Bug #68276 Reproducible memory corruption: pgsql conflicts with openssl extension

php.internals

Yasuo Ohgaki

10 years ago
Hi openssl module maintainers, This bug https://bugs.php.net/bug.php?id=68276 is categorized as pgsql bug, but it would be more appropriate if categorized as openssl bug. This bug report includes PR https://github.com/php/php-src/pull/1223 and it seems it7s a good one. Could any openssl module maintainer take care of it? Thanks,
-- Yasuo Ohgaki yohgaki@ohgaki.net

David Zuelke

10 years ago
> On 18.01.2016, at 03:03, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote: > > Hi openssl module maintainers, > > This bug https://bugs.php.net/bug.php?id=68276 is categorized > as pgsql bug, but it would be more appropriate if categorized as > openssl bug. > > This bug report includes PR https://github.com/php/php-src/pull/1223 > and it seems it7s a good one. > > Could any openssl module maintainer take care of it?
Hi, I have customers running into this too. I have not yet had time to pick up that patch - AFAICT, it's incomplete (see comments). We are, in parallel, working on getting a fix into libpq, but that's of course just a band-aid, since it can still happen with any other library that also uses openssl functions. The principle approach of that PR ("backing up" the errors from openssl) is good, though. David

Yasuo Ohgaki

10 years ago
Hi David, On Tue, Jan 19, 2016 at 2:31 AM, David Zuelke <dz@heroku.com> wrote:
> > I have customers running into this too. I have not yet had time to pick up that patch - AFAICT, it's incomplete (see comments). > > We are, in parallel, working on getting a fix into libpq, but that's of course just a band-aid, since it can still happen with any other library that also uses openssl functions.
That's what I thought.
> > The principle approach of that PR ("backing up" the errors from openssl) is good, though.
This issue is nasty. I hope you come up with feasible solution soon. BTW, should I change the bug report category to openssl? Regards,
-- Yasuo Ohgaki yohgaki@ohgaki.net

David Zuelke

10 years ago
On 19.01.2016, at 02:36, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
> > Hi David, > > On Tue, Jan 19, 2016 at 2:31 AM, David Zuelke <dz@heroku.com> wrote: >> >> I have customers running into this too. I have not yet had time to pick up that patch - AFAICT, it's incomplete (see comments). >> >> We are, in parallel, working on getting a fix into libpq, but that's of course just a band-aid, since it can still happen with any other library that also uses openssl functions. > > That's what I thought. > >> >> The principle approach of that PR ("backing up" the errors from openssl) is good, though. > > This issue is nasty. I hope you come up with feasible solution soon.
The libpq fix is in the works and not that complex. It's more a question of when it would get released (Postgres doesn't do regular release intervals). The PHP side of it is more work, and genuinely not pretty, but it's not like there's an alternative approach to fix it, so we'll have to live with it. What I am currently struggling with is a way to reproduce this for the tests... once libpq is fixed, the problem can't be triggered anymore.
> BTW, should I change the bug report category to openssl?
Yeah it's an ext-openssl "problem" (one could also argue the fault is with OpenSSL, but meh). David

Yasuo Ohgaki

10 years ago
Hi David, On Tue, Jan 19, 2016 at 11:13 AM, David Zuelke <dz@heroku.com> wrote:
> >> BTW, should I change the bug report category to openssl? > > Yeah it's an ext-openssl "problem" (one could also argue the fault is with OpenSSL, but meh).
Thanks. Done. If you need some help for pgsql, I'll. Regards,
-- Yasuo Ohgaki yohgaki@ohgaki.net