#23333 [NEW]: Seg fault + hang using unset on array

From: smgallo at ccr dot buffalo dot edu Operating system: RedHat 7.3, glibc-2.2.5-39 PHP version: 4.3.0 PHP Bug Type: Reproducible crash Bug description: Seg fault + hang using unset on array <?php $big = array(); $test = array(); fwrite(STDOUT, "Start\n"); for($i=0; $i < 100000; $i++) { $big[$i] = $i; } fwrite(STDOUT, "Middle\n"); for ($k=0; $k < 20; $k++) { fwrite(STDOUT,"$k"); $test = array(); fwrite(STDOUT,"."); for($i=0; $i < 100000; $i++) { $test[$i] = $big; } fwrite(STDOUT,"."); for($i=0; $i < 100000; $i++) { unset($test[$i]); } // unset($test); } fwrite(STDOUT, "\nEnd\n"); ?> Running the above script produces the following output: Start Middle 0..1..2.. Segmentation fault A trace in gdb produces: Program received signal SIGSEGV, Segmentation fault. 0x4207ad8e in chunk_free () from /lib/i686/libc.so.6 (gdb) where #0 0x4207ad8e in chunk_free () from /lib/i686/libc.so.6 #1 0x4207ad14 in free () from /lib/i686/libc.so.6 #2 0x08121bdc in zend_hash_destroy () #3 0x0811c5fa in _zval_dtor () #4 0x08114e01 in _zval_ptr_dtor () #5 0x08121aa6 in zend_hash_del_key_or_index () #6 0x0813587a in execute () #7 0x0811db3c in zend_execute_scripts () #8 0x080f75cd in php_execute_script () #9 0x081384a0 in main () #10 0x42017589 in __libc_start_main () from /lib/i686/libc.so.6 If I comment out the for loop containing the unset() and instead use: unset($test); Then the script hangs. strace shows the following output and seems to be in an infinite loop: brk(0x8f73000) = 0x8f73000 brk(0x8f74000) = 0x8f74000 write(5, ".", 1.) = 1 munmap(0x40256000, 528384) = 0 brk(0x8a21000) = 0x8a21000 munmap(0x402d7000, 528384) = 0 write(5, "1", 11) = 1 write(5, ".", 1.) = 1 write(5, ".", 1.) = 1 munmap(0xcac4, 136005040) = -1 EINVAL (Invalid argument) munmap(0xff797a94, 144821032) = -1 EINVAL (Invalid argument) munmap(0x8658cc, 136016488) = -1 EINVAL (Invalid argument) munmap(0xc608927c, 1108533240) = -1 EINVAL (Invalid argument) munmap(0xffffffcc, 136028904) = -1 EINVAL (Invalid argument) munmap(0xffffffcc, 136028960) = -1 EINVAL (Invalid argument) munmap(0xffffffcc, 136029016) = -1 EINVAL (Invalid argument) munmap(0xffffffcc, 136029072) = -1 EINVAL (Invalid argument) munmap(0xffffffcc, 136029128) = -1 EINVAL (Invalid argument) munmap(0xffffffcc, 136029184) = -1 EINVAL (Invalid argument) munmap(0xffffffcc, 136029240) = -1 EINVAL (Invalid argument) munmap(0xffffffcc, 136029296) = -1 EINVAL (Invalid argument) munmap(0xffffffcc, 136029352) = -1 EINVAL (Invalid argument) munmap(0xffffffcc, 136029408) = -1 EINVAL (Invalid argument) -- Edit bug report at http://bugs.php.net/?id=23333&edit=1 -- Try a CVS snapshot: http://bugs.php.net/fix.php?id=23333&r=trysnapshot Fixed in CVS: http://bugs.php.net/fix.php?id=23333&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=23333&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=23333&r=needtrace Try newer version: http://bugs.php.net/fix.php?id=23333&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=23333&r=support Expected behavior: http://bugs.php.net/fix.php?id=23333&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=23333&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=23333&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=23333&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=23333&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=23333&r=dst IIS Stability: http://bugs.php.net/fix.php?id=23333&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=23333&r=gnused