php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #41101 segfault when setcookie deletes session cookie with path information
Submitted: 2007-04-16 12:02 UTC Modified: 2007-04-16 12:49 UTC
From: tokul at users dot sourceforge dot net Assigned:
Status: Closed Package: Reproducible crash
PHP Version: 6CVS-2007-04-16 (snap) OS: Linux Debian Etch
Private report: No CVE-ID: None
View Developer Edit
 [2007-04-16 12:02 UTC] tokul at users dot sourceforge dot net 
Description:
------------
PHP6-200704160630 snapshot compiled with --prefix, --with-apxs2 and --config-path options. Apache 2.2.4. If setcookie() tries to delete session cookie, it causes 'zend_mm_heap corrupted' error or segfault in apache logs.

I have found other bug reports about 'zend_mm_heap corrupted' error, but they are closed in February or March. I can reproduce crash in current PHP6 snapshot. Code does not crash if fourth argument is set to '/'. Script is called from /path/ directory.


Reproduce code:
---------------
session_start();
setcookie(session_name(), '', 0, '/path');
die('test');


Expected result:
----------------
test

Actual result:
--------------
Browser tries to download php script and I get 'zend_mm_heap corrupted' message in error_log.

Real code generated 'child pid #### exit signal Segmentation fault (11)'. I wanted to simplify code and got zend_mm_heap error instead of segfault.

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2007-04-16 12:49 UTC] tony2001@php.net 
This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.
 
PHP Copyright © 2001-2026 The PHP Group
All rights reserved. 		Last updated: Thu Oct 08 11:00:02 2026 UTC