Bug #75502 [Opn]: Segmentation fault in zend_string_release

Edit report at https://bugs.php.net/bug.php?id=75502&edit=1 ID: 75502 Updated by: nikic@php.net Reported by: cristian dot pop at softwire dot com Summary: Segmentation fault in zend_string_release Status: Open Type: Bug Package: Reproducible crash Operating System: CentOS 7.4 PHP Version: 7.1.11 Block user comment: N Private report: N New Comment: Can you please run your application through valgrind (using "USE_ZEND_ALLOC=0 valgrind php script.php your_args") and post the resulting log? Previous Comments: ------------------------------------------------------------------------ [2017-11-08 15:58:08] cristian dot pop at softwire dot com Description: ------------ I'm getting consistent segmentation fault errors when running a PHP script via CLI, running PHP 7.1.11 (with Zend Framework 1.12.20) and Apache 2.4.6. The script was developed on another box running PHP 5.4, and it still runs without issues on the older version. Unfortunately, I've not been able to come up with a minimal reproducible example, as I couldn't isolate precisely which section of the script is the culprit. Debugging the script in IntelliJ didn't help, as the segfault seems to be thrown during zend_shutdown(). There are multiple, distinct, sections in that script that can be blindly commented out to stop the segfaults from occurring (though rendering the script useless). It might have something to do with the complexity of the script or how much "work" it's doing, but I have other similar scripts that take a long time to complete (up to a minute), and this is the only one throwing a segmentation fault on every run. Running the script with USE_ZEND_ALLOC=0 seems to help (no more segfaults), and (bizarrely) so does setting zfDebug.enabled to TRUE in my application.ini. I'm worried about using these workarounds in a production environment though, as long as I still don't know what the underlying cause is. Here's the gdb backtrace from the core dump generated (I noticed it's somewhat similar to an older bug affecting PHP 7.0.3 https://bugs.php.net/bug.php?id=71662): #0 zend_string_release (s=0x7ff9aa940660) at /usr/src/debug/php-7.1.11/Zend/zend_string.h:270 #1 zend_hash_destroy (ht=0x55ee0879af10) at /usr/src/debug/php-7.1.11/Zend/zend_hash.c:1248 #2 0x00007ff9b90b7e8e in delete_type_persistent (zv=<optimized out>) at /usr/src/debug/php-7.1.11/ext/soap/php_schema.c:2459 #3 0x000055ee06d40bf5 in zend_hash_destroy (ht=0x55ee08777400) at /usr/src/debug/php-7.1.11/Zend/zend_hash.c:1235 #4 0x00007ff9b90bf031 in delete_psdl_int (p=<optimized out>) at /usr/src/debug/php-7.1.11/ext/soap/php_sdl.c:3130 #5 0x00007ff9b90bf09f in delete_psdl (zv=0x55ee08a07a40) at /usr/src/debug/php-7.1.11/ext/soap/php_sdl.c:3150 #6 0x000055ee06d40c96 in zend_hash_destroy (ht=0x55ee0877bbf0) at /usr/src/debug/php-7.1.11/Zend/zend_hash.c:1246 #7 0x00007ff9b908f8c9 in zm_shutdown_soap (type=<optimized out>, module_number=33) at /usr/src/debug/php-7.1.11/ext/soap/soap.c:598 #8 0x000055ee06d35eb7 in module_destructor (module=module@entry=0x55ee0854c760) at /usr/src/debug/php-7.1.11/Zend/zend_API.c:2501 #9 0x000055ee06d2e60c in module_destructor_zval (zv=<optimized out>) at /usr/src/debug/php-7.1.11/Zend/zend.c:633 #10 0x000055ee06d41791 in _zend_hash_del_el_ex (prev=<optimized out>, p=<optimized out>, idx=<optimized out>, ht=<optimized out>) at /usr/src/debug/php-7.1.11/Zend/zend_hash.c:997 #11 _zend_hash_del_el (p=0x55ee0854ec30, idx=32, ht=0x55ee07155420 <module_registry>) at /usr/src/debug/php-7.1.11/Zend/zend_hash.c:1020 #12 zend_hash_graceful_reverse_destroy (ht=ht@entry=0x55ee07155420 <module_registry>) at /usr/src/debug/php-7.1.11/Zend/zend_hash.c:1476 #13 0x000055ee06d342dc in zend_destroy_modules () at /usr/src/debug/php-7.1.11/Zend/zend_API.c:1978 #14 0x000055ee06d2f1f1 in zend_shutdown () at /usr/src/debug/php-7.1.11/Zend/zend.c:876 #15 0x000055ee06ccb1ab in php_module_shutdown () at /usr/src/debug/php-7.1.11/main/main.c:2445 #16 0x000055ee06b5c76c in main (argc=2, argv=0x55ee08542c10) at /usr/src/debug/php-7.1.11/sapi/cli/php_cli.c:1396 ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=75502&edit=1