Swoole-src: swoole compiled with SW_USE_OPENSSL can segfault in getClientInfo()

[simonhf]

Please answer these questions before submitting your issue. Thanks!

1. What did you do? If possible, provide a recipe for reproducing the error.

$ cat reproduce-getclientinfo-seg-fault.php 
<?php
printf("%f - creating swoole tcp server\n", microtime(true));
$server = new swoole_server("127.0.0.1", 9501, SWOOLE_BASE, SWOOLE_SOCK_TCP);
$server->set(['open_tcp_nodelay' => true, 'worker_num' => 1,]);
$server->on('WorkerStart', function ($server, $worker_id) {
        printf("%f - callback: WorkerStart for http server\n", microtime(true));
});
$server->on('connect', function (swoole_server $server, int $fd, int $reactor_id) {
        $info = $server->getClientInfo($fd);
        printf("%f - callback; connected via fd:reactor %u:%u; peer %s:%s\n", microtime(true), $fd, $reactor_id, $info['remote_ip'], $info['remote_port']);
});
$server->on('receive', function (swoole_server $server, int $fd, int $reactor_id, string $data) {
        $id = $GLOBALS['fd_2_id'][$fd];
        printf("%f - %s %-48s callback; received via fd:reactor %u:%u; %u bytes\n", microtime(true), network_state_text(), what($direction, $id, ''), $fd, $reactor_id, strlen($data));
});
$server->on('close', function (swoole_server $server, int $fd, int $reactor_id) {
        printf("%f - callback; close by peer via fd:reactor %u:%u\n", microtime(true), $fd, $reactor_id);
});

printf("%f - entering swoole event loop\n", microtime(true));
$server->start();

$ gdb --args php reproduce-getclientinfo-seg-fault.php
GNU gdb (Ubuntu 8.0.1-0ubuntu1) 8.0.1
Copyright (C) 2017 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from php...(no debugging symbols found)...done.
(gdb) run
Starting program: /usr/bin/php reproduce-getclientinfo-seg-fault.php
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
1521754044.708968 - creating swoole tcp server
1521754044.709088 - entering swoole event loop
[/home/simon/swoole-src-1.9.23/swoole_server.c:415@php_swoole_server_before_start]Create swoole_server host=127.0.0.1, port=9501, mode=4, type=1
1521754044.713501 - callback: WorkerStart for http server
[/home/simon/swoole-src-1.9.23/src/network/Server.c:148@swServer_master_onAccept][Master] Accept new connection. maxfd=3|reactor_id=0|conn=8

Program received signal SIGSEGV, Segmentation fault.
__memmove_avx_unaligned_erms () at ../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:431
431     ../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S: No such file or directory.
(gdb) bt
#0  __memmove_avx_unaligned_erms () at ../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:431
#1  0x00005555557c7df5 in add_assoc_stringl_ex ()
#2  0x00007ffff2fafe44 in zim_swoole_server_connection_info (execute_data=<optimized out>, return_value=0x7ffff3813280) at /home/simon/swoole-src-1.9.23/swoole_server.c:3194
#3  0x00005555558675ed in ?? ()
#4  0x000055555580ec2b in execute_ex ()
#5  0x00005555557b4ba6 in zend_call_function ()
#6  0x00007ffff2fab5a8 in sw_call_user_function_fast (params=<synthetic pointer>, param_count=3, retval_ptr_ptr=<synthetic pointer>, fci_cache=<optimized out>, function_name=<optimized out>) at /home/simon/swoole-src-1.9.23/php7_wrapper.h:301
#7  php_swoole_onConnect (serv=<optimized out>, info=<optimized out>) at /home/simon/swoole-src-1.9.23/swoole_server.c:1305
#8  0x00007ffff30030dc in swWorker_onTask (factory=<optimized out>, task=0x7fffffffa7ac) at /home/simon/swoole-src-1.9.23/src/network/Worker.c:278
#9  0x00007ffff2ff5de4 in swServer_tcp_notify (serv=serv@entry=0x555555d79270, conn=conn@entry=0x7ffff7e168d0, event=event@entry=5) at /home/simon/swoole-src-1.9.23/src/network/Server.c:976
#10 0x00007ffff2ffd66a in swReactorThread_onWrite (reactor=0x555555d79888, ev=<optimized out>) at /home/simon/swoole-src-1.9.23/src/network/ReactorThread.c:927
#11 0x00007ffff2ff1f54 in swReactorEpoll_wait (reactor=0x555555d79888, timeo=<optimized out>) at /home/simon/swoole-src-1.9.23/src/reactor/ReactorEpoll.c:261
#12 0x00007ffff30004d8 in swReactorProcess_loop (pool=<optimized out>, worker=worker@entry=0x7fffffffa910) at /home/simon/swoole-src-1.9.23/src/network/ReactorProcess.c:384
#13 0x00007ffff3000ed4 in swReactorProcess_start (serv=serv@entry=0x555555d79270) at /home/simon/swoole-src-1.9.23/src/network/ReactorProcess.c:112
#14 0x00007ffff2ff6768 in swServer_start (serv=serv@entry=0x555555d79270) at /home/simon/swoole-src-1.9.23/src/network/Server.c:707
#15 0x00007ffff2fad48f in zim_swoole_server_start (execute_data=<optimized out>, return_value=0x7fffffffaae0) at /home/simon/swoole-src-1.9.23/swoole_server.c:2181
#16 0x0000555555867b5f in ?? ()
#17 0x000055555580ec2b in execute_ex ()
#18 0x0000555555869c10 in zend_execute ()
#19 0x00005555557c4ee2 in zend_execute_scripts ()
#20 0x0000555555761ea0 in php_execute_script ()
#21 0x000055555586bf30 in ?? ()
#22 0x0000555555636a35 in main ()
(gdb) 

