php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #72411 PHP segfaults when there are too many elements added to a linked list
Submitted: 2016-06-15 11:31 UTC Modified: 2016-06-15 13:42 UTC
Votes:2
Avg. Score:3.5 ± 0.5
Reproduced:2 of 2 (100.0%)
Same Version:2 (100.0%)
Same OS:2 (100.0%)
From: pwmosquito at gmail dot com Assigned:
Status: Duplicate Package: Reproducible crash
PHP Version: Irrelevant OS: All
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: pwmosquito at gmail dot com
New email:
PHP Version: OS:

 

 [2016-06-15 11:31 UTC] pwmosquito at gmail dot com
Description:
------------
OSes: OSX (version 10.11.5), Ubuntu 14.04.3 LTS, CentOS release 6.5 (Final)
PHP versions: 5.5, 5.6, 7.0

When implementing a simple singly linked list in PHP I get a segfault if I try to add too many items to the list. To define too many: the sample code attached could cope with 29,000 items on my machine but segfaults with 30,000 items.

The interesting part is that if I first remove the items from the list, eg. with $this->head = $this->head->getNext() (method excluded from the sample code for brevity) then everything works as expected and I can add items to the list till it fill up and I get "Fatal error: Uncaught RuntimeException: Stack overflow.", which is expected.

If I add __destruct() { $this->head = null; } to LinkedList and set a breakpoint there it will segfault when I execute that line.

Test script:
---------------
<?php
class Node {
    private $next;

    public function setNext(Node $node = null) {
        $this->next = $node;
        return $this;
    }
}

class LinkedList {
    private $head;

    public function addNode() {
        $this->head = (new Node())->setNext($this->head);
    }
}

$ll = new LinkedList();
for ($i = 0; $i < 100000; $i++) {
    $ll->addNode();
}

Expected result:
----------------
no output

Actual result:
--------------
'php test.php' terminated by signal SIGSEGV (Address boundary error)

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2016-06-15 13:42 UTC] nikic@php.net
-Status: Open +Status: Duplicate
 [2016-06-15 13:42 UTC] nikic@php.net
Duplicate of bug #68606.
 [2016-06-15 14:00 UTC] brunocassol at gmail dot com
Well I can bikeshed this.

Full strace output: http://pastebin.com/Nnyufi3R

Last lines:

mmap(NULL, 2097152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_HUGETLB, -1, 0) = -1 ENOMEM (Cannot allocate memory)
mmap(NULL, 2097152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f139ea46000
munmap(0x7f139ea46000, 2097152)         = 0
mmap(NULL, 4190208, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f139e847000
munmap(0x7f139e847000, 1806336)         = 0
munmap(0x7f139ec00000, 286720)          = 0
madvise(0x7f139ea00000, 2097152, MADV_HUGEPAGE) = 0
mmap(NULL, 2097152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_HUGETLB, -1, 0) = -1 ENOMEM (Cannot allocate memory)
mmap(NULL, 2097152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f139e800000
madvise(0x7f139e800000, 2097152, MADV_HUGEPAGE) = 0
mmap(NULL, 2097152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_HUGETLB, -1, 0) = -1 ENOMEM (Cannot allocate memory)
mmap(NULL, 2097152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f139e600000
madvise(0x7f139e600000, 2097152, MADV_HUGEPAGE) = 0
--- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=0x7ffdfe29cf78} ---
+++ killed by SIGSEGV (core dumped) +++
Segmentation fault (core dumped)
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved.
Last updated: Sun Feb 16 14:01:31 2025 UTC