geohash_neighbors产生coredump

[leo-xia-jing]

服务器版本：ubuntu 12.04
PHP版本：PHP 5.5.37

gdb stack信息如下：

#0 0x00007f825184e447 in zend_hash_destroy () from /usr/lib/apache2/modules/libphp5.so
#1 0x00007f825181f378 in zend_release_labels () from /usr/lib/apache2/modules/libphp5.so
#2 0x00007f8251808bfd in compile_file () from /usr/lib/apache2/modules/libphp5.so
#3 0x00007f825182fa4a in dtrace_compile_file () from /usr/lib/apache2/modules/libphp5.so
#4 0x00007f82516ac2c6 in ?? () from /usr/lib/apache2/modules/libphp5.so
#5 0x00007f824e686b29 in ?? () from /usr/lib/php5/20121212/opcache.so
#6 0x00007f824e6881cf in persistent_compile_file () from /usr/lib/php5/20121212/opcache.so
#7 0x00007f8251808d6c in compile_filename () from /usr/lib/apache2/modules/libphp5.so
#8 0x00007f82518ed0bb in ?? () from /usr/lib/apache2/modules/libphp5.so
#9 0x00007f82518af638 in execute_ex () from /usr/lib/apache2/modules/libphp5.so
#10 0x00007f825182fad6 in dtrace_execute_ex () from /usr/lib/apache2/modules/libphp5.so
#11 0x00007f8251831cf3 in zend_call_function () from /usr/lib/apache2/modules/libphp5.so
#12 0x00007f8251857b47 in zend_call_method () from /usr/lib/apache2/modules/libphp5.so
#13 0x00007f8251729b09 in zif_spl_autoload_call () from /usr/lib/apache2/modules/libphp5.so
#14 0x00007f825182fbe9 in dtrace_execute_internal () from /usr/lib/apache2/modules/libphp5.so
#15 0x00007f8251831eb3 in zend_call_function () from /usr/lib/apache2/modules/libphp5.so
#16 0x00007f82518325ba in zend_lookup_class_ex () from /usr/lib/apache2/modules/libphp5.so
#17 0x00007f8251832ae9 in zend_fetch_class () from /usr/lib/apache2/modules/libphp5.so
#18 0x00007f8251888c68 in ?? () from /usr/lib/apache2/modules/libphp5.so
#19 0x00007f82518af638 in execute_ex () from /usr/lib/apache2/modules/libphp5.so
#20 0x00007f825182fad6 in dtrace_execute_ex () from /usr/lib/apache2/modules/libphp5.so
#21 0x00007f82518ecae1 in ?? () from /usr/lib/apache2/modules/libphp5.so
#22 0x00007f82518af638 in execute_ex () from /usr/lib/apache2/modules/libphp5.so
#23 0x00007f825182fad6 in dtrace_execute_ex () from /usr/lib/apache2/modules/libphp5.so
#24 0x00007f82518ecae1 in ?? () from /usr/lib/apache2/modules/libphp5.so
#25 0x00007f82518af638 in execute_ex () from /usr/lib/apache2/modules/libphp5.so
#26 0x00007f825182fad6 in dtrace_execute_ex () from /usr/lib/apache2/modules/libphp5.so
#27 0x00007f82518ecae1 in ?? () from /usr/lib/apache2/modules/libphp5.so
#28 0x00007f82518af638 in execute_ex () from /usr/lib/apache2/modules/libphp5.so
#29 0x00007f825182fad6 in dtrace_execute_ex () from /usr/lib/apache2/modules/libphp5.so
#30 0x00007f82518ecae1 in ?? () from /usr/lib/apache2/modules/libphp5.so
#31 0x00007f82518af638 in execute_ex () from /usr/lib/apache2/modules/libphp5.so
#32 0x00007f825182fad6 in dtrace_execute_ex () from /usr/lib/apache2/modules/libphp5.so
#33 0x00007f82518ee40e in ?? () from /usr/lib/apache2/modules/libphp5.so
#34 0x00007f82518af638 in execute_ex () from /usr/lib/apache2/modules/libphp5.so
#35 0x00007f825182fad6 in dtrace_execute_ex () from /usr/lib/apache2/modules/libphp5.so
#36 0x00007f8251841994 in zend_execute_scripts () from /usr/lib/apache2/modules/libphp5.so
#37 0x00007f82517de96d in php_execute_script () from /usr/lib/apache2/modules/libphp5.so
#38 0x00007f82518efa9d in ?? () from /usr/lib/apache2/modules/libphp5.so
#39 0x00007f8255d906d8 in ap_run_handler ()
#40 0x00007f8255d90cce in ap_invoke_handler ()
#41 0x00007f8255da74ea in ap_process_async_request ()
#42 0x00007f8255da764f in ap_process_request ()

[leo-xia-jing]

发现在cli模式下geohash_neighbors能正常运行，但是在apache环境下就不行。

[leo-xia-jing]

经过调试分析，get_neighbor方法中base内存申请的使用，在有些C环境是会发生踩内存导致进程异常。

如上源代码，base申请的内存大小为1个字节，strncat的时候会将hash的前5个字节的cat到base。如果base分配的1个字节后面内存为其他使用了，就会导致程序跑飞。base申请的内存字节应该为hash_length+1个，即如下。

char *base = emalloc(sizeof(char) * (hash_length+1));

[shenzhe]

感谢反馈！