libphp5.so crashes JVM when using <security-constraint>
prolancer Feb 1, 2007 6:44 AMI am running a PHP based web application using the following setup:
- php5servlet-linux-i686-1.0.0-SP1
- jbossweb-1.0.1.GA-linux2-i686
- Fedora Core 5 with the latest updates (see next)
$ uname -a
Linux pub-srv-001.xxx.xxx.xx 2.6.18-1.2257.fc5 #1 SMP Fri Dec 15 16:07:14 EST 2006 x86_64 x86_64 x86_64 GNU/Linux
I have installed the application as a web module and have configured the PHP servlet as recommended in the global web.xml file for the jbossweb.sar. The PHP app runs fine and the JBoss WS behaves with the following web.xml file (in the WEB-INF dir for the module):
<?xml version="1.0" encoding="UTF-8"?> <web-app id="PlayMe" version="2.4" xmlns="http://java.sun.com/xml/ns/j2ee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd"> <display-name>Play Me</display-name> <!-- Servlet definition is a already done in the global web.xml. --> <!-- Welcome file list in the global web.xml already contains index.php. --> </web-app>
Then I added a security constraint in the web.xml file
<?xml version="1.0" encoding="UTF-8"?> <web-app id="PlayMe" version="2.4" xmlns="http://java.sun.com/xml/ns/j2ee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd"> <display-name>Play Me</display-name> <!-- Servlet definition is a already done in the global web.xml. --> <!-- Welcome file list in the global web.xml already contains index.php. --> <!-- Protect access to the administration pages. --> <security-constraint> <web-resource-collection> <web-resource-name>GameAdministration</web-resource-name> <url-pattern>/admin/*</url-pattern> </web-resource-collection> <auth-constraint> <role-name>gameadmin</role-name> </auth-constraint> <user-data-constraint> <transport-guarantee>NONE</transport-guarantee> </user-data-constraint> </security-constraint> <security-role> <role-name>gameadmin</role-name> </security-role> <login-config> <auth-method>DIGEST</auth-method> <realm-name>Prolancer Games</realm-name> </login-config> </web-app>
The admin directory has PHP pages as well with index.php being the entry page. This is what happens:
1. I access the .../admin/index.php with IE 7.
2. A login dialog appears
3. I supply my user-name and password
4. The browser starts to display the index.php page but half way through the JVM running the JBoss WS server dies with the following dump
#
# An unexpected error has been detected by HotSpot Virtual Machine:
#
# SIGSEGV (0xb) at pc=0xc7b4d75d, pid=31890, tid=3358587808
#
# Java VM: Java HotSpot(TM) Server VM (1.5.0_09-b03 mixed mode)
# Problematic frame:
# C [libphp5.so+0x2e775d] _efree+0x81
#
--------------- T H R E A D ---------------
Current thread (0x0892c1a8): JavaThread "http-pub-srv-001.xxx.xxx.xxx%2F192.xxx.xxx.xxx-80-1" daemon [_thread_in_native, id=31927]
siginfo:si_signo=11, si_errno=0, si_code=1, si_addr=0x0000000a
Registers:
EAX=0xcb200048, EBX=0xc9791074, ECX=0x00000003, EDX=0x0000000a
ESP=0xc82fcfe4, EBP=0xc82fcffc, ESI=0xc9a46e28, EDI=0xc7fe26e8
EIP=0xc7b4d75d, CR2=0x0000000a, EFLAGS=0x00210297
Top of Stack: (sp=0xc82fcfe4)
0xc82fcfe4: 00000000 ed8c8700 ee062860 c82fd014
0xc82fcff4: c7fe26e8 c979abcc c82fdfbc c7b31675
0xc82fd004: c9791080 00000f9f c7fe26e8 c9a4a1c0
0xc82fd014: c82fd0f4 f77884f8 08080648 edd3f210
