#11 PHP process segfaults with LDAP Nav 0.9.

[Ryan Underwood]

Hi,
When modifying some entries, the PHP process segfaults and the server
connection closes (but apache does not crash). It happens when
modifying a few entries but not most others.

Debian testing system, software versions:
php4 4.1.2-5
apache-ssl 1.3.26.1+1.48-

LDAP Navigator version is 0.9.4, I will install 0.9.6 soon and see if
anything is chanced.

Strace -f is below.

[pid 32603] <... select resumed> ) = 1 (in [7])
[pid 32603] read(7, "0\f\2\1\1a\7\n\1\0\4\0\4\0", 16384) = 14
[pid 32603] time(NULL) = 1035181851
[pid 32603] open("./modules/entry/modify.php", O_RDONLY|O_LARGEFILE) = 8
[pid 32603] getcwd("/usr/share/ldapnavigator", 4096) = 25
[pid 32603] lstat("/usr", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0
[pid 32603] lstat("/usr/share", {st_mode=S_IFDIR|0755, st_size=4096,
...}) = 0
[pid 32603] lstat("/usr/share/ldapnavigator", {st_mode=S_IFDIR|0755,
st_size=4096, ...}) = 0
[pid 32603] lstat("/usr/share/ldapnavigator/modules",
{st_mode=S_IFDIR|0777, st_size=4096, ...}) = 0
[pid 32603] lstat("/usr/share/ldapnavigator/modules/entry",
{st_mode=S_IFDIR|0777, st_size=4096, ...}) = 0
[pid 32603] lstat("/usr/share/ldapnavigator/modules/entry/modify.php",
{st_mode=S_IFREG|0666, st_size=4611, ...}) = 0
[pid 32603] brk(0x8189000) = 0x8189000
[pid 32603] ioctl(8, SNDCTL_TMR_TIMEBASE, 0x7fffd33c) = -1 ENOTTY
(Inappropriate ioctl for device)
[pid 32603] fstat(8, {st_mode=S_IFREG|0666, st_size=4611, ...}) = 0
[pid 32603] old_mmap(NULL, 4096, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x2ad87000
[pid 32603] read(8, "<?php\r\n/*\r\n\tentry.modify.php\r\n\tM"..., 8192)
= 4611
[pid 32603] read(8, "", 4096) = 0
[pid 32603] brk(0x8199000) = 0x8199000
[pid 32603] read(8, "", 8192) = 0
[pid 32603] ioctl(8, SNDCTL_TMR_TIMEBASE, 0x7fffc318) = -1 ENOTTY
(Inappropriate ioctl for device)
[pid 32603] close(8) = 0
[pid 32603] munmap(0x2ad87000, 4096) = 0
[pid 32603] time(NULL) = 1035181852
[pid 32603] write(7, "0\201\204\2\1\2c\177\4_mail=theband@room237.f"...,
135) = 135
[pid 32603] select(1024, [7], [], NULL, NULL) = 1 (in [7])
[pid 32603] read(7,
"0\202\1\275\2\1\2d\202\1\266\4_mail=theband@room23"..., 16384) = 463
[pid 32603] time(NULL) = 1035181852
[pid 32603] --- SIGSEGV (Segmentation fault) ---
[pid 32601] <... select resumed> ) = ? ERESTARTNOHAND (To be restarted)

[Ryan Underwood]

Logged In: YES
user_id=324742

Looks like the same thing with 0.9.6.

It worked fine with earlier versions of apache/php. Can some debug output be outputted somehow?

[Ryan Underwood]

Logged In: YES
user_id=324742

Here is the backtrace:

(gdb) attach attach 27231
Attaching to process 27231

Reading symbols from /usr/sbin/apache-ssl...(no debugging symbols found)...done.
Reading symbols from /lib/libm.so.6...(no debugging symbols found)...done.
Loaded symbols for /lib/libm.so.6
Reading symbols from /lib/libcrypt.so.1...(no debugging symbols found)...done.
Loaded symbols for /lib/libcrypt.so.1
...etc...

0x2ad37cc3 in semop () from /lib/libc.so.6
(gdb) c
Continuing.

...attempt to make modification in LDAP Navigator...

Program received signal SIGSEGV, Segmentation fault.
0x2af9279c in zif_ldap_dn2ufn () from /usr/lib/php4/20010901/ldap.so
(gdb) bt
#0 0x2af9279c in zif_ldap_dn2ufn () from /usr/lib/php4/20010901/ldap.so
#1 0x2af92ad5 in zif_ldap_mod_replace () from /usr/lib/php4/20010901/ldap.so
#2 0x2ae40779 in execute () from /usr/lib/apache/1.3/libphp4.so
#3 0x2ae42b4a in execute () from /usr/lib/apache/1.3/libphp4.so
#4 0x2ae4ef66 in zend_execute_scripts () from /usr/lib/apache/1.3/libphp4.so
#5 0x2ae5ceb6 in php_execute_script () from /usr/lib/apache/1.3/libphp4.so
#6 0x2ae58cae in apache_php_module_main () from /usr/lib/apache/1.3/libphp4.so
#7 0x2ae597ae in php_restore_umask () from /usr/lib/apache/1.3/libphp4.so
#8 0x2ae59815 in php_restore_umask () from /usr/lib/apache/1.3/libphp4.so
#9 0x08053be4 in ap_invoke_handler ()
#10 0x0806348c in ap_some_auth_required ()
#11 0x080634e8 in ap_process_request ()
#12 0x0805cce9 in ap_child_terminate ()
#13 0x0805cf1e in ap_child_terminate ()
#14 0x0805cf99 in ap_child_terminate ()
#15 0x0805d475 in ap_child_terminate ()
#16 0x0805db7d in main ()
#17 0x2ac810bf in __libc_start_main () from /lib/libc.so.6
(gdb)

[Ryan Underwood]

Logged In: YES
user_id=324742

Looks like upgrading to PHP 4.2.3 (and the new php-ldap module contained within it as of 4/02, compared to PHP 4.1.2 and the php-ldap from 12/01) changed something. The module no longer segfaults when trying to change an existing string, but returns:
"modifying attributes failed : Success"
in an error box, and the string is not modified.

I can accomplish the modification by removing the existing entry and re-adding it, but there seems to be a bug in updating an existing entry.

slapd version is:
slapd 2.0.23-14 (626.9k) OpenLDAP server (slapd)