Bug #75502 [NEW]: Segmentation fault in zend_string_release

From: cristian dot pop at softwire dot com Operating system: CentOS 7.4 PHP version: 7.1.11 Package: Reproducible crash Bug Type: Bug Bug description:Segmentation fault in zend_string_release Description: ------------ I'm getting consistent segmentation fault errors when running a PHP script via CLI, running PHP 7.1.11 (with Zend Framework 1.12.20) and Apache 2.4.6. The script was developed on another box running PHP 5.4, and it still runs without issues on the older version. Unfortunately, I've not been able to come up with a minimal reproducible example, as I couldn't isolate precisely which section of the script is the culprit. Debugging the script in IntelliJ didn't help, as the segfault seems to be thrown during zend_shutdown(). There are multiple, distinct, sections in that script that can be blindly commented out to stop the segfaults from occurring (though rendering the script useless). It might have something to do with the complexity of the script or how much "work" it's doing, but I have other similar scripts that take a long time to complete (up to a minute), and this is the only one throwing a segmentation fault on every run. Running the script with USE_ZEND_ALLOC=0 seems to help (no more segfaults), and (bizarrely) so does setting zfDebug.enabled to TRUE in my application.ini. I'm worried about using these workarounds in a production environment though, as long as I still don't know what the underlying cause is. Here's the gdb backtrace from the core dump generated (I noticed it's somewhat similar to an older bug affecting PHP 7.0.3 https://bugs.php.net/bug.php?id=71662): #0 zend_string_release (s=0x7ff9aa940660) at /usr/src/debug/php-7.1.11/Zend/zend_string.h:270 #1 zend_hash_destroy (ht=0x55ee0879af10) at /usr/src/debug/php-7.1.11/Zend/zend_hash.c:1248 #2 0x00007ff9b90b7e8e in delete_type_persistent (zv=<optimized out>) at /usr/src/debug/php-7.1.11/ext/soap/php_schema.c:2459 #3 0x000055ee06d40bf5 in zend_hash_destroy (ht=0x55ee08777400) at /usr/src/debug/php-7.1.11/Zend/zend_hash.c:1235 #4 0x00007ff9b90bf031 in delete_psdl_int (p=<optimized out>) at /usr/src/debug/php-7.1.11/ext/soap/php_sdl.c:3130 #5 0x00007ff9b90bf09f in delete_psdl (zv=0x55ee08a07a40) at /usr/src/debug/php-7.1.11/ext/soap/php_sdl.c:3150 #6 0x000055ee06d40c96 in zend_hash_destroy (ht=0x55ee0877bbf0) at /usr/src/debug/php-7.1.11/Zend/zend_hash.c:1246 #7 0x00007ff9b908f8c9 in zm_shutdown_soap (type=<optimized out>, module_number=33) at /usr/src/debug/php-7.1.11/ext/soap/soap.c:598 #8 0x000055ee06d35eb7 in module_destructor (module=module@entry=0x55ee0854c760) at /usr/src/debug/php-7.1.11/Zend/zend_API.c:2501 #9 0x000055ee06d2e60c in module_destructor_zval (zv=<optimized out>) at /usr/src/debug/php-7.1.11/Zend/zend.c:633 #10 0x000055ee06d41791 in _zend_hash_del_el_ex (prev=<optimized out>, p=<optimized out>, idx=<optimized out>, ht=<optimized out>) at /usr/src/debug/php-7.1.11/Zend/zend_hash.c:997 #11 _zend_hash_del_el (p=0x55ee0854ec30, idx=32, ht=0x55ee07155420 <module_registry>) at /usr/src/debug/php-7.1.11/Zend/zend_hash.c:1020 #12 zend_hash_graceful_reverse_destroy (ht=ht@entry=0x55ee07155420 <module_registry>) at /usr/src/debug/php-7.1.11/Zend/zend_hash.c:1476 #13 0x000055ee06d342dc in zend_destroy_modules () at /usr/src/debug/php-7.1.11/Zend/zend_API.c:1978 #14 0x000055ee06d2f1f1 in zend_shutdown () at /usr/src/debug/php-7.1.11/Zend/zend.c:876 #15 0x000055ee06ccb1ab in php_module_shutdown () at /usr/src/debug/php-7.1.11/main/main.c:2445 #16 0x000055ee06b5c76c in main (argc=2, argv=0x55ee08542c10) at /usr/src/debug/php-7.1.11/sapi/cli/php_cli.c:1396 -- Edit bug report at https://bugs.php.net/bug.php?id=75502&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=75502&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=75502&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=75502&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=75502&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=75502&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=75502&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=75502&r=needscript Try newer version: https://bugs.php.net/fix.php?id=75502&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=75502&r=support Expected behavior: https://bugs.php.net/fix.php?id=75502&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=75502&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=75502&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=75502&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=75502&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=75502&r=dst IIS Stability: https://bugs.php.net/fix.php?id=75502&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=75502&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=75502&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=75502&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=75502&r=mysqlcfg