Bug #76405 [NEW]: Process lsphp-7.1 of user killed by SIGSEGV

From: alexey at nsk21 dot ru Operating system: CentOS Linux release 7.5.1804 (C PHP version: 7.1.18 Package: CGI/CLI related Bug Type: Bug Bug description:Process lsphp-7.1 of user killed by SIGSEGV Description: ------------ PHP crashes randomly during running WordPress crontask: reason: lsphp-7.1 killed by SIGSEGV cmdline: lsphp5: ..skipped.. ./wp-cron.php PHP 7.1.18 (cli) (built: May 31 2018 17:47:26) ( NTS ) Copyright (c) 1997-2018 The PHP Group Zend Engine v3.1.0, Copyright (c) 1998-2018 Zend Technologies with the ionCube PHP Loader (enabled) + Intrusion Protection from ioncube24.com (unconfigured) v10.2.1, Copyright (c) 2002-2018, by ionCube Ltd. with Zend OPcache v7.1.18, Copyright (c) 1999-2018, by Zend Technologies Test script: --------------- It's a regular WordPress wp-cron.php file. Expected result: ---------------- Crontask complete without crash. Actual result: -------------- Program terminated with signal 11, Segmentation fault. #0 0x00007fa300df3c60 in ?? () (gdb) bt #0 0x00007fa300df3c60 in ?? () #1 0x00007ffd9c11a310 in ?? () #2 0x000000000076ce58 in process_nested_data (rval=<optimized out>, objprops=0, elements=140727221855168, ht=0x7ffd9c11a420, var_hash=0x7fa2d61fffff, max=0x7fa300e1d000 "", p=0x7fa2d6dc85a6) at /usr/local/directadmin/custombuild/php-7.1.18/ext/standard/var_unserializer.c:376 #3 php_var_unserialize_internal (rval=<optimized out>, p=0x7fa2d6dc85a6, max=0x7fa300e1d000 "", var_hash=0x7fa2d61fffff) at /usr/local/directadmin/custombuild/php-7.1.18/ext/standard/var_unserializer.c:1330 #4 0x00002000f7a755ac in ?? () #5 0x0000010e00000022 in ?? () #6 0x00007fa2d6dc8498 in ?? () #7 0x0000000003437300 in ?? () #8 0x00000000032064d0 in ?? () #9 0x0000000003091520 in ?? () #10 0x00007fa2d6dc84ba in ?? () #11 0x00007fa2d6dc8498 in ?? () #12 0x00007fa2d6dc85a6 in ?? () #13 0x00007ffd9c11a6c0 in ?? () #14 0x00000000008acd8f in zend_verify_arg_type (cache_slot=<optimized out>, default_value=0x0, arg=<optimized out>, arg_num=16, zf=0x7fa200000000) at /usr/local/directadmin/custombuild/php-7.1.18/Zend/zend_execute.c:958 #15 ZEND_RECV_SPEC_HANDLER () at /usr/local/directadmin/custombuild/php-7.1.18/Zend/zend_vm_execute.h:1470 #16 0x00007ffd9c11a6c0 in ?? () #17 0x0000000000000004 in ?? () #18 0x00002000f7a1a350 in ?? () #19 0x0000010e00000022 in ?? () #20 0x00007fa2d6dc8498 in ?? () #21 0x000000000323d7c0 in ?? () #22 0x00000000032064d0 in ?? () #23 0x00007fa2f7a1a190 in ?? () #24 0x000000000074bee8 in php_strspn (s1=0x7ffd9c11a3c0 " \025\t\003", s2=0x7fa300e15008 "\034Q\247\367\242\177", s1_end=0x10 <Address 0x10 out of bounds>, s2_end=0xffffffffff46fbf7 <Address 0xffffffffff46fbf7 out of bounds>) at /usr/local/directadmin/custombuild/php-7.1.18/ext/standard/string.c:1757 #25 0x00007fa2f7a1a190 in ?? () #26 0x00007fa2d7f5dd20 in ?? () #27 0x00007ffd9c11a660 in ?? () #28 0x000000000085af5b in ZEND_ADD_ARRAY_ELEMENT_SPEC_TMP_CONST_HANDLER () at /usr/local/directadmin/custombuild/php-7.1.18/Zend/zend_vm_execute.h:13752 #29 0x00007fa2d6d9bbc0 in ?? () #30 0x00007fa2d6d9bba0 in ?? () #31 0x000000000082630e in _zend_hash_del_el_ex (prev=0x2000, p=0x1377, idx=14766088, ht=0x7ffd9c11a400) at /usr/local/directadmin/custombuild/php-7.1.18/Zend/zend_hash.c:969 #32 zend_hash_str_del_ind (ht=0x7ffd9c11a400, str=0x7fa2000f4240 <Address 0x7fa2000f4240 out of bounds>, len=140338040721974) at /usr/local/directadmin/custombuild/php-7.1.18/Zend/zend_hash.c:1144 #33 0x00007fa2f783edf3 in ?? () #34 0x000000019c11a870 