PHP 4.0 Bug #3224: Crash on complex PHPLIB script - every time session data is read

From: stas@zend.com Operating system: Linux PHP version: 4.0 Latest CVS (16/01/2000) PHP Bug Type: Reproduceable crash Bug description: Crash on complex PHPLIB script - every time session data is read Program received signal SIGSEGV, Segmentation fault. 0x80ad148 in php_register_var (entry=0x81cb308) at /home/php/php4/ext/session/session.c:957 957 } else if (!PG(track_vars) || strcmp((*entry)->value.str.val, "HTTP_STATE_VARS") != 0) { #0 0x80ad148 in php_register_var (entry=0x81cb308) at /home/php/php4/ext/session/session.c:957 #1 0x80ad36a in php_if_session_register (ht=1, return_value=0x8318768, list=0x818b4dc, plist=0x818b50c, this_ptr=0x0, return_value_used=0) at /home/php/php4/ext/session/session.c:993 #2 0x80e4965 in execute (op_array=0x81e6b10) at ../../Zend/zend_execute.c:1525 #3 0x80e4b57 in execute (op_array=0x81e4340) at ../../Zend/zend_execute.c:1564 #4 0x80e4b57 in execute (op_array=0x830c1c8) at ../../Zend/zend_execute.c:1564 #5 0x80e4b57 in execute (op_array=0x81cb5c8) at ../../Zend/zend_execute.c:1564 #6 0x8084f90 in php_execute_script (primary_file=0xbffffb5c) at /home/php/php4/./main.c:1302 #7 0x809d0a1 in apache_php_module_main (r=0x81c7b94, fd=19, display_source_mode=0) at /home/php/php4/sapi/apache/sapi_apache.c:86 #8 0x8083413 in send_php () #9 0x8083458 in send_parsed_php () #10 0x80eeb53 in ap_invoke_handler () #11 0x8101e49 in process_request_internal () #12 0x8101eac in ap_process_request () #13 0x80f986e in child_main () #14 0x80f99fc in make_child () #15 0x80f9b59 in startup_children () #16 0x80fa186 in standalone_main () #17 0x80fa903 in main () (gdb) p (*entry)->value $2 = {lval = 1, dval = 1.7838863871792182e+127, str = { val = 0x1 <Address 0x1 out of bounds>, len = 1515870810}, chval = 1 '\001', ht = 0x1, obj = {ce = 0x1, properties = 0x5a5a5a5a}}