Bug #74361 [NEW]: Compaction in array_rand() violates COW

From: nikic Operating system: PHP version: 7.1.4RC1 Package: Arrays related Bug Type: Bug Bug description:Compaction in array_rand() violates COW Description: ------------ From http://stackoverflow.com/questions/43162831/zend-mm-heap-corrupted-with-php-7-1. If numUsed occupancy is <= 3/4 array_rand() compacts the array prior to sampling. This is done on a potentially shared array. This may lead to SHM corruption, for example: $array = [1 => 1, 2 => 2]; var_dump(array_rand($array)); Crashes on opcache. It can also have other side effects: <?php $array = range(0, 100); for ($i = 0; $i < 50; $i++) { unset($array[$i]); } foreach ($array as $x) { var_dump($x); if ($x == 55) { array_rand($array, 1); } } Here the array is resized during the loop, leaving a dangling pointer. -- Edit bug report at https://bugs.php.net/bug.php?id=74361&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=74361&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=74361&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=74361&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=74361&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=74361&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=74361&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=74361&r=needscript Try newer version: https://bugs.php.net/fix.php?id=74361&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=74361&r=support Expected behavior: https://bugs.php.net/fix.php?id=74361&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=74361&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=74361&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=74361&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=74361&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=74361&r=dst IIS Stability: https://bugs.php.net/fix.php?id=74361&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=74361&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=74361&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=74361&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=74361&r=mysqlcfg