in ?? () #35 0x0000000000000000 in ?? () (gdb) (gdb) (gdb) frame 2 #2 0x000000000076ce58 in process_nested_data (rval=<optimized out>, objprops=0, elements=140727221855168, ht=0x7ffd9c11a420, var_hash=0x7fa2d61fffff, max=0x7fa300e1d000 "", p=0x7fa2d6dc85a6) at /usr/local/directadmin/custombuild/php-7.1.18/ext/standard/var_unserializer.c:376 376 while (elements-- > 0) { (gdb) (gdb) frame 3 #3 php_var_unserialize_internal (rval=<optimized out>, p=0x7fa2d6dc85a6, max=0x7fa300e1d000 "", var_hash=0x7fa2d61fffff) at /usr/local/directadmin/custombuild/php-7.1.18/ext/standard/var_unserializer.c:1330 1330 if (!process_nested_data(UNSERIALIZE_PASSTHRU, Z_ARRVAL_P(rval), elements, 0)) { (gdb) (gdb) frame 14 #14 0x00000000008acd8f in zend_verify_arg_type (cache_slot=<optimized out>, default_value=0x0, arg=<optimized out>, arg_num=16, zf=0x7fa200000000) at /usr/local/directadmin/custombuild/php-7.1.18/Zend/zend_execute.c:958 958 if (UNEXPECTED(!zend_check_type(zf, cur_arg_info, arg, &ce, cache_slot, default_value, 0))) { (gdb) (gdb) frame 24 #24 0x000000000074bee8 in php_strspn (s1=0x7ffd9c11a3c0 " \025\t\003", s2=0x7fa300e15008 "\034Q\247\367\242\177", s1_end=0x10 <Address 0x10 out of bounds>, s2_end=0xffffffffff46fbf7 <Address 0xffffffffff46fbf7 out of bounds>) at /usr/local/directadmin/custombuild/php-7.1.18/ext/standard/string.c:1757 1757 for (spanp = s2; p != s1_end && spanp != s2_end;) { (gdb) frame 28 #28 0x000000000085af5b in ZEND_ADD_ARRAY_ELEMENT_SPEC_TMP_CONST_HANDLER () at /usr/local/directadmin/custombuild/php-7.1.18/Zend/zend_vm_execute.h:13752 13752 } else if (Z_TYPE_P(offset) == IS_TRUE) { (gdb) (gdb) frame 30 #30 0x00007fa2d6d9bba0 in ?? () (gdb) (gdb) frame 31 #31 0x000000000082630e in _zend_hash_del_el_ex (prev=0x2000, p=0x1377, idx=14766088, ht=0x7ffd9c11a400) at /usr/local/directadmin/custombuild/php-7.1.18/Zend/zend_hash.c:969 969 } while (ht->nNumUsed > 0 && (UNEXPECTED(Z_TYPE(ht->arData[ht->nNumUsed-1].val) == IS_UNDEF))); (gdb) (gdb) frame 32 #32 zend_hash_str_del_ind (ht=0x7ffd9c11a400, str=0x7fa2000f4240 <Address 0x7fa2000f4240 out of bounds>, len=140338040721974) at /usr/local/directadmin/custombuild/php-7.1.18/Zend/zend_hash.c:1144 1144 _zend_hash_del_el_ex(ht, idx, p, prev); (gdb) q -- Edit bug report at https://bugs.php.net/bug.php?id=76405&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=76405&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=76405&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=76405&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=76405&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=76405&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=76405&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=76405&r=needscript Try newer version: https://bugs.php.net/fix.php?id=76405&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=76405&r=support Expected behavior: https://bugs.php.net/fix.php?id=76405&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=76405&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=76405&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=76405&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=76405&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=76405&r=dst IIS Stability: https://bugs.php.net/fix.php?id=76405&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=76405&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=76405&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=76405&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=76405&r=mysqlcfg