0xc82fd024: edb072f0 edb072f0 ed5455b0 edb529f0
0xc82fd034: c82fd064 edd30540 00000000 ed562390
0xc82fd044: edb529f0 ed5455a8 ed5cb8d8 ee29d020
0xc82fd054: 00000000 00000000 ed544158 00000000
Instructions: (pc=0xc7b4d75d)
0xc7b4d74d: f3 ef c7 8b 54 82 fc 3b 1a 74 03 8b 53 04 8b 03
0xc7b4d75d: 89 02 8b 13 85 d2 74 06 8b 43 04 89 42 04 83 ec
Stack: [0xc827f000,0xc8300000), sp=0xc82fcfe4, free space=503k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
C [libphp5.so+0x2e775d] _efree+0x81
C [libphp5.so+0x2cb675] sapi_deactivate+0x201
C [libphp5.so+0x2c572f] php_request_shutdown+0x7d7
C [libphp5servlet.so+0x212f] Java_org_apache_catalina_servlets_php_Handler_php+0x67d
j org.apache.catalina.servlets.php.Handler.php([BLorg/apache/catalina/servlets/php/ScriptEnvironment;Ljavax/servlet/http/HttpServletRequest;Ljavax/servlet/http/HttpServletResponse;Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;IZ)I+0
j org.apache.catalina.servlets.php.Handler.service(Ljavax/servlet/http/HttpServletRequest;Ljavax/servlet/http/HttpServletResponse;)V+102
j javax.servlet.http.HttpServlet.service(Ljavax/servlet/ServletRequest;Ljavax/servlet/ServletResponse;)V+30
j org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Ljavax/servlet/ServletRequest;Ljavax/servlet/ServletResponse;)V+354
j org.apache.catalina.core.ApplicationFilterChain.doFilter(Ljavax/servlet/ServletRequest;Ljavax/servlet/ServletResponse;)V+101
j org.apache.catalina.core.StandardWrapperValve.invoke(Lorg/apache/catalina/connector/Request;Lorg/apache/catalina/connector/Response;)V+695
j org.apache.catalina.core.StandardContextValve.invoke(Lorg/apache/catalina/connector/Request;Lorg/apache/catalina/connector/Response;)V+285
j org.jboss.web.tomcat.security.SecurityAssociationValve.invoke(Lorg/apache/catalina/connector/Request;Lorg/apache/catalina/connector/Response;)V+342
j org.apache.catalina.authenticator.AuthenticatorBase.invoke(Lorg/apache/catalina/connector/Request;Lorg/apache/catalina/connector/Response;)V+675
j org.jboss.web.tomcat.security.JaccContextValve.invoke(Lorg/apache/catalina/connector/Request;Lorg/apache/catalina/connector/Response;)V+32
j org.apache.catalina.core.StandardHostValve.invoke(Lorg/apache/catalina/connector/Request;Lorg/apache/catalina/connector/Response;)V+64
j org.apache.catalina.valves.ErrorReportValve.invoke(Lorg/apache/catalina/connector/Request;Lorg/apache/catalina/connector/Response;)V+6
j org.apache.catalina.valves.FastCommonAccessLogValve.invoke(Lorg/apache/catalina/connector/Request;Lorg/apache/catalina/connector/Response;)V+6
j org.apache.catalina.core.StandardEngineValve.invoke(Lorg/apache/catalina/connector/Request;Lorg/apache/catalina/connector/Response;)V+42
j org.apache.catalina.connector.CoyoteAdapter.service(Lorg/apache/coyote/Request;Lorg/apache/coyote/Response;)V+141
j org.apache.coyote.http11.Http11AprProcessor.process(J)Z+473
j org.apache.coyote.http11.Http11AprProtocol$Http11ConnectionHandler.process(J)Z+323
j org.apache.tomcat.util.net.AprEndpoint$Worker.run()V+50
j java.lang.Thread.run()V+11
v ~StubRoutines::call_stub
V [libjvm.so+0x266eec]
V [libjvm.so+0x42da88]
V [libjvm.so+0x266745]
V [libjvm.so+0x2667de]
V [libjvm.so+0x2ddf75]
V [libjvm.so+0x4cdb13]
V [libjvm.so+0x42e698]
C [libpthread.so.0+0x5433]
[-- cut -- ]
I can provide the whole dump if of interest.
