Bug #77683 [NEW]: Segfault possibly by strange chars

From: pascal dot nobus at webservice dot be Operating system: Slackware 14.1 PHP version: 7.1.26 Package: *General Issues Bug Type: Bug Bug description:Segfault possibly by strange chars Description: ------------ After months of random Segfaults at several servers we have some good core-dumps now. PHP is compiled as mod_php with apache-2.4.38. Nginx is running as front-proxy. # apachectl -t -D DUMP_MODULES Loaded Modules: core_module (static) so_module (static) http_module (static) mpm_event_module (static) authn_file_module (shared) authn_core_module (shared) authz_host_module (shared) authz_groupfile_module (shared) authz_user_module (shared) authz_core_module (shared) access_compat_module (shared) auth_basic_module (shared) socache_shmcb_module (shared) reqtimeout_module (shared) filter_module (shared) deflate_module (shared) mime_module (shared) log_config_module (shared) logio_module (shared) env_module (shared) expires_module (shared) headers_module (shared) setenvif_module (shared) version_module (shared) ssl_module (shared) unixd_module (shared) status_module (shared) autoindex_module (shared) cgid_module (shared) negotiation_module (shared) dir_module (shared) alias_module (shared) rewrite_module (shared) php7_module (shared) # /usr/local/bin/php -m [PHP Modules] bcmath Core ctype curl date dom exif fileinfo filter ftp gd hash iconv intl json libxml mbstring mcrypt mysqli mysqlnd openssl pcre PDO pdo_mysql pdo_sqlite Phar posix Reflection session SimpleXML soap SPL sqlite3 standard tokenizer xml xmlreader xmlwriter xsl Zend OPcache zip zlib [Zend Modules] Zend OPcache Opcache is turned of in php.ini (I thought the problem was there) At nginx I have this in the logs: 120.92.10.210 - - [28/Feb/2019:22:56:54 +0100] "GET /index.php?s=/index/%5Cthink%5Capp/invokefunction&function=call_user_func_array&vars[0]=file_put_contents&vars[1][]=yulxsads.php&vars[1][]=%3C?php%20print(md5(222));$a=str_replace(%22vbnm%22,%22%22,%22asvbnmsert%22);@$a($_POST[qazw]);?%3E HTTP/1.1" 200 7757 "-" "python-requests/2.21.0" "-" (note: I tested this URL myself but no crash) At the same time a core was dumped: Core was generated by `/usr/local/apache2/bin/httpd -k start'. Program terminated with signal 11, Segmentation fault. #0 0x00007f6db5a8d88d in getenv () from /lib64/libc.so.6 (gdb) bt full #0 0x00007f6db5a8d88d in getenv () from /lib64/libc.so.6 No symbol table info available. #1 0x00007f6db5a80d76 in setlocale () from /lib64/libc.so.6 No symbol table info available. #2 0x00007f6db12e5de0 in zif_setlocale (execute_data=<optimized out>, return_value=0x7f6d9bfec640) at /usr/local/src/php-7.1.26/ext/standard/string.c:4454 args = 0x7f6d824186e0 plocale = <optimized out> loc = 0x7f6d824fbde0 retval = <optimized out> cat = 6 num_args = 1 i = 0 idx = 0 #3 0x00007f6db14652bd in ZEND_DO_FCALL_BY_NAME_SPEC_RETVAL_UNUSED_HANDLER () at /usr/local/src/php-7.1.26/Zend/zend_vm_execute.h:797 retval = {value = {lval = 140108313494368, dval = 6.9222704394322764e-310, counted = 0x7f6d82418360, str = 0x7f6d82418360, arr = 0x7f6d82418360, obj = 0x7f6d82418360, res = 0x7f6d82418360, ref = 0x7f6d82418360, ast = 0x7f6d82418360, zv = 0x7f6d82418360, ptr = 0x7f6d82418360, ce = 0x7f6d82418360, func = 0x7f6d82418360, ww = {w1 = 2185331552, w2 = 32621}}, u1 = {v = {type = 1 '\001', type_flags = 0 '\000', const_flags = 0 '\000', reserved = 0 '\000'}, type_info = 1}, u2 = {next = 32621, cache_slot = 32621, lineno = 32621, num_args = 32621, fe_pos = 32621, fe_iter_idx = 32621, access_flags = 32621, property_guard = 32621, extra = 32621}} call = 0x7f6d82418680 fbc = 0x7f6d64028850 ret = 0x7f6d9bfec640 #4 0x00007f6db140bee3 in execute_ex (ex=<optimized out>) at /usr/local/src/php-7.1.26/Zend/zend_vm_execute.h:429 orig_opline = 0x7f6d82475000 orig_execute_data = 0x7f6d8245c0a0 #5 0x00007f6db14684fb in zend_execute (op_array=<optimized out>, return_value=<optimized out>) at /usr/local/src/php-7.1.26/Zend/zend_vm_execute.h:474 No locals. #6 0x00007f6db13c1a67 in zend_execute_scripts (type=type@entry=8, retval=retval@entry=0x0, file_count=file_count@entry=3) at /usr/local/src/php-7.1.26/Zend/zend.c:1482 files = {{gp_offset = 40, fp_offset = 32621, overflow_arg_area = 0x7f6d9bfec790, reg_save_area = 0x7f6d9bfec720}} i = 1 file_handle = 0x7f6d9bfee9f0 op_array = 0x7f6d8252a520 #7 0x00007f6db1351ea0 in php_execute_script (primary_file=primary_file@entry=0x7f6d9bfee9f0) at /usr/local/src/php-7.1.26/main/main.c:2577 realfile = "�/!dm\177\000\000\000\060!dm\177\000\000\210,\020\\m\177\000\000\000\000\000\000\000\000\000\000\200\003\000\000\000\000\000\000\005\021��m\177\000\000�\000\t\002\000\000\000\000\030��\233m\177\000\000�,\020\\m\177\000\000\210,\020\\\002\000\000\000\001\000\000\000\000\000\000\000\020��\233m\177\000\000\000\000\000\002\000\000\000\000\210,\020\\m\177\000\000\000\000\000\000\000\000\000\000���\233m\177\000\000\000\000\000\000\000\000\000\000K\231\211�m\177", '\000' <repeats 202 times>... __orig_bailout = 0x7f6d9bfeea60 __bailout = {{__jmpbuf = {140108745337440, 8649366419897889551, 34144464, 0, 140108745341376, 0, 8649366420503966479, 8649424189837325071}, __mask_was_saved = 0, __saved_mask = {__val = {0, 0, 0, 0, 0, 0, 140107808060111, 140107808060112, 13, 140107808060288, 140109176240366, 0, 140107808060099, 140107808060256, 140107808060274, 8}}}} prepend_file_p = 0x0 append_file_p = 0x0 prepend_file = {handle = {fd = 0, fp = 0x0, stream = {handle = 0x0, isatty = 0, mmap = {len = 0, pos = 0, map = 0x0, buf = 0x0, old_handle = 0x0, old_closer = 0x0}, reader = 0x0, fsizer = 0x0, closer = 0x0}}, filename = 0x0, opened_path = 0x0, type = ZEND_HANDLE_FILENAME, free_filename = 0 '\000'} append_file = {handle = {fd = 0, fp = 0x0, stream = {handle = 0x0, isatty = 0, mmap = {len = 0, pos = 0, map = 0x0, buf = 0x0, old_handle = 0x0, old_closer = 0x0}, reader = 0x0, fsizer = 0x0, closer = 0x0}}, filename = 0x0, opened_path = 0x0, type = ZEND_HANDLE_FILENAME, free_filename = 0 '\000'} old_cwd = 0x7f6d9bfec790 "/" retval = 0 #8 0x00007f6db146aaba in php_handler (r=<optimized out>) at /usr/local/src/php-7.1.26/sapi/apache2handler/sapi_apache2.c:712 zfd = {handle = {fd = -2109300736, fp = 0x7f6d8246a000, stream = {handle = 0x7f6d8246a000, isatty = 0, mmap = {len = 549, pos = 0, map = 0x0, buf = 0x7f6db8816000 <Address 0x7f6db8816000 out of bounds>, old_handle = 0x0, old_closer = 0x0}, reader = 0x7f6db136b8e0 <_php_stream_read>, fsizer = 0x7f6db134ecb0 <php_zend_stream_fsizer>, closer = 0x7f6db134ec90 <php_zend_stream_mmap_closer>}}, filename = 0x7f6d38042ef0 "/host/user_A/public/index.php", opened_path = 0x0, type = ZEND_HANDLE_MAPPED, free_filename = 0 '\000'} __orig_bailout = 0x0 __bailout = {{__jmpbuf = {140107067957248, 8649366419855946511, 34144464, 0, 140108745341376, 0, 8649366419895792399, 8649424347934274319}, __mask_was_saved = 0, __saved_mask = {__val = {140108611289768, 0, 140109118180451, 140108745337648, 140107067957248, 140107067957688, 140109122460671, 140108879639336, 140107067957248, 0, 140107067957248, 140108745337648, 