Your message dated Fri, 8 Jan 2010 17:23:24 +0100
with message-id <[email protected]>
and subject line Re: Bug#464186: #464186: random heap corruption in php5
has caused the Debian Bug report #464186,
regarding random heap corruption in php5
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
464186: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=464186
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: php5-cgi
Version: 5.2.5-2
Severity: important
After switching to 5.2.5.x, suhosin reveals several heap corruption
cases:
Feb 4 07:46:55 e suhosin[2951]: ALERT - linked list corrupt on efree
() - heap corruption detected (attacker 'x.x.x.x', file 'xxxfile.php')
Feb 4 07:47:22 e suhosin[11754]: ALERT - linked list corrupt on efree
() - heap corruption detected (attacker 'x.x.x.x', file 'xxxfile.php')
Feb 4 07:47:53 e suhosin[3178]: ALERT - linked list corrupt on efree
() - heap corruption detected (attacker 'x.x.x.x', file 'xxxfile.php')
Feb 4 07:47:59 e suhosin[3199]: ALERT - canary mismatch on efree() -
heap overflow detected (attacker 'x.x.x.x', file 'xxxfile.php')
Feb 4 14:21:33 e suhosin[3204]: ALERT - canary mismatch on efree() -
heap overflow detected (attacker 'x.x.x.x', file 'xxxfile.php')
Feb 4 15:11:56 e suhosin[10601]: ALERT - canary mismatch on efree()
- heap overflow detected (attacker 'x.x.x.x', file 'xxxfile.php')
Feb 4 15:12:17 e suhosin[10385]: ALERT - canary mismatch on efree()
- heap overflow detected (attacker 'x.x.x.x', file 'xxxfile.php')
Feb 4 15:25:40 e suhosin[11580]: ALERT - canary mismatch on efree()
- heap overflow detected (attacker 'x.x.x.x', file 'xxxfile.php')
Feb 4 15:25:52 e suhosin[11667]: ALERT - canary mismatch on efree()
- heap overflow detected (attacker 'x.x.x.x', file 'xxxfile.php')
Feb 4 21:10:40 e suhosin[18365]: ALERT - linked list corrupt on efree
() - heap corruption detected (attacker 'x.x.x.x', file 'xxxfile.php')
These are not attacks (this is a local test machine), but important
bugs in php5.
I'm using php5-cgi via fcgid and php5-sqlite only. Both are built
from the same php sources, so this is not an external module bug.
I'm having an hard time reproducing the crashes though, since these
are classic heap corruption problems occurring after several hours of
usage.
php5 has always been very crashy compared to php4, but suhosin raised
the bar significantly. I can hardly suggest to run it on production
boxes.
Running the php test-suite under valgrind may help.
--- End Message ---
--- Begin Message ---
> Please close it, thanks.
Closing per submitter request.
Ondrej
--
Ondřej Surý <[email protected]>
http://blog.rfc1925.org/
--- End Message ---