The segfault happens after issuing the following command:

$ curl http://127.0.0.1:9501/hello-world

The gdb backtrace points to this line which appears to be gathering SSL cert strings even though the script is not using SSL...

[1] https://github.com/swoole/swoole-src/blob/v1.9.23/swoole_server.c#L3194

1. What did you expect to see?

I'd expect no segfault and expect to see the IP and port of the connecting peer.

1. What did you see instead?

A segfault.

1. What version of Swoole are you using (php --ri swoole)?

$ php --ri swoole

swoole

swoole support => enabled
Version => 1.9.23
Author => tianfeng.han[email: [email protected]]
epoll => enabled
eventfd => enabled
timerfd => enabled
signalfd => enabled
cpu affinity => enabled
spinlock => enabled
rwlock => enabled
async redis client => enabled
async http/websocket client => enabled
sockets => enabled
openssl => enabled
http2 => enabled
Linux Native AIO => enabled
pcre => enabled
zlib => enabled
mutex_timedlock => enabled
pthread_barrier => enabled
futex => enabled

Directive => Local Value => Master Value
swoole.aio_thread_num => 2 => 2
swoole.display_errors => On => On
swoole.use_namespace => Off => Off
swoole.fast_serialize => Off => Off
swoole.unixsock_buffer_size => 8388608 => 8388608

1. What is your machine environment used (including version of kernel & php & gcc) ?

Latest Ubuntu running on a VM.

$ uname -a
Linux simon-virtual-machine 4.13.0-36-generic #40-Ubuntu SMP Fri Feb 16 20:07:48 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux

$ php -v
PHP 7.1.15-0ubuntu0.17.10.1 (cli) (built: Mar 14 2018 22:30:42) ( NTS )
Copyright (c) 1997-2018 The PHP Group
Zend Engine v3.1.0, Copyright (c) 1998-2018 Zend Technologies
    with Zend OPcache v7.1.15-0ubuntu0.17.10.1, Copyright (c) 1999-2018, by Zend Technologies

$ gcc -v
Using built-in specs.
COLLECT_GCC=gcc
COLLECT_LTO_WRAPPER=/usr/lib/gcc/x86_64-linux-gnu/7/lto-wrapper
OFFLOAD_TARGET_NAMES=nvptx-none
OFFLOAD_TARGET_DEFAULT=1
Target: x86_64-linux-gnu
Configured with: ../src/configure -v --with-pkgversion='Ubuntu 7.2.0-8ubuntu3.2' --with-bugurl=file:///usr/share/doc/gcc-7/README.Bugs --enable-languages=c,ada,c++,go,brig,d,fortran,objc,obj-c++ --prefix=/usr --with-gcc-major-version-only --program-suffix=-7 --program-prefix=x86_64-linux-gnu- --enable-shared --enable-linker-build-id --libexecdir=/usr/lib --without-included-gettext --enable-threads=posix --libdir=/usr/lib --enable-nls --with-sysroot=/ --enable-clocale=gnu --enable-libstdcxx-debug --enable-libstdcxx-time=yes --with-default-libstdcxx-abi=new --enable-gnu-unique-object --disable-vtable-verify --enable-libmpx --enable-plugin --enable-default-pie --with-system-zlib --with-target-system-zlib --enable-objc-gc=auto --enable-multiarch --disable-werror --with-arch-32=i686 --with-abi=m64 --with-multilib-list=m32,m64,mx32 --enable-multilib --with-tune=generic --enable-offload-targets=nvptx-none --without-cuda-driver --enable-checking=release --build=x86_64-linux-gnu --host=x86_64-linux-gnu --target=x86_64-linux-gnu
Thread model: posix
gcc version 7.2.0 (Ubuntu 7.2.0-8ubuntu3.2) 

1. If you are using ssl, what is your openssl version?

$ openssl version
OpenSSL 1.0.2g  1 Mar 2016

[matyhtf]

There is a bug here ,that has been fixed .
Thanks for your feedback.