Here is the server log from the time I try and access .../admin/index.php:
21:53:27,039 DEBUG [AuthenticatorBase] Security checking request GET /playme/admin/
21:53:27,039 DEBUG [RealmBase] Checking constraint 'SecurityConstraint[WebDAV]' against GET /playme/index.php --> false
21:53:27,039 DEBUG [RealmBase] Checking constraint 'SecurityConstraint[GameAdministration]' against GET /admin/index.php --> true
21:53:27,039 DEBUG [RealmBase] Checking constraint 'SecurityConstraint[WebDAV]' against GET /admin/index.php --> false
21:53:27,039 DEBUG [RealmBase] Checking constraint 'SecurityConstraint[GameAdministration]' against GET /admin/index.php --> true
21:53:27,039 DEBUG [AuthenticatorBase] Calling hasUserDataPermission()
21:53:27,039 DEBUG [RealmBase] User data constraint has no restrictions
21:53:27,040 DEBUG [AuthenticatorBase] Calling authenticate()
21:53:27,040 DEBUG [AuthenticatorBase] Failed authenticate() test
21:53:31,986 DEBUG [AuthenticatorBase] Security checking request GET /shop/admin/
21:53:31,986 DEBUG [RealmBase] Checking constraint 'SecurityConstraint[WebDAV]' against GET /playme/index.php --> false
21:53:31,986 DEBUG [RealmBase] Checking constraint 'SecurityConstraint[GameAdministration]' against GET /admin/index.php --> true
21:53:31,986 DEBUG [RealmBase] Checking constraint 'SecurityConstraint[WebDAV]' against GET /playme/index.php --> false
21:53:31,986 DEBUG [RealmBase] Checking constraint 'SecurityConstraint[GameAdministration]' against GET /admin/index.php --> true
21:53:31,986 DEBUG [AuthenticatorBase] Calling hasUserDataPermission()
21:53:31,986 DEBUG [RealmBase] User data constraint has no restrictions
21:53:31,986 DEBUG [AuthenticatorBase] Calling authenticate()
21:53:31,991 DEBUG [WebappClassLoader] findResources(jndi.properties)
21:53:31,991 DEBUG [WebappClassLoader] loadClass(org.jnp.interfaces.NamingContextFactory, false)
21:53:31,992 DEBUG [WebappClassLoader] Searching local repositories
21:53:31,992 DEBUG [WebappClassLoader] findClass(org.jnp.interfaces.NamingContextFactory)
21:53:31,992 DEBUG [WebappClassLoader] Delegating to parent classloader at end: java.net.FactoryURLClassLoader@1144ba2
21:53:31,992 DEBUG [WebappClassLoader] Loading class from parent
21:53:31,992 DEBUG [WebappClassLoader] loadClass(org.jboss.naming.java.javaURLContextFactory, false)
21:53:31,992 DEBUG [WebappClassLoader] Searching local repositories
21:53:31,992 DEBUG [WebappClassLoader] findClass(org.jboss.naming.java.javaURLContextFactory)
21:53:31,992 DEBUG [WebappClassLoader] Delegating to parent classloader at end: java.net.FactoryURLClassLoader@1144ba2
21:53:31,993 DEBUG [WebappClassLoader] Loading class from parent
21:53:31,993 DEBUG [WebappClassLoader] loadClass(org.jboss.naming.ENCFactory, false)
21:53:31,994 DEBUG [WebappClassLoader] Searching local repositories
21:53:31,994 DEBUG [WebappClassLoader] findClass(org.jboss.naming.ENCFactory)
21:53:31,994 DEBUG [WebappClassLoader] Delegating to parent classloader at end: java.net.FactoryURLClassLoader@1144ba2
21:53:31,994 DEBUG [WebappClassLoader] Loading class from parent
21:53:31,995 DEBUG [WebappClassLoader] loadClass(org.jboss.security.plugins.JaasSecurityManagerService$SecurityDomainObjectFactory, false)
21:53:31,995 DEBUG [WebappClassLoader] Searching local repositories
