Bug #78539 [NEW]: Segfault with json_decode

From: ymaheo at hexaglobe dot com Operating system: CentOS Linux release 7.4.1708 (C PHP version: 7.3.9 Package: JSON related Bug Type: Bug Bug description:Segfault with json_decode Description: ------------ PHP crash randomly on json_decode We do not succeed to find a consistent way to reproduice the issue. Test script: --------------- N/A Expected result: ---------------- No segfault Actual result: -------------- Fri Sep 13 21:08:16.078034 2019] [core:notice] [pid 65411] AH00051: child pid 169661 exit signal Segmentation fault (11), possible coredump in /home/apache_core [Fri Sep 13 21:17:04.545743 2019] [core:notice] [pid 65411] AH00051: child pid 26553 exit signal Segmentation fault (11), possible coredump in /home/apache_core [Fri Sep 13 21:17:09.549116 2019] [core:notice] [pid 65411] AH00051: child pid 136671 exit signal Segmentation fault (11), possible coredump in /home/apache_core [Fri Sep 13 21:23:10.883202 2019] [core:notice] [pid 65411] AH00051: child pid 73382 exit signal Segmentation fault (11), possible coredump in /home/apache_core [Fri Sep 13 21:23:16.890704 2019] [core:notice] [pid 65411] AH00051: child pid 61619 exit signal Segmentation fault (11), possible coredump in /home/apache_co gdb) bt #0 zend_mm_alloc_small (bin_num=6, size=56, heap=0x7f1717a00040) at /usr/src/debug/php-7.3.9/Zend/zend_alloc.c:1289 #1 _emalloc_56 () at /usr/src/debug/php-7.3.9/Zend/zend_alloc.c:2423 #2 0x00007f171fd92829 in _zend_new_array_0 () at /usr/src/debug/php-7.3.9/Zend/zend_hash.c:217 #3 0x00007f170f24bf09 in php_json_parser_array_create (parser=<optimized out>, array=0x7ffc96ba1660) at /usr/src/debug/php-7.3.9/ext/json/json_parser.tab.c:1859 #4 0x00007f170f24c6f9 in php_json_yyparse (parser=parser@entry=0x7ffc96ba2b20) at /usr/src/debug/php-7.3.9/ext/json/json_parser.tab.c:1593 #5 0x00007f170f249556 in php_json_decode_ex (return_value=return_value@entry=0x7f1717a1bed0, str=str@entry=0x7f16e2c8b018 "{\"i\":50404029,\"s\":\"dispo\",\"d\":false,\"TIMESTAMP\":1568389265,\"fa\":\"6912ed310195a0e91823d336ea3c61d1\",\"t\":0,\"t2\":0,"..., str_len=str_len@entry=1212, options=1, depth=<optimized out>) at /usr/src/debug/php-7.3.9/ext/json/json.c:252 #6 0x00007f170f249729 in zif_json_decode (execute_data=0x7f1717a1bf10, return_value=0x7f1717a1bed0) at /usr/src/debug/php-7.3.9/ext/json/json.c:361 #7 0x00007f171fe11628 in ZEND_DO_ICALL_SPEC_RETVAL_USED_HANDLER () at /usr/src/debug/php-7.3.9/Zend/zend_vm_execute.h:690 #8 execute_ex (ex=0x7f1717a00040) at /usr/src/debug/php-7.3.9/Zend/zend_vm_execute.h:55465 #9 0x00007f171fe15e83 in zend_execute (op_array=op_array@entry=0x7f1717a88000, return_value=0x0, return_value@entry=0x7f16eb5ee5e0) at /usr/src/debug/php-7.3.9/Zend/zend_vm_execute.h:60881 #10 0x00007f171fd868c2 in zend_execute_scripts (type=type@entry=8, retval=0x7f16eb5ee5e0, retval@entry=0x0, file_count=396475984, file_count@entry=3) at /usr/src/debug/php-7.3.9/Zend/zend.c:1568 #11 0x00007f171fd264f0 in php_execute_script (primary_file=primary_file@entry=0x7ffc96ba5140) at /usr/src/debug/php-7.3.9/main/main.c:2639 #12 0x00007f171fe180b2 in php_handler (r=<optimized out>) at /usr/src/debug/php-7.3.9/sapi/apache2handler/sapi_apache2.c:699 #13 0x0000560bdb7b0990 in ?? () #14 0x0000560bdd2cb418 in ?? () #15 0x0000560bdcf8e410 in ?? () #16 0x0000560bdd2c9df0 in ?? () #17 0x0000560bdb7b0ed9 in ?? () #18 0x0000560bdcf926c0 in ?? () #19 0x0000560bdb7a9b5f in ?? () #20 0x0000000000000000 in ?? () -- Edit bug report at https://bugs.php.net/bug.php?id=78539&edit=1 -- Fix committed: https://bugs.php.net/fix.php?id=78539&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=78539&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=78539&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=78539&r=needscript Try newer version: https://bugs.php.net/fix.php?id=78539&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=78539&r=support Expected behavior: https://bugs.php.net/fix.php?id=78539&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=78539&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=78539&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=78539&r=globals PHP version support discontinued: https://bugs.php.net/fix.php?id=78539&r=phptooold Daylight Savings: https://bugs.php.net/fix.php?id=78539&r=dst IIS Stability: https://bugs.php.net/fix.php?id=78539&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=78539&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=78539&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=78539&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=78539&r=mysqlcfg