Bug#907682: lighttpd: segfault / error 4; primarily when accessing fastcgi/php

[Jon Daley <debian@jon.limedaley.com>]

Package: lighttpd
Version: 1.4.49-1.1
Severity: important

I upgraded today:
[UPGRADE] lighttpd:amd64 1.4.45-1 -> 1.4.49-1.1
[UPGRADE] lighttpd-mod-magnet:amd64 1.4.45-1 -> 1.4.49-1.1

and now I get a segfault within 30 seconds of startup.  When I run lighttpd via 
"strace lighttpd -D -f ..." it appears to crash when accessing php via fastcgi,
though I think it can access simple PHP scripts without crashing, so perhaps it
is on the php side, though when I downgrade back to 1.4.45, everything is fine.

The exact error message is (one per server instantiation):
Aug 31 05:22:22 tangelo kernel: [10595636.459818] lighttpd[8657]: segfault at b0 ip 000055a286a8919a sp 00007ffdee39f000 error 4 in lighttpd[55a286a64000+46000]
Aug 31 05:23:27 tangelo kernel: [10595701.465898] lighttpd[8868]: segfault at b0 ip 0000563eb738819a sp 00007ffc7b968290 error 4 in lighttpd[563eb7363000+46000]
Aug 31 05:27:19 tangelo kernel: [10595932.776978] lighttpd[9176]: segfault at b0 ip 000055c975b0619a sp 00007ffef9652fe0 error 4 in lighttpd[55c975ae1000+46000]
Aug 31 05:34:10 tangelo kernel: [10596343.912608] lighttpd[10534]: segfault at b0 ip 0000556ff121c19a sp 00007ffd94a20570 error 4 in lighttpd[556ff11f7000+46000]

The access is not logged in /var/log/lighttpd/, and no errors reported there, just the segfault in /var/log/messages.

Any ideas about where I should look?

I'm using PHP 5.6.22-2 (cgi-fcgi), so perhaps that just isn't supported any more.


-- System Information:
Debian Release: buster/sid
  APT prefers testing
  APT policy: (500, 'testing')
Architecture: amd64 (x86_64)

Kernel: Linux 4.13.0-1-amd64 (SMP w/12 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: sysvinit (via /sbin/init)

Versions of packages lighttpd depends on:
ii  init-system-helpers  1.54
ii  libattr1             1:2.4.47-2+b2
ii  libbz2-1.0           1.0.6-9
ii  libc6                2.27-5
ii  libgamin0 [libfam0]  0.1.10-5+b1
ii  libpcre3             2:8.39-11
ii  libssl1.1            1.1.0h-4
ii  lsb-base             9.20170808
ii  mime-support         3.61
ii  zlib1g               1:1.2.11.dfsg-1

Versions of packages lighttpd recommends:
ii  spawn-fcgi  1.6.4-2

Versions of packages lighttpd suggests:
pn  apache2-utils  <none>
pn  lighttpd-doc   <none>
ii  openssl        1.1.0h-4
ii  php5-cgi       5.6.22+dfsg-2
pn  rrdtool        <none>

-- Configuration Files:
/etc/lighttpd/conf-available/10-accesslog.conf changed:
server.modules += ( "mod_accesslog" )

/etc/lighttpd/conf-available/10-cgi.conf changed:
server.modules += ( "mod_cgi" )
$HTTP["url"] =~ "^/cgi-bin/" {
	cgi.assign = ( ".cgi" => "" )
}

/etc/lighttpd/conf-available/10-evasive.conf changed:
server.modules += ( "mod_evasive" )
evasive.max-conns-per-ip = 150

/etc/lighttpd/conf-available/10-fastcgi.conf changed:
server.modules += ( "mod_fastcgi" )
fastcgi.server    = ( ".php" => 
	((
		"bin-path" => "/usr/bin/php-cgi",
		"socket" => "/tmp/php.socket",
		"max-procs" => 5,
		"idle-timeout" => 5,
		"bin-environment" => ( 
			"PHP_FCGI_CHILDREN" => "30",
			"PHP_FCGI_MAX_REQUESTS" => "500"
		),
		"bin-copy-environment" => (
			"PATH", "SHELL", "USER"
		),
		"broken-scriptfilename" => "enable"
	))
)

/etc/lighttpd/lighttpd.conf changed:
server.modules = (
	"mod_access",
	"mod_alias",
	"mod_compress",
	"mod_rewrite",
	"mod_redirect",
    "mod_expire",
)
include_shell "/usr/share/lighttpd/include-conf-enabled.pl"
server.max-keep-alive-requests = 32
server.max-keep-alive-idle = 5
server.max-read-idle = 30
server.max-write-idle = 30
server.max-fds = 2048
server.max-connections = 1024
server.event-handler = "linux-sysepoll"
server.network-backend = "linux-sendfile"
server.stat-cache-engine = "fam"


-- no debconf information