21:53:31,995 DEBUG [WebappClassLoader] findClass(org.jboss.security.plugins.JaasSecurityManagerService$SecurityDomainObjectFactory)
21:53:31,995 DEBUG [WebappClassLoader] Delegating to parent classloader at end: java.net.FactoryURLClassLoader@1144ba2
21:53:31,995 DEBUG [WebappClassLoader] Loading class from parent
21:53:31,998 DEBUG [WebappClassLoader] loadClass(javax.naming.Context, false)
21:53:32,005 DEBUG [WebappClassLoader] loadClass(java.lang.reflect.Proxy, false)
21:53:32,006 DEBUG [WebappClassLoader] loadClass(java.lang.Object, false)
21:53:32,006 DEBUG [WebappClassLoader] loadClass(java.lang.Throwable, false)
21:53:32,006 DEBUG [WebappClassLoader] loadClass(javax.naming.NamingException, false)
21:53:32,006 DEBUG [WebappClassLoader] loadClass(java.lang.RuntimeException, false)
21:53:32,006 DEBUG [WebappClassLoader] loadClass(java.lang.Error, false)
21:53:32,006 DEBUG [WebappClassLoader] loadClass(java.lang.reflect.UndeclaredThrowableException, false)
21:53:32,008 DEBUG [WebappClassLoader] loadClass(java.lang.ClassNotFoundException, false)
21:53:32,008 DEBUG [WebappClassLoader] loadClass(java.lang.NoSuchMethodException, false)
21:53:32,009 DEBUG [WebappClassLoader] loadClass(java.lang.NoSuchMethodError, false)
21:53:32,009 DEBUG [WebappClassLoader] loadClass(java.lang.NoClassDefFoundError, false)
21:53:32,009 DEBUG [WebappClassLoader] loadClass(java.lang.reflect.InvocationHandler, false)
21:53:32,009 DEBUG [WebappClassLoader] loadClass(java.lang.Class, false)
21:53:32,009 DEBUG [WebappClassLoader] loadClass(javax.naming.Name, false)
21:53:32,009 DEBUG [WebappClassLoader] loadClass(java.lang.String, false)
21:53:32,011 DEBUG [digest] CallbackHandler: org.jboss.security.auth.callback.SecurityAssociationHandler@771eb1
21:53:32,011 DEBUG [JaasSecurityManagerService] Created securityMgr=org.jboss.security.plugins.JaasSecurityManager@801059
21:53:32,011 DEBUG [WebappClassLoader] loadClass(org.jboss.security.plugins.JaasSecurityManagerService$DefaultCacheObjectFactory, false)
21:53:32,011 DEBUG [WebappClassLoader] Searching local repositories
21:53:32,011 DEBUG [WebappClassLoader] findClass(org.jboss.security.plugins.JaasSecurityManagerService$DefaultCacheObjectFactory)
21:53:32,012 DEBUG [WebappClassLoader] Delegating to parent classloader at end: java.net.FactoryURLClassLoader@1144ba2
21:53:32,012 DEBUG [WebappClassLoader] Loading class from parent
21:53:32,017 DEBUG [digest] CachePolicy set to: org.jboss.util.TimedCachePolicy@dc024a
21:53:32,017 DEBUG [JaasSecurityManagerService] setCachePolicy, c=org.jboss.util.TimedCachePolicy@dc024a
21:53:32,017 DEBUG [JaasSecurityManagerService] Added digest, org.jboss.security.plugins.SecurityDomainContext@1a70b8 to map
21:53:32,021 DEBUG [WebappClassLoader] loadClass(org.jboss.security.auth.spi.UsersRolesLoginModule, false)
21:53:32,021 DEBUG [WebappClassLoader] Searching local repositories
21:53:32,021 DEBUG [WebappClassLoader] findClass(org.jboss.security.auth.spi.UsersRolesLoginModule)
21:53:32,021 DEBUG [WebappClassLoader] Delegating to parent classloader at end: java.net.FactoryURLClassLoader@1144ba2
21:53:32,025 DEBUG [WebappClassLoader] Loading class from parent
21:53:32,031 DEBUG [WebappClassLoader] findResource(defaultUsers.properties)
21:53:32,032 DEBUG [WebappClassLoader] --> Resource not found, returning null
