Double free or corruption (fasttop) on SSL-enabled server during reload server

[abolfazl-esmaeeli]

hi
When running a Swoole HTTP server with SSL enabled, performing a reload operation causes a crash with the error:
double free or corruption (fasttop)

[matyhtf]

Please submit according to the issue template. Detailed information is required to analyze the cause of the problem

1. Environment information: php, swoole, linux, gcc, openssl, curl versions, and php - m lists all used extensions
2. Problem code: reproducible problem complete php code
3. Trace logs: trace logs of strace, valgrind, asan and gdb

[abolfazl-esmaeeli]

simpleCode.zip

When I run the server using the command
php index.php,
I use inotify to automatically reload the server as soon as any PHP file inside that folder changes.
However, when the reload happens, I get this error in the console.

[matyhtf]

I cannot reproduce it. I used version 6.1.2. If you are using a lower version, you can try upgrading it

~/workspace/debug/simpleCode$ USE_ZEND_ALLOC=0 valgrind php index.php 
==2586431== Memcheck, a memory error detector
==2586431== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==2586431== Using Valgrind-3.18.1 and LibVEX; rerun with -h for copyright info
==2586431== Command: php index.php
==2586431== 


:
reloadreload==2586437== 
==2586437== HEAP SUMMARY:
==2586437==     in use at exit: 5,809,116 bytes in 36,305 blocks
==2586437==   total heap usage: 75,156 allocs, 38,851 frees, 15,746,322 bytes allocated
==2586437== 
==2586441== 
==2586441== HEAP SUMMARY:
==2586441==     in use at exit: 5,809,116 bytes in 36,305 blocks
==2586441==   total heap usage: 75,156 allocs, 38,851 frees, 15,746,322 bytes allocated
==2586441== 
==2586434== 
==2586434== HEAP SUMMARY:
==2586434==     in use at exit: 5,809,116 bytes in 36,305 blocks
==2586434==   total heap usage: 75,156 allocs, 38,851 frees, 15,746,322 bytes allocated
==2586434== 
==2586440== 
==2586440== HEAP SUMMARY:
==2586440==     in use at exit: 5,809,116 bytes in 36,305 blocks
==2586440==   total heap usage: 75,156 allocs, 38,851 frees, 15,746,322 bytes allocated
==2586440== 
==2586439== 
==2586439== HEAP SUMMARY:
==2586439==     in use at exit: 5,809,116 bytes in 36,305 blocks
==2586439==   total heap usage: 75,156 allocs, 38,851 frees, 15,746,322 bytes allocated
==2586439== 
==2586435== 
==2586435== HEAP SUMMARY:
==2586435==     in use at exit: 5,809,116 bytes in 36,305 blocks
==2586435==   total heap usage: 75,156 allocs, 38,851 frees, 15,746,322 bytes allocated
==2586435== 
==2586441== LEAK SUMMARY:
==2586441==    definitely lost: 39,632 bytes in 1,239 blocks
==2586441==    indirectly lost: 128 bytes in 3 blocks
==2586441==      possibly lost: 3,636,564 bytes in 25,160 blocks
==2586441==    still reachable: 2,132,792 bytes in 9,903 blocks
==2586441==                       of which reachable via heuristic:
==2586441==                         newarray           : 1,544 bytes in 1 blocks
==2586441==         suppressed: 0 bytes in 0 blocks
==2586441== Rerun with --leak-check=full to see details of leaked memory
==2586441== 
==2586441== For lists of detected and suppressed errors, rerun with: -s
==2586441== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)
==2586437== LEAK SUMMARY:
==2586437==    definitely lost: 39,632 bytes in 1,239 blocks
==2586437==    indirectly lost: 128 bytes in 3 blocks
==2586437==      possibly lost: 3,636,564 bytes in 25,160 blocks
==2586437==    still reachable: 2,132,792 bytes in 9,903 blocks
==2586437==                       of which reachable via heuristic:
==2586437==                         newarray           : 1,544 bytes in 1 blocks
==2586437==         suppressed: 0 bytes in 0 blocks
==2586437== Rerun with --leak-check=full to see details of leaked memory
==2586437== 
==2586437== For lists of detected and suppressed errors, rerun with: -s
==2586437== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)
==2586438== 
==2586438== HEAP SUMMARY:
==2586438==     in use at exit: 5,809,116 bytes in 36,305 blocks
==2586438==   total heap usage: 75,156 allocs, 38,851 frees, 15,746,322 bytes allocated
==2586438== 
==2586436== 
==2586436== HEAP SUMMARY:
==2586436==     in use at exit: 5,809,116 bytes in 36,305 blocks
==2586436==   total heap usage: 75,156 allocs, 38,851 frees, 15,746,322 bytes allocated
==2586436== 
==2586434== LEAK SUMMARY:
==2586434==    definitely lost: 39,632 bytes in 1,239 blocks
==2586434==    indirectly lost: 128 bytes in 3 blocks
==2586434==      possibly lost: 3,636,564 bytes in 25,160 blocks
==2586434==    still reachable: 2,132,792 bytes in 9,903 blocks
==2586434==                       of which reachable via heuristic:
==2586434==                         newarray           : 1,544 bytes in 1 blocks
==2586434==         suppressed: 0 bytes in 0 blocks
==2586434== Rerun with --leak-check=full to see details of leaked memory
==2586434== 
==2586434== For lists of detected and suppressed errors, rerun with: -s
