  /users/t/test/files/../settings/myfile.gz
(response.c.207) URI-scheme   :  http
(response.c.208) URI-authority:  test.abc.de:81
(response.c.209) URI-path     :  /users/t/test/files/../settings/myfile.gz
(response.c.210) URI-query    :
(response.c.260) -- sanatising URI

******************************************************************************************************
**** Vulnerability **** (response.c.261) URI-path     :  /users/t/test/settings/myfile.gz
******************************************************************************************************

(mod_access.c.135) -- mod_access_uri_handler called
(response.c.375) -- before doc_root
(response.c.376) Doc-Root     : /home/abc_de
(response.c.377) Rel-Path     : /users/t/test/settings/myfile.gz
(response.c.378) Path         :
(response.c.426) -- after doc_root
(response.c.427) Doc-Root     : /home/abc_de
(response.c.428) Rel-Path     : /users/t/test/settings/myfile.gz
(response.c.429) Path         : /home/abc_de/users/t/test/settings/myfile.gz
(response.c.446) -- logical -> physical
(response.c.447) Doc-Root     : /home/abc_de
(response.c.448) Rel-Path     : /users/t/test/settings/myfile.gz
(response.c.449) Path         : /home/abc_de/users/t/test/settings/myfile.gz
(response.c.466) -- handling physical path
(response.c.467) Path         : /home/abc_de/users/t/test/settings/myfile.gz
(response.c.474) -- file found
(response.c.475) Path         : /home/abc_de/users/t/test/settings/myfile.gz
(response.c.613) -- handling subrequest
(response.c.614) Path         : /home/abc_de/users/t/test/settings/myfile.gz
(mod_access.c.135) -- mod_access_uri_handler called
(mod_staticfile.c.394) -- handling file as static file
(response.c.625) -- subrequest finished
(response.c.114) Response-Header:
HTTP/1.1 200 OK
Content-Type: application/x-gzip
Accept-Ranges: bytes
ETag: "210873236"
Last-Modified: Sun, 30 Sep 2007 02:03:03 GMT
Content-Length: 6057
Date: Sun, 30 Sep 2007 13:50:39 GMT
Server: Apache Server