Bug #71045 [Opn]: zend_mm_alloc_small crashes with zend_string_alloc

Edit report at https://bugs.php.net/bug.php?id=71045&edit=1 ID: 71045 User updated by: kak dot serpom dot po dot yaitsam at gmail dot com Reported by: kak dot serpom dot po dot yaitsam at gmail dot com Summary: zend_mm_alloc_small crashes with zend_string_alloc Status: Open Type: Bug Package: *General Issues Operating System: CentOS PHP Version: 7.0.0 Block user comment: N Private report: N New Comment: I managed to compile a reproduction code, but it discloses some parts of our project so I have to hold it until the decision of my employer. I will talk to him tomorrow. Is it possible to share the code with someone competent in private? Previous Comments: ------------------------------------------------------------------------ [2015-12-06 21:41:19] danack@php.net Please can you provide more information about how to reproduce this issue? ------------------------------------------------------------------------ [2015-12-06 20:52:53] kak dot serpom dot po dot yaitsam at gmail dot com Description: ------------ A segmentation fault. Actual result: -------------- Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x7ffff7fe57c0 (LWP 81104)] zend_mm_alloc_small (size=<value optimized out>) at /usr/src/debug/php-7.0.0/Zend/zend_alloc.c:1291 1291 heap->free_slot[bin_num] = p->next_free_slot; Missing separate debuginfos, use: debuginfo-install libidn-1.18-2.el6.x86_64 libssh2-1.4.2-2.el6.x86_64 (gdb) bt #0 zend_mm_alloc_small (size=<value optimized out>) at /usr/src/debug/php-7.0.0/Zend/zend_alloc.c:1291 #1 zend_mm_alloc_heap (size=<value optimized out>) at /usr/src/debug/php-7.0.0/Zend/zend_alloc.c:1358 #2 _emalloc (size=<value optimized out>) at /usr/src/debug/php-7.0.0/Zend/zend_alloc.c:2442 #3 0x00000000005ac391 in zend_string_alloc (zendlval=0x7fffffffa3a0) at /usr/src/debug/php-7.0.0/Zend/zend_string.h:121 #4 zend_string_init (zendlval=0x7fffffffa3a0) at /usr/src/debug/php-7.0.0/Zend/zend_string.h:157 #5 lex_scan (zendlval=0x7fffffffa3a0) at Zend/zend_language_scanner.l:1310 #6 0x00000000005c0701 in zendlex (elem=0x7ffffffface0) at /usr/src/debug/php-7.0.0/Zend/zend_compile.c:1573 #7 0x00000000005a29ea in zendparse () at /usr/src/debug/php-7.0.0/Zend/zend_language_parser.c:4207 #8 0x00000000005a6f0d in compile_file (file_handle=<value optimized out>, type=<value optimized out>) at Zend/zend_language_scanner.l:591 #9 0x00000000005ce772 in dtrace_compile_file (file_handle=0x7fffffffb0c0, type=<value optimized out>) at /usr/src/debug/php-7.0.0/Zend/zend_dtrace.c:50 #10 0x00007fffea6ed72f in phar_compile_file (file_handle=0x7fffffffb0c0, type=2) at /usr/src/debug/php-7.0.0/ext/phar/phar.c:3311 #11 0x00000000005a64ef in compile_filename (type=2, filename=0x7ffff4616930) at Zend/zend_language_scanner.l:647 #12 0x000000000066021a in ZEND_INCLUDE_OR_EVAL_SPEC_CV_HANDLER (execute_data=0x7ffff46168d0) at /usr/src/debug/php-7.0.0/Zend/zend_vm_execute.h:29114 #13 0x000000000061b740 in execute_ex (ex=<value optimized out>) at /usr/src/debug/php-7.0.0/Zend/zend_vm_execute.h:417 #14 0x00000000005ce63e in dtrace_execute_ex (execute_data=0x7ffff46168d0) at /usr/src/debug/php-7.0.0/Zend/zend_dtrace.c:83 #15 0x000000000065317a