==2586434== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)
==2586440== LEAK SUMMARY:
==2586440==    definitely lost: 39,632 bytes in 1,239 blocks
==2586440==    indirectly lost: 128 bytes in 3 blocks
==2586440==      possibly lost: 3,636,564 bytes in 25,160 blocks
==2586440==    still reachable: 2,132,792 bytes in 9,903 blocks
==2586440==                       of which reachable via heuristic:
==2586440==                         newarray           : 1,544 bytes in 1 blocks
==2586440==         suppressed: 0 bytes in 0 blocks
==2586440== Rerun with --leak-check=full to see details of leaked memory
==2586440== 
==2586440== For lists of detected and suppressed errors, rerun with: -s
==2586440== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)
==2586439== LEAK SUMMARY:
==2586439==    definitely lost: 39,632 bytes in 1,239 blocks
==2586439==    indirectly lost: 128 bytes in 3 blocks
==2586439==      possibly lost: 3,636,564 bytes in 25,160 blocks
==2586439==    still reachable: 2,132,792 bytes in 9,903 blocks
==2586439==                       of which reachable via heuristic:
==2586439==                         newarray           : 1,544 bytes in 1 blocks
==2586439==         suppressed: 0 bytes in 0 blocks
==2586439== Rerun with --leak-check=full to see details of leaked memory
==2586439== 
==2586439== For lists of detected and suppressed errors, rerun with: -s
==2586439== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)
==2586435== LEAK SUMMARY:
==2586435==    definitely lost: 39,632 bytes in 1,239 blocks
==2586435==    indirectly lost: 128 bytes in 3 blocks
==2586435==      possibly lost: 3,636,564 bytes in 25,160 blocks
==2586435==    still reachable: 2,132,792 bytes in 9,903 blocks
==2586435==                       of which reachable via heuristic:
==2586435==                         newarray           : 1,544 bytes in 1 blocks
==2586435==         suppressed: 0 bytes in 0 blocks
==2586435== Rerun with --leak-check=full to see details of leaked memory
==2586435== 
==2586435== For lists of detected and suppressed errors, rerun with: -s
==2586435== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)
==2586438== LEAK SUMMARY:
==2586438==    definitely lost: 39,632 bytes in 1,239 blocks
==2586438==    indirectly lost: 128 bytes in 3 blocks
==2586438==      possibly lost: 3,636,564 bytes in 25,160 blocks
==2586438==    still reachable: 2,132,792 bytes in 9,903 blocks
==2586438==                       of which reachable via heuristic:
==2586438==                         newarray           : 1,544 bytes in 1 blocks
==2586438==         suppressed: 0 bytes in 0 blocks
==2586438== Rerun with --leak-check=full to see details of leaked memory
==2586438== 
==2586438== For lists of detected and suppressed errors, rerun with: -s
==2586438== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)
==2586436== LEAK SUMMARY:
==2586436==    definitely lost: 39,632 bytes in 1,239 blocks
==2586436==    indirectly lost: 128 bytes in 3 blocks
==2586436==      possibly lost: 3,636,564 bytes in 25,160 blocks
==2586436==    still reachable: 2,132,792 bytes in 9,903 blocks
==2586436==                       of which reachable via heuristic:
==2586436==                         newarray           : 1,544 bytes in 1 blocks
==2586436==         suppressed: 0 bytes in 0 blocks
==2586436== Rerun with --leak-check=full to see details of leaked memory
==2586436== 
==2586436== For lists of detected and suppressed errors, rerun with: -s
==2586436== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)

[abolfazl-esmaeeli]

When the file test.php changes, the error above occurs.

[matyhtf]

@abolfazl-esmaeeli You need to provide version information and the complete Valgrind output log, not just a small part.

[abolfazl-esmaeeli]

valgrind.log

USE_ZEND_ALLOC=0 valgrind --tool=memcheck --leak-check=full --show-leak-kinds=all --track-origins=yes --log-file=valgrind.log php index.php

[matyhtf]

There is no valid information. From the Valgrind log, it seems that everything is normal and no crashes have occurred

[abolfazl-esmaeeli]

In the provided sample code
When the reload function is called multiple times, it can cause an error. Sometimes the error occurs on the first call, and other times it may not appear even after five calls.

To reproduce the issue, modify the file test.php. Each time the file is changed, the reload function is triggered. After several changes, the error appears.

[abolfazl-esmaeeli]

I realized that this happens because my SSL certificate is not valid. In other words, as long as no request comes to the server from a browser, the server can be reloaded any number of times without any issue.

However, as soon as the server is reloaded and then a request is sent from a browser, the following warning appears in the console, and on the next reload, the server immediately crashes.

I hope this information helps you with troubleshooting the issue.