Description Mark Felder 2014-06-07 03:29:44 UTC

The snmp PHP module somehow causes libpkg.so.1 to be loaded and the sqlite functions from libpkg.so.1 are picked up and cause segfaults, coredumps.

To reproduce:

Consider this simple PHP script that calls sqlite functions

<?php
$dbhandle = new PDO("sqlite:/database/mppdb");
echo "hello";
$dbhandle = null;
?>

Install required php software:

# pkg install php5-pdo_sqlite

Execute script:

# php test.php

Fatal error: Uncaught exception 'PDOException' with message 'SQLSTATE[HY000] [14] unable to open database file' in /root/test.php:2
Stack trace:
#0 /root/test.php(2): PDO->__construct('sqlite:/databas...')
#1 {main}
  thrown in /root/test.php on line 2


Script works as expected.

Now install the php5-snmp module. Check the extensions order and make sure you place snmp above the sqlite modules as this can happen to users.

# pkg install php5-snmp
# cat /usr/local/etc/php/extensions.ini
extension=snmp.so
extension=pdo.so
extension=pdo_sqlite.so

# php test.php
Segmentation fault (core dumped)


Backtrace of core looks like this:

#0  0x0000000000000000 in ?? ()
#1  0x000000080397894e in sqlite3_release_memory () from /usr/local/lib/libpkg.so.1
#2  0x0000000803978b29 in sqlite3_release_memory () from /usr/local/lib/libpkg.so.1
#3  0x0000000803984e25 in sqlite3_set_auxdata () from /usr/local/lib/libpkg.so.1
#4  0x00000008039a9294 in sqlite3_blob_close () from /usr/local/lib/libpkg.so.1
#5  0x000000080cdd0265 in pdo_sqlite_handle_factory () from /usr/local/lib/php/20100525/pdo_sqlite.so
#6  0x000000080a4402dd in zim_PDO_dbh_constructor () from /usr/local/lib/php/20100525/pdo.so
#7  0x0000000000597673 in zend_do_fcall_common_helper_SPEC ()
#8  0x000000000059d2b3 in execute ()
#9  0x000000000056993e in zend_execute_scripts ()
#10 0x000000000050d02c in php_execute_script ()
#11 0x000000000060e854 in do_cli ()
#12 0x000000000060eff1 in main ()
#13 0x0000000000418bde in _start ()
#14 0x000000080096f000 in ?? ()