21:53:32,032 DEBUG [WebappClassLoader] findResource(digest-users.properties)
21:53:32,032 DEBUG [WebappClassLoader] --> Resource not found, returning null
21:53:32,032 DEBUG [WebappClassLoader] getResource(defaultUsers.properties)
21:53:32,032 DEBUG [WebappClassLoader] findResource(defaultUsers.properties)
21:53:32,032 DEBUG [WebappClassLoader] --> Resource not found, returning null
21:53:32,080 DEBUG [WebappClassLoader] --> Resource not found, returning null
21:53:32,080 DEBUG [WebappClassLoader] getResource(digest-users.properties)
21:53:32,080 DEBUG [WebappClassLoader] findResource(digest-users.properties)
21:53:32,080 DEBUG [WebappClassLoader] --> Resource not found, returning null
21:53:32,081 DEBUG [WebappClassLoader] --> Returning 'file:/usr/jboss/jbossweb-1.0.1.GA/server/pub-srv-001/conf/digest-users.properties'
21:53:32,081 DEBUG [UsersRolesLoginModule] Loaded properties, users=[emil, zane]
21:53:32,081 DEBUG [WebappClassLoader] findResource(defaultRoles.properties)
21:53:32,081 DEBUG [WebappClassLoader] --> Resource not found, returning null
21:53:32,081 DEBUG [WebappClassLoader] findResource(digest-roles.properties)
21:53:32,081 DEBUG [WebappClassLoader] --> Resource not found, returning null
21:53:32,081 DEBUG [WebappClassLoader] getResource(defaultRoles.properties)
21:53:32,081 DEBUG [WebappClassLoader] findResource(defaultRoles.properties)
21:53:32,081 DEBUG [WebappClassLoader] --> Resource not found, returning null
21:53:32,082 DEBUG [WebappClassLoader] --> Resource not found, returning null
21:53:32,082 DEBUG [WebappClassLoader] getResource(digest-roles.properties)
21:53:32,082 DEBUG [WebappClassLoader] --> Resource not found, returning null
21:53:32,083 DEBUG [WebappClassLoader] --> Returning 'file:/usr/jboss/jbossweb-1.0.1.GA/server/pub-srv-001/conf/digest-roles.properties'
21:53:32,083 DEBUG [UsersRolesLoginModule] Loaded properties, users=[emil, zane]
21:53:32,084 DEBUG [WebappClassLoader] loadClass(org.jboss.security.auth.spi.RFC2617Digest, false)
21:53:32,084 DEBUG [WebappClassLoader] Searching local repositories
21:53:32,084 DEBUG [WebappClassLoader] findClass(org.jboss.security.auth.spi.RFC2617Digest)
21:53:32,084 DEBUG [WebappClassLoader] Delegating to parent classloader at end: java.net.FactoryURLClassLoader@1144ba2
21:53:32,086 DEBUG [WebappClassLoader] Loading class from parent
21:53:32,111 DEBUG [AuthenticatorBase] Authenticated 'emil' with type 'DIGEST'
21:53:32,111 DEBUG [AuthenticatorBase] Calling accessControl()
21:53:32,111 DEBUG [RealmBase] Username emil has role gameadmin
21:53:32,111 DEBUG [AuthenticatorBase] Successfully passed all security constraints
21:53:32,123 DEBUG [WebappClassLoader] loadClass(org.apache.log4j.Level, false)
21:53:32,123 DEBUG [WebappClassLoader] Searching local repositories
21:53:32,123 DEBUG [WebappClassLoader] findClass(org.apache.log4j.Level)
21:53:32,124 DEBUG [WebappClassLoader] Delegating to parent classloader at end: java.net.FactoryURLClassLoader@1144ba2
21:53:32,124 DEBUG [WebappClassLoader] Loading class from parent
21:53:32,124 DEBUG [WebappClassLoader] loadClass(org.apache.log4j.Logger, false)
21:53:32,124 DEBUG [WebappClassLoader] Searching local repositories
21:53:32,124 DEBUG [WebappClassLoader] findClass(org.apache.log4j.Logger)
21:53:32,124 DEBUG [WebappClassLoader] Delegating to parent classloader at end: java.net.FactoryURLClassLoader@1144ba2
