Bug #78244 [NEW]: fpm segfaults in concat_function

From: sjon Operating system: PHP version: 7.3.7RC3 Package: Reproducible crash Bug Type: Bug Bug description:fpm segfaults in concat_function Description: ------------ I experience a segfault in the almost-released 7.3.7 but have yet been unable to create a reproduce script. Looking at strace - this happens while all output has been generated, so it's possibly while destructing Program terminated with signal SIGSEGV, Segmentation fault. #0 0x000055ef3e4e204e in zend_mm_alloc_small (heap=0x7fa664600040, size=64, bin_num=7, __zend_filename=0x55ef3ed873e8 "php-7.3.7/Zend/zend_string.h", __zend_lineno=133, __zend_orig_filename=0x0, __zend_orig_lineno=0) at php-7.3.7/Zend/zend_alloc.c:1289 1289 heap->free_slot[bin_num] = p->next_free_slot; (gdb) bt #0 0x000055ef3e4e204e in zend_mm_alloc_small (heap=0x7fa664600040, size=64, bin_num=7, __zend_filename=0x55ef3ed873e8 "php-7.3.7/Zend/zend_string.h", __zend_lineno=133, __zend_orig_filename=0x0, __zend_orig_lineno=0) at php-7.3.7/Zend/zend_alloc.c:1289 #1 0x000055ef3e4e22f7 in zend_mm_alloc_heap (heap=0x7fa664600040, size=64, __zend_filename=0x55ef3ed873e8 "php-7.3.7/Zend/zend_string.h", __zend_lineno=133, __zend_orig_filename=0x0, __zend_orig_lineno=0) at php-7.3.7/Zend/zend_alloc.c:1360 #2 0x000055ef3e4e4fcd in _emalloc (size=32, __zend_filename=0x55ef3ed873e8 "php-7.3.7/Zend/zend_string.h", __zend_lineno=133, __zend_orig_filename=0x0, __zend_orig_lineno=0) at php-7.3.7/Zend/zend_alloc.c:2500 #3 0x000055ef3e50c01b in zend_string_alloc (len=6, persistent=0) at php-7.3.7/Zend/zend_string.h:133 #4 0x000055ef3e515374 in concat_function (result=0x7fa664621ae0, op1=0x7fa65b352b50, op2=0x7fff4e2f5170) at php-7.3.7/Zend/zend_operators.c:1852 #5 0x000055ef3e594d92 in ZEND_CONCAT_SPEC_CONST_TMPVAR_HANDLER () at php-7.3.7/Zend/zend_vm_execute.h:6695 #6 0x000055ef3e5f5c80 in execute_ex (ex=0x7fa664621030) at php-7.3.7/Zend/zend_vm_execute.h:56127 #7 0x000055ef3e5fa922 in zend_execute (op_array=0x7fa664602100, return_value=0x0) at php-7.3.7/Zend/zend_vm_execute.h:60881 #8 0x000055ef3e51e2b0 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at php-7.3.7/Zend/zend.c:1568 #9 0x000055ef3e482830 in php_execute_script (primary_file=0x7fff4e2f78f0) at php-7.3.7/main/main.c:2630 #10 0x000055ef3e60e056 in main (argc=4, argv=0x7fff4e2f7d88) at php-7.3.7/sapi/fpm/fpm/fpm_main.c:1950 -- Edit bug report at https://bugs.php.net/bug.php?id=78244&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=78244&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=78244&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=78244&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=78244&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=78244&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=78244&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=78244&r=needscript Try newer version: https://bugs.php.net/fix.php?id=78244&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=78244&r=support Expected behavior: https://bugs.php.net/fix.php?id=78244&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=78244&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=78244&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=78244&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=78244&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=78244&r=dst IIS Stability: https://bugs.php.net/fix.php?id=78244&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=78244&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=78244&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=78244&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=78244&r=mysqlcfg