Do you have a reproducing script for me?

regards,

Derick

mcrypt_module_self_test('test','test');

I can not reproduce this with 4.0.6, 4.1.0, 4.1.1dev or 4.2.0dev, and libmcrypt 2.4.18.

Can you make a backtrace for me with the script you posted?
And what do you want to reach with the patch you attached?

regards,
Derick

I change form 
 lib_dir_s = Z_STRVAL_PP(lib_dir);\
 if (zend_get_parameters_ex(2, &arg1, &lib_dir) == FAILURE)\
 {\
 WRONG_PARAM_COUNT;\
 }\
 convert_to_string_ex (lib_dir);\
 break;\


To:
 if (zend_get_parameters_ex(2, &arg1, &lib_dir) == FAILURE)\
 {\
 WRONG_PARAM_COUNT;\
 }\
 convert_to_string_ex (lib_dir);\
 lib_dir_s = Z_STRVAL_PP(lib_dir);\
 break;\

Can you make a backtrace for me, (with bt full)?

Derick

(gdb) bt
#0  0x0814cd43 in zif_mcrypt_module_self_test (ht=2, return_value=0x83c6144, this_ptr=0x0, return_value_used=0)
    at mcrypt.c:851
#1  0x081aae4a in execute (op_array=0x83c1e6c) at ./zend_execute.c:1590
#2  0x080e5239 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at zend.c:814
#3  0x080801c1 in php_execute_script (primary_file=0xbffff7f0) at main.c:1307
#4  0x0807a8cc in main (argc=3, argv=0xbffff864) at cgi_main.c:738
#5  0x404f19cb in __libc_start_main (main=0x8079f34 <main>, argc=3, argv=0xbffff864, init=0x8076e1c <_init>, 
    fini=0x82310b0 <_fini>, rtld_fini=0x4000aea0 <_dl_fini>, stack_end=0xbffff85c) at ../sysdeps/generic/libc-start.c:92


(gdb) bt full 
#0  0x0814cd43 in zif_mcrypt_module_self_test (ht=2, return_value=0x83c6144, this_ptr=0x0, return_value_used=0)
    at mcrypt.c:851
        arg1 = (struct _zval_struct **) 0x8277e01
        lib_dir = (struct _zval_struct **) 0xc
        lib_dir_s = 0x81aadbb "\203? \211?\213M?\213Q\b\211?\215\f?"
        argc = 2
#1  0x081aae4a in execute (op_array=0x83c1e6c) at ./zend_execute.c:1590
        original_return_value = (struct _zval_struct **) 0x83c60b4
        return_value_used = 0
        opline = (struct _zend_op *) 0x83c609c
        function_state = {function_symbol_table = 0x0, function = 0x83953b8, reserved = {0xbffff7f0, 0x80ea508, 0x0, 0x0}}
        fbc = (union _zend_function *) 0x0
        object = {ptr = 0x0}
        Ts = (union _temp_variable *) 0xbfffe480
        original_in_execution = 0 '\000'
#2  0x080e5239 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at zend.c:814
        files = (void *) 0xbfffe5d4
        i = 1
        file_handle = (struct _zend_file_handle *) 0xbffff7f0
        orig_op_array = (struct _zend_op_array *) 0x0
        local_retval = (struct _zval_struct *) 0x0
#3  0x080801c1 in php_execute_script (primary_file=0xbffff7f0) at main.c:1307
        orig_bailout = {{__jmpbuf = {1079808588, 1073786528, -1073743772, -1073743848, -1073744176, 134717703}, 
    __mask_was_saved = 0, __saved_mask = {__val = {0 <repeats 32 times>}}}}
        orig_bailout_set = 1 '\001'
        prepend_file_p = (struct _zend_file_handle *) 0x0
        append_file_p = (struct _zend_file_handle *) 0x0
        prepend_file = {type = 1 '\001', filename = 0x4000aea0 "U\211?\203?\004WVS?", 
  opened_path = 0xbffff864 "\210???????????", handle = {fd = 4096, fp = 0x1000}, free_filename = 0 '\000'}
        append_file = {type = 0 '\000', filename = 0x0, opened_path = 0x0, handle = {fd = 3, fp = 0x3}, 
  free_filename = 240 '?'}
        old_cwd = 0xbfffe5e0 ""
#4  0x0807a8cc in main (argc=3, argv=0xbffff864) at cgi_main.c:738
        orig_bailout = {{__jmpbuf = {0, 0, 0, 0, 0, 0}, __mask_was_saved = 0, __saved_mask = {__val = {
        0 <repeats 32 times>}}}}
        orig_bailout_set = 0 '\000'
        exit_status = 0
        cgi = 0
        c = 60
        i = 3
        len = 0
        file_handle = {type = 2 '\002', filename = 0x83ba5d4 "t.php", 
  opened_path = 0x83c1e1c 'Z' <repeats 29 times>, "\204?\217*", handle = {fd = 138157296, fp = 0x83c1cf0}, 
  free_filename = 0 '\000'}
        retval = 0
        s = 0x83ba5e8 "t.php"
        behavior = 1
        no_headers = 1
        orig_optind = 1
        orig_optarg = 0x0
---Type <return> to continue, or q <return> to quit---  
        argv0 = 0x0
        script_file = 0x83ba5d4 "t.php"
        global_vars = {head = 0x0, tail = 0x0, size = 4, count = 0, dtor = 0, persistent = 0 '\000', 
  traverse_ptr = 0x40013f30}
        interactive = 0
#5  0x404f19cb in __libc_start_main (main=0x8079f34 <main>, argc=3, argv=0xbffff864, init=0x8076e1c <_init>, 
    fini=0x82310b0 <_fini>, rtld_fini=0x4000aea0 <_dl_fini>, stack_end=0xbffff85c) at ../sysdeps/generic/libc-start.c:92
        argv = (char **) 0xbffff864
        rtld_fini = (void (*)()) 0x4000aea0 <_dl_fini>
        stack_end = (void *) 0x83c609c

Starting program: /export/work/php-4.1.1/./php -f t.php

Program received signal SIGSEGV, Segmentation fault.
0x0814cd43 in zif_mcrypt_module_self_test (ht=2, return_value=0x83c6144, this_ptr=0x0, return_value_used=0) at mcrypt.c:851
851             MCRYPT_GET_MODE_DIR_ARGS(algorithms_dir);
(gdb) bt
#0  0x0814cd43 in zif_mcrypt_module_self_test (ht=2, return_value=0x83c6144, this_ptr=0x0, return_value_used=0)
    at mcrypt.c:851
#1  0x081aae4a in execute (op_array=0x83c1e6c) at ./zend_execute.c:1590
#2  0x080e5239 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at zend.c:814
#3  0x080801c1 in php_execute_script (primary_file=0xbffff7f0) at main.c:1307
#4  0x0807a8cc in main (argc=3, argv=0xbffff864) at cgi_main.c:738
#5  0x404f19cb in __libc_start_main (main=0x8079f34 <main>, argc=3, argv=0xbffff864, init=0x8076e1c <_init>, 
    fini=0x82310b0 <_fini>, rtld_fini=0x4000aea0 <_dl_fini>, stack_end=0xbffff85c) at ../sysdeps/generic/libc-start.c:92

This is fixed in php 4.1.1 and php 4.2.0dev.

Derick