SIGSEGV when using with ionCube and Octane with RoadRunner

[pushpesh-cometchat]

Describe your environment
Container built via a Dockerfile

FROM php:8.4-cli AS encoder

ENV DEBIAN_FRONTEND=noninteractive

RUN dpkg --add-architecture i386 \
    && apt-get update -y && apt-get install -y \
    curl \
    unzip \
    git \
    zip \
    libc6:i386 \
    libstdc++6:i386 \
    zlib1g:i386 \
    && apt-get clean && rm -rf /var/lib/apt/lists/*

RUN curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer

WORKDIR /var/www

RUN git config --global --add safe.directory /var/www

COPY . .

RUN composer install --no-dev --no-interaction --optimize-autoloader --ignore-platform-reqs

RUN curl -fsSL "https://s3.us-east-1.amazonaws.com/downloads3.ioncube.com/eval_download_packages/ioncube_encoder/linux_i686/en/ioncube_encoder_evaluation.tar.gz" \
    -o /tmp/encoder.tar.gz \
    && tar -xzf /tmp/encoder.tar.gz -C /opt \
    && rm /tmp/encoder.tar.gz

RUN mv /var/www/vendor /tmp/vendor

RUN /opt/ioncube_encoder_evaluation/ioncube_encoder.sh -C -x86-64 -84 \
    --allow-reflection-all \
    --copy "*.blade.php" \
    --copy "*.json" \
    --copy "*.yaml" \
    --copy "*.yml" \
    --copy "*.xml" \
    --copy "*.txt" \
    --copy "*.md" \
    --copy "*.lock" \
    --copy "*.js" \
    --copy "*.css" \
    --copy "*.html" \
    --copy "*.env*" \
    --copy "*.pem" \
    --ignore "ioncube_encoder*" \
    #--ignore "tests/" \
    #--ignore "Tests/" \
    /var/www/ -o /tmp/encoded; \
    EXIT_CODE=$?; \
    if [ $EXIT_CODE -ne 0 ] && [ $EXIT_CODE -ne 8 ]; then exit $EXIT_CODE; fi


FROM php:8.4-cli

ENV DEBIAN_FRONTEND=noninteractive

RUN apt-get update -y && apt-get install -y \
    build-essential \
    curl \
    unzip \
    git \
    zip \
    librdkafka-dev \
    pkg-config \
    libargon2-dev \
    libcurl4-openssl-dev \
    libedit-dev \
    libsodium-dev \
    libsqlite3-dev \
    libssl-dev \
    libxml2-dev \
    zlib1g-dev \
    libffi-dev \
    libxslt1-dev \
    libzip-dev \
    libpng-dev \
    libfreetype6-dev \
    libjpeg-dev \
    libonig-dev \
    && docker-php-ext-configure gd --with-freetype --with-jpeg \
    && docker-php-ext-install \
        pdo_mysql \
        mysqli \
        bcmath \
        pcntl \
        sockets \
        gd \
        zip \
        exif \
        opcache \
    && apt-get clean \
    && rm -rf /var/lib/apt/lists/*

RUN curl -fsSL https://downloads.ioncube.com/loader_downloads/ioncube_loaders_lin_x86-64.tar.gz -o /tmp/ioncube.tar.gz \
    && tar -xzf /tmp/ioncube.tar.gz -C /tmp \
    && cp /tmp/ioncube/ioncube_loader_lin_8.4.so "$(php -r 'echo ini_get("extension_dir");')" \
    && echo "zend_extension=ioncube_loader_lin_8.4.so" > /usr/local/etc/php/conf.d/00-ioncube.ini \
    && rm -rf /tmp/ioncube /tmp/ioncube.tar.gz

RUN pecl install rdkafka && docker-php-ext-enable rdkafka
RUN pecl install redis && docker-php-ext-enable redis
RUN apt-get update && apt-get install -y --no-install-recommends $PHPIZE_DEPS \
    && pecl install opentelemetry && docker-php-ext-enable opentelemetry \
    && rm -rf /var/lib/apt/lists/*
RUN php -m | grep -qix opentelemetry || { echo "!!! opentelemetry extension FAILED TO LOAD"; exit 1; }

RUN echo "memory_limit=4096M" > /usr/local/etc/php/conf.d/memory.ini \
    && echo "max_execution_time=600" >> /usr/local/etc/php/conf.d/memory.ini \
    && echo "opcache.enable=1" > /usr/local/etc/php/conf.d/opcache.ini \
    && echo "opcache.memory_consumption=256" >> /usr/local/etc/php/conf.d/opcache.ini \
    && echo "opcache.max_accelerated_files=20000" >> /usr/local/etc/php/conf.d/opcache.ini

RUN curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer

WORKDIR /var/www

COPY --from=encoder /tmp/encoded /var/www

COPY --from=encoder /tmp/vendor /var/www/vendor

RUN php vendor/bin/rr get-binary --location /usr/local/bin 2>/dev/null || \
    (curl -sSL https://github.com/roadrunner-server/roadrunner/releases/download/v2024.3.5/roadrunner-2024.3.5-linux-amd64.tar.gz -o /tmp/rr.tar.gz && \
     tar xzf /tmp/rr.tar.gz -C /usr/local/bin --strip-components=1 && \
     rm /tmp/rr.tar.gz) || \
    echo "RoadRunner will be downloaded at runtime"

RUN chmod -R 777 storage bootstrap/cache 2>/dev/null || true
RUN chmod 644 /var/www/public.pem /var/www/private.pem 2>/dev/null || true
RUN chmod 644 /var/www/fat-public-key.pem /var/www/fat-private-key.pem 2>/dev/null || true