140109135431297, 140107067962456, 140109111812294, 34144464}}}} ctx = 0x7f6d38043488 conf = <optimized out> brigade = 0x7f6d4c004198 bucket = <optimized out> rv = <optimized out> parent_req = 0x0 #9 0x000000000045e8c5 in ap_run_handler () No symbol table info available. #10 0x000000000045f3e5 in ap_invoke_handler () No symbol table info available. #11 0x000000000047f0a3 in ap_internal_redirect () No symbol table info available. #12 0x00007f6db1d6e162 in handler_redirect () from /usr/local/apache2/modules/mod_rewrite.so No symbol table info available. #13 0x000000000045e8c5 in ap_run_handler () No symbol table info available. #14 0x000000000045f3e5 in ap_invoke_handler () No symbol table info available. #15 0x000000000047deeb in ap_process_async_request () No symbol table info available. #16 0x00000000004797f5 in ap_process_http_async_connection () No symbol table info available. #17 0x0000000000479a0d in ap_process_http_connection () No symbol table info available. #18 0x000000000046d43c in ap_run_process_connection () No symbol table info available. #19 0x0000000000488e32 in process_socket () No symbol table info available. #20 0x000000000048b77d in worker_thread () No symbol table info available. #21 0x00007f6db6029ce2 in start_thread () from /lib64/libpthread.so.0 No symbol table info available. #22 0x00007f6db5b4e8cd in clone () from /lib64/libc.so.6 No symbol table info available. 15 minutes later a new core was dump. In Nginx-error-logs: 2019/02/28 23:15:18 [error] 28427#0: *50733494 upstream prematurely closed connection while reading response header from upstream, client: 193.106.30.98, server: xxxxxx.com, request: "POST /wp-sbb.php HTTP/1.1", upstream: "http://127.0.0.1:80/wp-sbb.php", host: "xxxxxx.com" Core was generated by `/usr/local/apache2/bin/httpd -k start'. Program terminated with signal 11, Segmentation fault. #0 0x00007f6db5adb36a in __strchr_sse2 () from /lib64/libc.so.6 (gdb) bt full #0 0x00007f6db5adb36a in __strchr_sse2 () from /lib64/libc.so.6 No symbol table info available. #1 0x00007f6db5a8d8d8 in putenv () from /lib64/libc.so.6 No symbol table info available. #2 0x00007f6db12ae782 in php_putenv_destructor (zv=<optimized out>) at /usr/local/src/php-7.1.26/ext/standard/basic_functions.c:3435 pe = 0x7f6d34a23e20 #3 0x00007f6db13d2972 in zend_hash_destroy (ht=0x7f6ce806dd18) at /usr/local/src/php-7.1.26/Zend/zend_hash.c:1246 p = 0x7f6d34a54f20 end = 0x7f6d34a54f40 #4 0x00007f6db12ae8ec in zm_deactivate_basic (type=1, module_number=35) at /usr/local/src/php-7.1.26/ext/standard/basic_functions.c:3811 No locals. #5 0x00007f6db13c830c in zend_deactivate_modules () at /usr/local/src/php-7.1.26/Zend/zend_API.c:2576 module = <optimized out> p = 0x2849c70 __orig_bailout = 0x0 __bailout = {{__jmpbuf = {140109111745076, 8649830570995790607, 140109111745076, 0, 140108812483008, 0, 8649357619503608591, 8649424125633540879}, __mask_was_saved = 0, __saved_mask = {__val = {0, 0, 140109099586621, 41622448, 140105725517728, 140105725518112, 140109101722110, 0, 140109101750980, 140109111738420, 140109101602570, 0, 0, 0, 0, 0}}}} #6 0x00007f6db1350b12 in php_request_shutdown (dummy=dummy@entry=0x0) at /usr/local/src/php-7.1.26/main/main.c:1876 report_memleaks = 1 '\001' #7 0x00007f6db146a94f in php_apache_request_dtor (r=<optimized out>) at /usr/local/src/php-7.1.26/sapi/apache2handler/sapi_apache2.c:552 No locals. #8 php_handler (r=<optimized out>) at /usr/local/src/php-7.1.26/sapi/apache2handler/sapi_apache2.c:724 ctx = 0x7f6d88005430 conf = <optimized out> brigade = 0x7f6d88005b48 bucket = <optimized out> rv = <optimized out> parent_req = 0x0 #9 0x000000000045e8c5 in ap_run_handler () No symbol table info available. #10 0x000000000045f3e5 in ap_invoke_handler () No symbol table info available. #11 0x000000000047deeb in ap_process_async_request () No symbol table info available. #12 0x00000000004797f5 in ap_process_http_async_connection () No symbol table info available. #13 0x0000000000479a0d in ap_process_http_connection () No symbol table info available. #14 0x000000000046d43c in ap_run_process_connection () No symbol table info available. #15 0x0000000000488e32 in process_socket () No symbol table info available. #16 0x000000000048b77d in worker_thread () No symbol table info available. #17 0x00007f6db6029ce2 in start_thread () from /lib64/libpthread.so.0 No symbol table info available. #18 0x00007f6db5b4e8cd in clone () from /lib64/libc.so.6 No Core was generated by `/usr/local/apache2/bin/httpd -k start'. Program terminated with signal 11, Segmentation fault. #0 0x00007f6db5adb36a in __strchr_sse2 () from /lib64/libc.so.6 (gdb) bt full #0 0x00007f6db5adb36a in __strchr_sse2 () from /lib64/libc.so.6 No symbol table info available. #1 0x00007f6db5a8d8d8 in putenv () from /lib64/libc.so.6 No symbol table info available. #2 0x00007f6db12ae782 in php_putenv_destructor (zv=<optimized out>) at /usr/local/src/php-7.1.26/ext/standard/basic_functions.c:3435 pe = 0x7f6d34a23e20 #3 0x00007f6db13d2972 in zend_hash_destroy (ht=0x7f6ce806dd18) at /usr/local/src/php-7.1.26/Zend/zend_hash.c:1246 p = 0x7f6d34a54f20 end = 0x7f6d34a54f40 #4 0x00007f6db12ae8ec in zm_deactivate_basic (type=1, module_number=35) at /usr/local/src/php-7.1.26/ext/standard/basic_functions.c:3811 No locals. #5 0x00007f6db13c830c in zend_deactivate_modules () at /usr/local/src/php-7.1.26/Zend/zend_API.c:2576 module = <optimized out> p = 0x2849c70 __orig_bailout = 0x0 __bailout = {{__jmpbuf = {140109111745076, 8649830570995790607, 140109111745076, 0, 140108812483008, 0, 8649357619503608591, 8649424125633540879}, __mask_was_saved = 0, __saved_mask = {__val = {0, 0, 140109099586621, 41622448, 140105725517728, 140105725518112, 140109101722110, 0, 140109101750980, 140109111738420, 140109101602570, 0, 0, 0, 0, 0}}}} #6 0x00007f6db1350b12 in php_request_shutdown (dummy=dummy@entry=0x0) at /usr/local/src/php-7.1.26/main/main.c:1876 report_memleaks = 1 '\001' #7 0x00007f6db146a94f in php_apache_request_dtor (r=<optimized out>) at /usr/local/src/php-7.1.26/sapi/apache2handler/sapi_apache2.c:552 No locals. #8 php_handler (r=<optimized out>) at /usr/local/src/php-7.1.26/sapi/apache2handler/sapi_apache2.c:724 ctx = 0x7f6d88005430 conf = <optimized out> brigade = 0x7f6d88005b48 bucket = <optimized out> rv = <optimized out> parent_req = 0x0 #9 0x000000000045e8c5 in ap_run_handler () No symbol table info available. #10 0x000000000045f3e5 in ap_invoke_handler () No symbol table info available. #11 0x000000000047deeb in ap_process_async_request () No symbol table info available. #12 0x00000000004797f5 in ap_process_http_async_connection () No symbol table info available. #13 0x0000000000479a0d in ap_process_http_connection () No symbol table info available. #14 0x000000000046d43c in ap_run_process_connection () No symbol table info available. #15 0x0000000000488e32 in process_socket () No symbol table info available. #16 0x000000000048b77d in worker_thread () No symbol table info available. #17 0x00007f6db6029ce2 in start_thread () from /lib64/libpthread.so.0 No symbol table info