Bug #77497 [NEW]: Segfault with H2 server push and timeout

From: tobias dot nyholm at gmail dot com Operating system: Alpine PHP version: 7.3Git-2019-01-21 (Git) Package: cURL related Bug Type: Bug Bug description:Segfault with H2 server push and timeout Description: ------------ Follow up from https://bugs.php.net/bug.php?id=76675 When I use cUrl h2 push functionality and timeouts I get a crash. Test script: --------------- <?php $transfers = 1; $callback = function($parent, $passed) use (&$transfers) { curl_setopt($passed, CURLOPT_WRITEFUNCTION, function ($ch, $data) { echo "Received ".strlen($data)."\n"; return strlen($data); }); $transfers++; return CURL_PUSH_OK; }; $mh = curl_multi_init(); curl_multi_setopt($mh, CURLMOPT_PIPELINING, CURLPIPE_MULTIPLEX); curl_multi_setopt($mh, CURLMOPT_PUSHFUNCTION, $callback); $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, 'https://http2.golang.org/serverpush'); curl_setopt($ch, CURLOPT_HTTP_VERSION, 3); curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0); curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); // FIXME, this line crashes everything. Without it, everything is fine. curl_setopt($ch, CURLOPT_TIMEOUT, 30); curl_multi_add_handle($mh, $ch); $active = null; do { $status = curl_multi_exec($mh, $active); do { $info = curl_multi_info_read($mh); if (false !== $info && $info['msg'] == CURLMSG_DONE) { $handle = $info['handle']; if ($handle !== null) { $transfers--; curl_multi_remove_handle($mh, $handle); curl_close($handle); } } } while ($info); } while ($transfers); curl_multi_close($mh); -- Edit bug report at https://bugs.php.net/bug.php?id=77497&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=77497&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=77497&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=77497&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=77497&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=77497&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=77497&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=77497&r=needscript Try newer version: https://bugs.php.net/fix.php?id=77497&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=77497&r=support Expected behavior: https://bugs.php.net/fix.php?id=77497&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=77497&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=77497&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=77497&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=77497&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=77497&r=dst IIS Stability: https://bugs.php.net/fix.php?id=77497&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=77497&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=77497&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=77497&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=77497&r=mysqlcfg