Bug #16278: reference to $_SESSION causes seg-fault

From: bhlyons@mail.com Operating system: Linux 2.2.16 (redhat 7.0) PHP version: 4.1.2 PHP Bug Type: Reproducible crash Bug description: reference to $_SESSION causes seg-fault Configuration: ./configure --with-apxs --enable-debug php.ini = php.ini-recommended Apache 1.3.12 I have been using a procedure to create nicely-formatted tables of arrays and their contents for a long time. It works very well under 4.1.2 (and previous 4.* verions) for displaying $GLOBALS if session_start has not been called. If session_start has been called, it causes a seg-fault when the $HTTP_SESSION_VARS and/or $_SESSION is processed. My normal script is much more elaborate, but I've stripped it to the bare minimum to make the bugs more obvious. There are four 'fix' comments in the code - implementing any one will make the problem go away, but none should be necessary. I have compiled 4.2.0rc1 with the same ./configure options and used the 4.2.0rc1-supplied php.ini-recommended file as part of a further test. The output is the same, but the seg-fault is not reported to the error log with 4.2.0rc1. ------------ index.php ------------------- <?PHP # fix 1 is to pass the array by value function CVTT (&$array, $depth=0) { if($depth==0) { print "<PRE>\n"; } while(list($key,$value)=each($array)) { # fix 2 is to skip both instances of the session variables array ### If this session-skipping block is enabled, there are no problems # if($key=="_SESSION" || $key=="HTTP_SESSION_VARS") { # print "skipping $key\n"; # continue; # } ### End of session-skipping block for($c=0;$c<$depth*5;$c++) { print " "; } print "$key="; if(is_array($value)) { $valuestring="Array"; } elseif(is_object($value)) { $valuestring="Object"; } elseif(is_bool($value)) { if($value) { $valuestring="Boolean True"; } else { $valuestring="Boolean False"; } } else { $valuestring=$value; } print "$valuestring\n"; if(is_array($array[$key])) { # fix 3 is to pass $value instead of $array[$key] CVTT($array[$key], $depth+1); } } if($depth==0) { print "</PRE>\n"; } } # fix 4 is to eliminate the session_start session_start(); $_SESSION['one']="two"; ?> <HTML> <HEAD> </HEAD> <BODY> <?PHP CVTT($GLOBALS) ?> </BODY> </HTML> ---------------end of index.php ------------- I was not able to get a backtrace by following the instructions in the php documentation. I'd be happy to try again with more-detailed instructions. If there is any further testing you would like, please let me know. Sincerely, Bryan -- Edit bug report at http://bugs.php.net/?id=16278&edit=1 -- Fixed in CVS: http://bugs.php.net/fix.php?id=16278&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=16278&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=16278&r=needtrace Try newer version: http://bugs.php.net/fix.php?id=16278&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=16278&r=support Expected behavior: http://bugs.php.net/fix.php?id=16278&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=16278&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=16278&r=submittedtwice