Bug #78295 [NEW]: session_create_id causes SIGSEGV

From: ilija dot tovilo at me dot com Operating system: Linux/Windows PHP version: 7.3.7 Package: Session related Bug Type: Bug Bug description:session_create_id causes SIGSEGV Description: ------------ We've upgraded to from PHP 7.0 to PHP 7.3 and started experiencing PHP-FPM crashes in production. Turns out it was caused by a call to session_create_id() in the SimpleSaml library: https://github.com/simplesamlphp/simplesamlphp/issues/1158 The issue would arise randomly about 2-3 times a day. We've tried to get a core dump but have not managed to do so yet. In the meantime SimpleSaml has switched back to use bin2hex(openssl_random_pseudo_bytes(16)) for session id generation for PHP 7.3. This has completely resolved the issue for us. No more crashes. Test script: --------------- Unfortunately, the issue only occurred in our production environment. We could not reproduce the issue in a short test script. Expected result: ---------------- No crash. Actual result: -------------- /var/log/kern.log: Jul 5 16:00:03 servername kernel: [265630.815422] traps: php-fpm7.3[21032] general protection ip:5580a3494efd sp:7fff8cff8498 error:0 Jul 5 16:00:03 servername kernel: [265630.815428] in php-fpm7.3[5580a3231000+3ee000] /var/log/php7.3-fpm.log: [05-Jul-2019 16:24:44] WARNING: [pool www] child 21558 exited on signal 11 (SIGSEGV) after 0.454303 seconds from start [05-Jul-2019 16:24:44] NOTICE: [pool www] child 21561 started -- Edit bug report at https://bugs.php.net/bug.php?id=78295&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=78295&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=78295&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=78295&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=78295&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=78295&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=78295&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=78295&r=needscript Try newer version: https://bugs.php.net/fix.php?id=78295&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=78295&r=support Expected behavior: https://bugs.php.net/fix.php?id=78295&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=78295&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=78295&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=78295&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=78295&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=78295&r=dst IIS Stability: https://bugs.php.net/fix.php?id=78295&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=78295&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=78295&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=78295&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=78295&r=mysqlcfg