in ZEND_DO_FCALL_SPEC_HANDLER (execute_data=0x7ffff4616820) at /usr/src/debug/php-7.0.0/Zend/zend_vm_execute.h:800 #16 0x000000000061b740 in execute_ex (ex=<value optimized out>) at /usr/src/debug/php-7.0.0/Zend/zend_vm_execute.h:417 #17 0x00000000005ce63e in dtrace_execute_ex (execute_data=0x7ffff4616820) at /usr/src/debug/php-7.0.0/Zend/zend_dtrace.c:83 #18 0x00000000005d0ce8 in zend_call_function (fci=0x7fffffffb4d0, fci_cache=0x7fffffffb520) at /usr/src/debug/php-7.0.0/Zend/zend_execute_API.c:854 #19 0x00000000005fb0f7 in zend_call_method (object=0x7ffff46a02a8, obj_ce=<value optimized out>, fn_proxy=<value optimized out>, function_name=0x7ffff46cbdd8 "composer\\autoload\\classloader::loadclass\001", function_name_len=<value optimized out>, retval_ptr=0x0, param_count=1, arg1=0x7ffff4616810, arg2=0x0) at /usr/src/debug/php-7.0.0/Zend/zend_interfaces.c:104 #20 0x00000000004ec700 in zif_spl_autoload_call (execute_data=<value optimized out>, return_value=<value optimized out>) at /usr/src/debug/php-7.0.0/ext/spl/php_spl.c:425 #21 0x00000000005ce4f9 in dtrace_execute_internal (execute_data=<value optimized out>, return_value=<value optimized out>) at /usr/src/debug/php-7.0.0/Zend/zend_dtrace.c:107 #22 0x00000000005d1133 in zend_call_function (fci=0x7fffffffb770, fci_cache=0x7fffffffb7c0) at /usr/src/debug/php-7.0.0/Zend/zend_execute_API.c:875 #23 0x00000000005d1410 in zend_lookup_class_ex (name=<value optimized out>, key=0x0, use_autoload=<value optimized out>) at /usr/src/debug/php-7.0.0/Zend/zend_execute_API.c:1036 #24 0x00000000005d1791 in zend_fetch_class (class_name=0x7ffff4719090, fetch_type=512) at /usr/src/debug/php-7.0.0/Zend/zend_execute_API.c:1361 #25 0x000000000062ac75 in ZEND_FETCH_CLASS_SPEC_CV_HANDLER (execute_data=0x7ffff46164b0) at /usr/src/debug/php-7.0.0/Zend/zend_vm_execute.h:2332 #26 0x000000000061b740 in execute_ex (ex=<value optimized out>) at /usr/src/debug/php-7.0.0/Zend/zend_vm_execute.h:417 #27 0x00000000005ce63e in dtrace_execute_ex (execute_data=0x7ffff46164b0) at /usr/src/debug/php-7.0.0/Zend/zend_dtrace.c:83 #28 0x000000000065317a in ZEND_DO_FCALL_SPEC_HANDLER (execute_data=0x7ffff4616210) at /usr/src/debug/php-7.0.0/Zend/zend_vm_execute.h:800 #29 0x000000000061b740 in execute_ex (ex=<value optimized out>) at /usr/src/debug/php-7.0.0/Zend/zend_vm_execute.h:417 #30 0x00000000005ce63e in dtrace_execute_ex (execute_data=0x7ffff4616210) at /usr/src/debug/php-7.0.0/Zend/zend_dtrace.c:83 #31 0x000000000065317a in ZEND_DO_FCALL_SPEC_HANDLER (execute_data=0x7ffff4616170) at /usr/src/debug/php-7.0.0/Zend/zend_vm_execute.h:800 #32 0x000000000061b740 in execute_ex (ex=<value optimized out>) at /usr/src/debug/php-7.0.0/Zend/zend_vm_execute.h:417 #33 0x00000000005ce63e in dtrace_execute_ex (execute_data=0x7ffff4616170) at /usr/src/debug/php-7.0.0/Zend/zend_dtrace.c:83 #34 0x0000000000660a87 in ZEND_INCLUDE_OR_EVAL_SPEC_TMPVAR_HANDLER (execute_data=0x7ffff46160e0) at /usr/src/debug/php-7.0.0/Zend/zend_vm_execute.h:40602 #35 0x000000000061b740 in execute_ex (ex=<value optimized out>) at /usr/src/debug/php-7.0.0/Zend/zend_vm_execute.h:417 ---Type <return> to continue, or q <return> to quit--- ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=71045&edit=1