Bug #71815 [NEW]: Segfault after 65536 empty array references
From: mihor dot cz at gmail dot com
Operating system: CentOS 7.2.1511
PHP version: 7.0.4
Package: Reproducible crash
Bug Type: Bug
Bug description:Segfault after 65536 empty array references
Description:
------------
Hello PHP team,
I managed to pin-point one problem with PHP 7.0.4 (But I think that this
problem is at least from 7.0.0)
I don't think that there is more to explain than simple code below.
Originally I found this problem in our large PHP code and it disappeared
every time I turned off Opcache, but after pin-pointing and extracting
problem into code below: Opcache is no longer needed to segfault (so I
guess that opcache is maybe little more sensitive to this kind of bad
PHP code abuse)
My system spec:
PHP version: 7.0.4
OS: CentOS 7.2.1511
RAM: 128 GB
CPU: 2 x Intel(R) Xeon(R) CPU E5-2667 v3 @ 3.20GHz
PHP config:
Memory limit: 16 GB
Test script:
---------------
<?php
$desc = array();
for ($i = 65535; $i > 0; $i--)
{
$desc[$i] = &$desc[$i - 1];
}
echo "still ok\n";
$desc = array();
for ($i = 65536; $i > 0; $i--)
{
$desc[$i] = &$desc[$i - 1];
}
echo "not ok";
Expected result:
----------------
still ok
not ok
Actual result:
--------------
still ok
Segmentation fault
--
Edit bug report at https://bugs.php.net/bug.php?id=71815&edit=1
--
Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=71815&r=trysnapshot54
Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=71815&r=trysnapshot55
Try a snapshot (trunk): https://bugs.php.net/fix.php?id=71815&r=trysnapshottrunk
Fixed in SVN: https://bugs.php.net/fix.php?id=71815&r=fixed
Fixed in release: https://bugs.php.net/fix.php?id=71815&r=alreadyfixed
Need backtrace: https://bugs.php.net/fix.php?id=71815&r=needtrace
Need Reproduce Script: https://bugs.php.net/fix.php?id=71815&r=needscript
Try newer version: https://bugs.php.net/fix.php?id=71815&r=oldversion
Not developer issue: https://bugs.php.net/fix.php?id=71815&r=support
Expected behavior: https://bugs.php.net/fix.php?id=71815&r=notwrong
Not enough info: https://bugs.php.net/fix.php?id=71815&r=notenoughinfo
Submitted twice: https://bugs.php.net/fix.php?id=71815&r=submittedtwice
register_globals: https://bugs.php.net/fix.php?id=71815&r=globals
PHP 4 support discontinued: https://bugs.php.net/fix.php?id=71815&r=php4
Daylight Savings: https://bugs.php.net/fix.php?id=71815&r=dst
IIS Stability: https://bugs.php.net/fix.php?id=71815&r=isapi
Install GNU Sed: https://bugs.php.net/fix.php?id=71815&r=gnused
Floating point limitations: https://bugs.php.net/fix.php?id=71815&r=float
No Zend Extensions: https://bugs.php.net/fix.php?id=71815&r=nozend
MySQL Configuration Error: https://bugs.php.net/fix.php?id=71815&r=mysqlcfg
Thread (2 messages)
- mihor dot cz at gmail dot com