[php-src] Issue #22117: Spinning 100% CPU in zend_hash_find_bucket

From: Date: Fri, 22 May 2026 06:13:08 +0000
Subject: [php-src] Issue #22117: Spinning 100% CPU in zend_hash_find_bucket
Groups: php.bugs 
Request: Send a blank email to php-bugs+get-252112@lists.php.net to get a copy of this message
Issue: https://github.com/php/php-src/issues/22117 Author: Arusekk ### Description The following code: (Installed Nextcloud 33 + Postgres and added an IMAP account to Nextcloud Mail) ```sh php-zts occ mail:account:sync 24 ``` Resulted in this output: It reliably hangs. Maybe a memory corruption? I would love it to just crash, but the symptom is that it starts to spin forever in zend_hash_find_bucket (the line idx = Z_NEXT(p->val); keeps idx being zero). I know this is hot code, but for safety against hanging, there could maybe be some assertion that ensures that idx changes at least once in a while? 100% CPU spins like this could get expensive at scale. ``` #0 0x000055b3c8dbda37 in zend_hash_find () #1 0x000055b3c871b929 in pcre_get_compiled_regex_cache_ex () #2 0x000055b3c871f4cd in ?? () #3 0x000055b3c871f2e0 in ?? () #4 0x000055b3c871f8e9 in ?? () #5 0x000055b3c8d3700d in ?? () #6 0x000055b3c8cdfbb9 in execute_ex () #7 0x000055b3c8cdff75 in zend_execute () #8 0x000055b3c8e25b72 in zend_execute_script () #9 0x000055b3c8bf0f28 in php_execute_script_ex () #10 0x000055b3c8e2a021 in ?? () #11 0x000055b3c8e28056 in ?? () #12 0x00007f8487e8a8d0 in libc_start_main_stage2 (main=0x55b3c8e26690, argc=4, argv=0x7ffffc22e278) at src/env/__libc_start_main.c:95 #13 0x000055b3c8518b56 in _start () ``` If I force return in GDB (set $rax=0; return - saying there is no matching hash), it dies on a null pointer dereference later on. But I expected this output instead: ``` 47MB of memory used ``` (this is normal successful execution) Sorry for no minimized reproducer yet. Is there something I could do without minimizing the test case? I am trying to get a better backtrace, but I believe building with ASAN would work best. Known working version (Alpine system PHP): ``` $ php85 -v PHP 8.5.6 (cli) (built: May 7 2026 16:54:58) (NTS) Copyright (c) The PHP Group Built by Alpine Linux aports Zend Engine v4.5.6, Copyright (c) Zend Technologies with Zend OPcache v8.5.6, Copyright (c), by Zend Technologies ``` Known broken version: (added https://pkg.henderkes.com/api/packages/85/alpine/main/php-zts to /etc/apk/repositories and installed php-zts) ### PHP Version ```plain PHP 8.5.6 (cli) (built: May 8 2026 14:59:54) (ZTS zig 0.16.0 x86_64) Copyright (c) The PHP Group Built by Static PHP <https://static-php.dev> #StandWithUkraine Zend Engine v4.5.6, Copyright (c) Zend Technologies with Zend OPcache v8.5.6, Copyright (c), by Zend Technologies ``` ### Operating System Alpine 3.23.4

« previous php.bugs (#252112) next »