Bug #68365 [NEW]: zend_mm_heap corrupted (in zend_hash_copy)
From: remi
Operating system: Fedora 20
PHP version: 5.5.18
Package: *General Issues
Bug Type: Bug
Bug description:zend_mm_heap corrupted (in zend_hash_copy)
Description:
------------
In some (hard to reproduce) run conditions, if memory limit is triggered
during zend_hash_copy, zend_mm_heap can be corrupted (and can segfault
during shutdown).
I think the problem occurs in _zend_hash_index_update_or_next_insert,
on
p = (Bucket *) pemalloc_rel(sizeof(Bucket), ht->persistent);
5.6 also affected
Test script:
---------------
<?php
error_reporting(E_ALL);
set_time_limit(5);
ini_set('memory_limit', '256M');
$arrayLarge = array_fill(0, 1010911, '*');
echo "Running 5/50 (get_defined_vars).\n";
$array_get_defined_vars_5 = get_defined_vars();
echo "Running 14/50 (array_merge).\n";
$array_array_merge_14 = array_merge($arrayLarge,
$array_get_defined_vars_5);
echo "Running 30/50 (exec).\n";
$string_exec_30 = exec(false, $arrayLarge);
Expected result:
----------------
Running 5/50 (get_defined_vars).
Running 14/50 (array_merge).
Running 30/50 (exec).
PHP Fatal error: Allowed memory size of 268435456 bytes exhausted
(tried to allocate 72 bytes) in
/home/rcollet/work/0d22753b8b97c56a401d760b9580a08b.php on line 11
zend_mm_heap corrupted
Actual result:
--------------
Running 5/50 (get_defined_vars).
Running 14/50 (array_merge).
Running 30/50 (exec).
PHP Fatal error: Allowed memory size of 268435456 bytes exhausted
(tried to allocate 72 bytes) in
/home/rcollet/work/0d22753b8b97c56a401d760b9580a08b.php on line 11
zend_mm_heap corrupted
--
Edit bug report at https://bugs.php.net/bug.php?id=68365&edit=1
--
Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=68365&r=trysnapshot54
Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=68365&r=trysnapshot55
Try a snapshot (trunk): https://bugs.php.net/fix.php?id=68365&r=trysnapshottrunk
Fixed in SVN: https://bugs.php.net/fix.php?id=68365&r=fixed
Fixed in release: https://bugs.php.net/fix.php?id=68365&r=alreadyfixed
Need backtrace: https://bugs.php.net/fix.php?id=68365&r=needtrace
Need Reproduce Script: https://bugs.php.net/fix.php?id=68365&r=needscript
Try newer version: https://bugs.php.net/fix.php?id=68365&r=oldversion
Not developer issue: https://bugs.php.net/fix.php?id=68365&r=support
Expected behavior: https://bugs.php.net/fix.php?id=68365&r=notwrong
Not enough info: https://bugs.php.net/fix.php?id=68365&r=notenoughinfo
Submitted twice: https://bugs.php.net/fix.php?id=68365&r=submittedtwice
register_globals: https://bugs.php.net/fix.php?id=68365&r=globals
PHP 4 support discontinued: https://bugs.php.net/fix.php?id=68365&r=php4
Daylight Savings: https://bugs.php.net/fix.php?id=68365&r=dst
IIS Stability: https://bugs.php.net/fix.php?id=68365&r=isapi
Install GNU Sed: https://bugs.php.net/fix.php?id=68365&r=gnused
Floating point limitations: https://bugs.php.net/fix.php?id=68365&r=float
No Zend Extensions: https://bugs.php.net/fix.php?id=68365&r=nozend
MySQL Configuration Error: https://bugs.php.net/fix.php?id=68365&r=mysqlcfg
Thread (3 messages)
- remi@php.net