21:53:32,124 DEBUG [WebappClassLoader] Loading class from parent
21:53:32,124 DEBUG [WebappClassLoader] loadClass(org.apache.log4j.Category, false)
21:53:32,124 DEBUG [WebappClassLoader] Searching local repositories
21:53:32,124 DEBUG [WebappClassLoader] findClass(org.apache.log4j.Category)
21:53:32,125 DEBUG [WebappClassLoader] Delegating to parent classloader at end: java.net.FactoryURLClassLoader@1144ba2
21:53:32,125 DEBUG [WebappClassLoader] Loading class from parent
21:53:32,125 DEBUG [WebappClassLoader] loadClass(org.apache.log4j.Priority, false)
21:53:32,125 DEBUG [WebappClassLoader] Searching local repositories
21:53:32,125 DEBUG [WebappClassLoader] findClass(org.apache.log4j.Priority)
21:53:32,125 DEBUG [WebappClassLoader] Delegating to parent classloader at end: java.net.FactoryURLClassLoader@1144ba2
21:53:32,125 DEBUG [WebappClassLoader] Loading class from parent
21:53:32,125 DEBUG [WebappClassLoader] loadClass(org.apache.log4j.Level, false)
21:53:32,125 DEBUG [WebappClassLoader] Searching local repositories
21:53:32,125 DEBUG [WebappClassLoader] findClass(org.apache.log4j.Level)
21:53:32,126 DEBUG [WebappClassLoader] Delegating to parent classloader at end: java.net.FactoryURLClassLoader@1144ba2
21:53:32,126 DEBUG [WebappClassLoader] Loading class from parent
21:53:32,126 DEBUG [WebappClassLoader] loadClass(org.jboss.logging.XLevel, false)
21:53:32,126 DEBUG [WebappClassLoader] Searching local repositories
21:53:32,126 DEBUG [WebappClassLoader] findClass(org.jboss.logging.XLevel)
21:53:32,126 DEBUG [WebappClassLoader] Delegating to parent classloader at end: java.net.FactoryURLClassLoader@1144ba2
21:53:32,126 DEBUG [WebappClassLoader] Loading class from parent
21:53:32,126 DEBUG [WebappClassLoader] loadClass(org.apache.log4j.Logger, false)
21:53:32,126 DEBUG [WebappClassLoader] Searching local repositories
21:53:32,126 DEBUG [WebappClassLoader] findClass(org.apache.log4j.Logger)
21:53:32,127 DEBUG [WebappClassLoader] Delegating to parent classloader at end: java.net.FactoryURLClassLoader@1144ba2
21:53:32,127 DEBUG [WebappClassLoader] Loading class from parent
21:53:32,127 DEBUG [WebappClassLoader] loadClass(org.apache.log4j.Priority, false)
21:53:32,127 DEBUG [WebappClassLoader] Searching local repositories
21:53:32,132 DEBUG [WebappClassLoader] findClass(org.apache.log4j.Priority)
21:53:32,132 DEBUG [WebappClassLoader] Delegating to parent classloader at end: java.net.FactoryURLClassLoader@1144ba2
21:53:32,133 DEBUG [WebappClassLoader] Loading class from parent
#
# An unexpected error has been detected by HotSpot Virtual Machine:
#
# SIGSEGV (0xb) at pc=0xc7b4d75d, pid=31890, tid=3358587808
#
# Java VM: Java HotSpot(TM) Server VM (1.5.0_09-b03 mixed mode)
# Problematic frame:
# C [libphp5.so+0x2e775d] _efree+0x81
#
# An error report file with more information is saved as hs_err_pid31890.log
#
# If you would like to submit a bug report, please visit:
# http://java.sun.com/webapps/bugreport/crash.jsp
#
I would be grateful for any help with this problem. I can reproduce the problem every time. Just to make sure that it is not the PHP code causing the problem I tried to add the same security constraint to a web module that runs osCommerce (all PHP shop application). The result is exactly the same.
Thank you,
Emil