Bug #78295 [Opn]: session_create_id causes SIGSEGV

Edit report at https://bugs.php.net/bug.php?id=78295&edit=1 ID: 78295 User updated by: ilija dot tovilo at me dot com Reported by: ilija dot tovilo at me dot com Summary: session_create_id causes SIGSEGV Status: Open Type: Bug Package: Session related Operating System: Linux/Windows -PHP Version: 7.3.7 +PHP Version: 7.3.6 Block user comment: N Private report: N New Comment: Adjust tested PHP version Previous Comments: ------------------------------------------------------------------------ [2019-07-15 21:24:54] ilija dot tovilo at me dot com Description: ------------ We've upgraded to from PHP 7.0 to PHP 7.3 and started experiencing PHP-FPM crashes in production. Turns out it was caused by a call to session_create_id() in the SimpleSaml library: https://github.com/simplesamlphp/simplesamlphp/issues/1158 The issue would arise randomly about 2-3 times a day. We've tried to get a core dump but have not managed to do so yet. In the meantime SimpleSaml has switched back to use bin2hex(openssl_random_pseudo_bytes(16)) for session id generation for PHP 7.3. This has completely resolved the issue for us. No more crashes. Test script: --------------- Unfortunately, the issue only occurred in our production environment. We could not reproduce the issue in a short test script. Expected result: ---------------- No crash. Actual result: -------------- /var/log/kern.log: Jul 5 16:00:03 servername kernel: [265630.815422] traps: php-fpm7.3[21032] general protection ip:5580a3494efd sp:7fff8cff8498 error:0 Jul 5 16:00:03 servername kernel: [265630.815428] in php-fpm7.3[5580a3231000+3ee000] /var/log/php7.3-fpm.log: [05-Jul-2019 16:24:44] WARNING: [pool www] child 21558 exited on signal 11 (SIGSEGV) after 0.454303 seconds from start [05-Jul-2019 16:24:44] NOTICE: [pool www] child 21561 started ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=78295&edit=1