PHP 4.0 Bug #5338: Apache/mod_php segv's in php_rshutdown_session_globals()

From: bharat@menalto.com Operating system: FreeBSD 4.0-STABLE PHP version: 4.0.1pl2 PHP Bug Type: Reproduceable crash Bug description: Apache/mod_php segv's in php_rshutdown_session_globals() mod_php segv's when it tries to clean up a session. It appears to be triggered by changing the location of the session path with a command like this in .htaccess: php_value session.save_path ./sessions The stack trace is below. -------------------------- (gdb) run -X -d /usr/local/apache Starting program: /usr/local/apache/bin/httpd -X -d /usr/local/apache Program received signal SIGSEGV, Segmentation fault. 0x283664ad in _efree (ptr=0x80fc080) at zend_alloc.c:205 205 REMOVE_POINTER_FROM_LIST(p); (gdb) w Ambiguous command "w": watch, whatis, where, while, while-stepping, ws. (gdb) where #0 0x283664ad in _efree (ptr=0x80fc080) at zend_alloc.c:205 #1 0x283c200f in php_rshutdown_session_globals () at session.c:1282 #2 0x283c20d4 in php_rshutdown_session (type=1, module_number=3) at session.c:1319 #3 0x2837db58 in module_registry_cleanup (module=0x8293380) at zend_API.c:858 #4 0x2838099b in zend_hash_apply (ht=0x284530e0, apply_func=0x2837db1c <module_registry_cleanup>) at zend_hash.c:672 #5 0x2837d0d7 in zend_deactivate_modules () at zend.c:503 #6 0x2838bc3b in php_request_shutdown (dummy=0x0) at main.c:659 #7 0x28389a2a in php_apache_request_shutdown (dummy=0x0) at mod_php4.c:301 #8 0x8051271 in run_cleanups () #9 0x804f907 in ap_clear_pool () #10 0x804f987 in ap_destroy_pool () #11 0x805fece in child_main () #12 0x8060051 in make_child () #13 0x80601ca in startup_children () #14 0x80607d8 in standalone_main () #15 0x8061008 in main () #16 0x804f189 in _start () (gdb) up #1 0x283c200f in php_rshutdown_session_globals () at session.c:1282 1282 efree(PS(save_path)); (gdb) list 1277 PS(mod)->close(&PS(mod_data)); 1278 if (PS(id)) 1279 efree(PS(id)); 1280 efree(PS(entropy_file)); 1281 efree(PS(extern_referer_chk)); 1282 efree(PS(save_path)); 1283 efree(PS(session_name)); 1284 efree(PS(cache_limiter)); 1285 efree(PS(cookie_path)); 1286 efree(PS(cookie_domain));