EXPOSE 8000

# Start Laravel Octane with RoadRunner
CMD ["php", "artisan", "octane:start", "--server=roadrunner", "--host=0.0.0.0", "--port=8000", "--workers=4", "--max-requests=1000"]

Steps to reproduce

• Encode a test.php(content as simple as possible e.g. <?php echo 'test';) file via ionCube (https://www.ioncube.com/ choose PHP8+)
• Place the encoded php content as test.php next to the Dockerfile
• Build the Dockerfile with: docker build -f Dockerfile -t otel-debug-local .
• Run the container with docker run --rm -it --entrypoint /bin/sh otel-debug-local

What is the expected behavior?
An output which says test

What is the actual behavior?
An error which says Segmentation fault / SIGSEGV

Additional context
Environment

• PHP 8.4.22 (NTS, non-debug, api 20240924), x86_64, Debian (official php:8.4-cli)
• ionCube Loader 15.5.0 (zend_extension, loaded first via 00-ioncube.ini)
• opentelemetry extension 1.2.1 (also reproduced with 1.1.0) — any ext registering a Zend observer
• Laravel 12, using Octane served via RoadRunner as seen in the Dockerfile above.

Using these OpenTelemetry packages:

"open-telemetry/detector-container": "^1.3",
"open-telemetry/exporter-otlp": "^1.0",
"open-telemetry/gen-otlp-protobuf": "^1.0",
"open-telemetry/opentelemetry-auto-curl": "^0.2.0",
"open-telemetry/opentelemetry-auto-ext-rdkafka": "^0.0",
"open-telemetry/opentelemetry-auto-guzzle": "^1.0",
"open-telemetry/opentelemetry-auto-http-async": "^1.2",
"open-telemetry/opentelemetry-auto-io": "^0.2.0",
"open-telemetry/opentelemetry-auto-laravel": "^1.0",
"open-telemetry/opentelemetry-auto-pdo": "^0.4",
"open-telemetry/opentelemetry-auto-psr18": "^1.2",
"open-telemetry/opentelemetry-logger-monolog": "^1.2",
"open-telemetry/sdk": "^1.0",

[intuibase]

Hi @pushpesh-cometchat

Could you include encoded file?

[pushpesh-cometchat]

@intuibase This came we tried to use ioncube encoder along with opentelemetry. Docker build was failing so there was no final output from where I can show a file.

[pushpesh-cometchat]

@intuibase

Title: SIGSEGV in zend_observer_fcall_begin_prechecked from ionCube internal_execute_ex
       — Loader 15.5.0 incompatible with the Zend Observer API (OpenTelemetry) on encoded code

Environment

• PHP 8.4.22 (NTS, non-debug, api 20240924), x86_64, Debian (official php:8.4-cli)
• ionCube Loader 15.5.0 (zend_extension, loaded first via 00-ioncube.ini)
• opentelemetry extension 1.2.1 (also reproduced with 1.1.0) — any ext registering a Zend observer

Summary
With ionCube Loader + the OpenTelemetry extension both loaded, executing ionCube-ENCODED
code segfaults. Unencoded code runs fine. Crash is independent of the OpenTelemetry SDK
(OTEL_PHP_AUTOLOAD_ENABLED=false still crashes), so it is the registered Zend observer
interacting with ionCube's VM, not the instrumentation layer.

Backtrace (gdb)
  #0 zend_observer_fcall_begin_prechecked ()                         [PHP core]
  #1 ?? () from ioncube_loader_lin_8.4.so
  #2 internal_execute_ex () from ioncube_loader_lin_8.4.so           [ionCube execute_ex override]
  #6 execute_ex ()
  #9 zend_execute ()  #10 zend_execute_script ()  #11 php_execute_script_ex ()

Faulting instruction
  zend_observer_fcall_begin_prechecked+145:  call *(%rbx)   ; indirect call thru observer handler
  registers: rsi=0x0, rdx=0x9f6a4af997757570 (non-canonical / uninitialized)

Analysis
zend_observer_fcall_begin_prechecked invokes the per-function observer handler list stored in
the function's run-time cache (ZEND_OBSERVER_DATA). ionCube's internal_execute_ex runs encoded
functions without initializing/maintaining that observer run-time cache, so the handler pointer
is garbage and the indirect call faults.

Reproduce

1. php:8.4-cli + ionCube Loader 15.5.0 + pecl install opentelemetry
2. Encode any code with the ionCube Encoder (e.g. a Laravel app: app/ config/ bootstrap/ routes/)
3. Run encoded code with both loaded: php artisan --version  → SIGSEGV
4. Remove opentelemetry.so OR run unencoded code → no crash

Ruled out

• Load order (ionCube first) · OpenTelemetry SDK (autoload off still crashes) · opcache (off, crashes)
• ext version (1.1.0 + 1.2.1) · RoadRunner/Octane (plain CLI crashes too)

Request
ionCube's execute_ex override should support the Zend Observer API (initialize the observer
run-time cache for encoded functions), or document the incompatibility. The Observer API is
used by OpenTelemetry, Datadog, Tideways, etc.

[intuibase]

@pushpesh-cometchat

To carry out any further analysis, I need an encoded test file. We do not have an account or credits there, so we are unable to create such a file ourselves.

However, based on the analysis so far, the issue most likely lies with ionCube. Therefore, a bug report or support request should be submitted directly to their team.

[brettmc]

FYI this has been raised previously in #1159 - there are some more details there, including feedback from an ioncube dev/support rep