Segfault on 4.1.2 on RH 7.2

Yes, yes, I know it's ancient -- but it's also what's out there for RPMs, and if I need to go to source I will, but for now... One single installation of gallery on our site -- a HUGE one -- consistently kills PHP. Here's a trace -- any useful info here? #0 chunk_realloc (ar_ptr=0x40349300, oldp=0x8343c78, oldsize=137641080, nb=344) at malloc.c:3563 #1 0x402959e2 in __libc_realloc (oldmem=0x8343c80, bytes=340) at malloc.c:3390 #2 0x08123a1b in _erealloc () #3 0x0810d232 in url_adapt_ext_ex () #4 0x080c6130 in session_adapt_uris () #5 0x08074dee in php_ub_body_write_no_header () #6 0x080744a2 in php_body_write () #7 0x0806cd78 in php_printf () #8 0x0806d00f in php_error_cb () #9 0x081333ac in zend_error () #10 0x08123b51 in _erealloc () #11 0x0810d232 in url_adapt_ext_ex () #12 0x080c6130 in session_adapt_uris () #13 0x08074dee in php_ub_body_write_no_header () #14 0x080744a2 in php_body_write () #15 0x0806cd78 in php_printf () #16 0x0806d00f in php_error_cb () #17 0x081333ac in zend_error () #18 0x08123b51 in _erealloc () #19 0x0810d232 in url_adapt_ext_ex () #20 0x080c6130 in session_adapt_uris () #21 0x08074dee in php_ub_body_write_no_header () #22 0x080744a2 in php_body_write () #23 0x0806cd78 in php_printf () #24 0x0806d00f in php_error_cb () #25 0x081333ac in zend_error () #26 0x0812378e in _emalloc () #27 0x08137c9b in zend_hash_index_update_or_next_insert () #28 0x08109d6d in php_var_unserialize () #29 0x0810a46c in php_var_unserialize () #30 0x0810a46c in php_var_unserialize () #31 0x0810a46c in php_var_unserialize () #32 0x0810a46c in php_var_unserialize () #33 0x0810a741 in zif_unserialize () #34 0x0815ab3a in execute () #35 0x0815ad33 in execute () #36 0x0815ad33 in execute () #37 0x0815ad33 in execute () #38 0x0815fe67 in execute () #39 0x08133798 in zend_execute_scripts () #40 0x0806ebf6 in php_execute_script () #41 0x0806c53c in main () #42 0x40230657 in __libc_start_main (main=0x806ba50 <main>, argc=2, ubp_av=0xbfffeca4, init=0x80689d4 <_init>, fini=0x81653e0 <_fini>, rtld_fini=0x4000dcd4 <_dl_fini>, stack_end=0xbfffec9c) at ../sysdeps/generic/libc-start.c:129