available. #18 0x00007f6db5b4e8cd in clone () from /lib64/libc.so.6 No symbol table info available. Another 5 minutes later again a core dump. Possible entry in Nginx 178.116.29.152 - - [28/Feb/2019:23:20:29 +0100] "GET / HTTP/1.1" 502 173 "https://www.google.be/" "Mozilla/5.0 (iPad; CPU OS 12_1_4 like Mac OS X) AppleW ebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1" "-" #0 0x00007f6db5b8bb47 in __strncmp_sse42 () from /lib64/libc.so.6 No symbol table info available. #1 0x00007f6db12af58e in zif_putenv (execute_data=<optimized out>, return_value=0x7f6d9eff2730) at /usr/local/src/php-7.1.26/ext/standard/basic_functions.c:4178 setting = 0x7f6d829f19a8 "MAGICK_THREAD_LIMIT=1" setting_len = 21 p = 0x7f6d423e0a4b "" env = 0x7f6d6c02f778 pe = {putenv_string = 0x7f6d8b26b438 "MAGICK_THREAD_LIMIT=1", previous_value = 0x0, key = 0x7f6d423e0a38 "MAGICK_THREAD_LIMIT", key_len = 19} #2 0x00007f6db141d50d in ZEND_DO_ICALL_SPEC_RETVAL_UNUSED_HANDLER () at /usr/local/src/php-7.1.26/Zend/zend_vm_execute.h:628 call = 0x7f6d8b21c0a0 fbc = 0x7f6d2000f040 ret = 0x7f6d9eff2730 retval = {value = {lval = 140108462407648, dval = 6.9222777967258622e-310, counted = 0x7f6d8b21bfe0, str = 0x7f6d8b21bfe0, arr = 0x7f6d8b21bfe0, obj = 0x7f6d8b21bfe0, res = 0x7f6d8b21bfe0, ref = 0x7f6d8b21bfe0, ast = 0x7f6d8b21bfe0, zv = 0x7f6d8b21bfe0, ptr = 0x7f6d8b21bfe0, ce = 0x7f6d8b21bfe0, func = 0x7f6d8b21bfe0, ww = {w1 = 2334244832, w2 = 32621}}, u1 = {v = {type = 1 '\001', type_flags = 0 '\000', const_flags = 0 '\000', reserved = 0 '\000'}, type_info = 1}, u2 = {next = 32621, cache_slot = 32621, lineno = 32621, num_args = 32621, fe_pos = 32621, fe_iter_idx = 32621, access_flags = 32621, property_guard = 32621, extra = 32621}} #3 0x00007f6db140bee3 in execute_ex (ex=<optimized out>) at /usr/local/src/php-7.1.26/Zend/zend_vm_execute.h:429 orig_opline = 0x7f6d8b275000 orig_execute_data = 0x7f6d8b25c0a0 #4 0x00007f6db14684fb in zend_execute (op_array=<optimized out>, return_value=<optimized out>) at /usr/local/src/php-7.1.26/Zend/zend_vm_execute.h:474 No locals. #5 0x00007f6db13c1a67 in zend_execute_scripts (type=type@entry=8, retval=retval@entry=0x0, file_count=file_count@entry=3) at /usr/local/src/php-7.1.26/Zend/zend.c:1482 files = {{gp_offset = 40, fp_offset = 32621, overflow_arg_area = 0x7f6d9eff2880, reg_save_area = 0x7f6d9eff2810}} i = 1 file_handle = 0x7f6d9eff4ae0 op_array = 0x7f6d82b51340 #6 0x00007f6db1351ea0 in php_execute_script (primary_file=primary_file@entry=0x7f6d9eff4ae0) at /usr/local/src/php-7.1.26/main/main.c:2577 realfile = '\000' <repeats 136 times>, "�35�m\177", '\000' <repeats 18 times>, "XD�\236m\177\000\000\001\000\000\000m\177", '\000' <repeats 18 times>, "$�\002\000\000\000\000\000"... __orig_bailout = 0x7f6d9eff4b50 __bailout = {{__jmpbuf = {140108795693904, 8649359819508331279, 34144464, 0, 140108795697600, 0, 8649359816356311823, 8649424189837325071}, __mask_was_saved = 0, __saved_mask = {__val = {140107741346632, 0, 140108795697600, 0, 140109190633803, 0 <repeats 11 times>}}}} prepend_file_p = 0x0 append_file_p = 0x0 prepend_file = {handle = {fd = 0, fp = 0x0, stream = {handle = 0x0, isatty = 0, mmap = {len = 0, pos = 0, map = 0x0, buf = 0x0, old_handle = 0x0, old_closer = 0x0}, reader = 0x0, fsizer = 0x0, closer = 0x0}}, filename = 0x0, opened_path = 0x0, type = ZEND_HANDLE_FILENAME, free_filename = 0 '\000'} append_file = {handle = {fd = 0, fp = 0x0, stream = {handle = 0x0, isatty = 0, mmap = {len = 0, pos = 0, map = 0x0, buf = 0x0, old_handle = 0x0, old_closer = 0x0}, reader = 0x0, fsizer = 0x0, closer = 0x0}}, filename = 0x0, opened_path = 0x0, type = ZEND_HANDLE_FILENAME, free_filename = 0 '\000'} old_cwd = 0x7f6d9eff2880 "/" retval = 0 #7 0x00007f6db146aaba in php_handler (r=<optimized out>) at /usr/local/src/php-7.1.26/sapi/apache2handler/sapi_apache2.c:712 zfd = {handle = {fd = -1960402944, fp = 0x7f6d8b26a000, stream = {handle = 0x7f6d8b26a000, isatty = 0, mmap = {len = 420, pos = 0, map = 0x0, buf = 0x7f6db8644000 <Address 0x7f6db8644000 out of bounds>, old_handle = 0x0, old_closer = 0x0}, reader = 0x7f6db136b8e0 <_php_stream_read>, fsizer = 0x7f6db134ecb0 <php_zend_stream_fsizer>, closer = 0x7f6db134ec90 <php_zend_stream_mmap_closer>}}, filename = 0x7f6d7805a8b0 "/host/user_b/public/index.php", opened_path = 0x0, type = ZEND_HANDLE_MAPPED, free_filename = 0 '\000'} __orig_bailout = 0x0 __bailout = {{__jmpbuf = {140107738844880, 8649359819466388239, 34144464, 0, 140108795697600, 0, 8649359819506234127, 8649424347934274319}, __mask_was_saved = 0, __saved_mask = {__val = {140107738844760, 0, 140109118180451, 140108795694112, 140107738844880, 0, 140109122460671, 34016304, 140107738844880, 0, 140107738844880, 140108141794240, 140107738844880, 140107741351528, 140109111812294, 34144464}}}} ctx = 0x7f6d60274e70 conf = <optimized out> brigade = 0x7f6d2416c4a0 bucket = <optimized out> rv = <optimized out> parent_req = 0x0 #8 0x000000000045e8c5 in ap_run_handler () No symbol table info available. #9 0x000000000045f3e5 in ap_invoke_handler () No symbol table info available. #10 0x000000000047deeb in ap_process_async_request () No symbol table info available. #11 0x00000000004797f5 in ap_process_http_async_connection () No symbol table info available. #12 0x0000000000479a0d in ap_process_http_connection () No symbol table info available. #13 0x000000000046d43c in ap_run_process_connection () No symbol table info available. #14 0x0000000000488e32 in process_socket () No symbol table info available. #15 0x000000000048b77d in worker_thread () No symbol table info available. #16 0x00007f6db6029ce2 in start_thread () from /lib64/libpthread.so.0 No symbol table info available. #17 0x00007f6db5b4e8cd in clone () from /lib64/libc.so.6 No symbol table info available Any idea how to prevent this? -- Edit bug report at https://bugs.php.net/bug.php?id=77683&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=77683&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=77683&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=77683&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=77683&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=77683&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=77683&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=77683&r=needscript Try newer version: https://bugs.php.net/fix.php?id=77683&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=77683&r=support Expected behavior: https://bugs.php.net/fix.php?id=77683&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=77683&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=77683&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=77683&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=77683&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=77683&r=dst IIS Stability: https://bugs.php.net/fix.php?id=77683&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=77683&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=77683&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=77683&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=77683&r=mysqlcfg