The following script cause a core dump, but only with "blowfish":

<?
$td = mcrypt_module_open ("blowfish", "", "ecb", "");
mcrypt_generic_init ($td, 'secret key', "\0\0\0\0\0\0\0\0");
$msg = mcrypt_generic ($td, 'secret phrase');
echo bin2hex($msg);                   
?>

Here's the backtrace:

[cmv]$ /usr/local/bin/php test.php 
Segmentation fault (core dumped)
[cmv]$ gdb /usr/local/bin/php core     
GNU gdb 19991004
Copyright 1998 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-redhat-linux"...
Core was generated by `/usr/local/bin/php test.php'.
Program terminated with signal 11, Segmentation fault.
Reading symbols from /lib/libpam.so.0...done.
Reading symbols from /lib/libdl.so.2...done.
Reading symbols from /usr/local/lib/libz.so.1...done.
Reading symbols from /usr/lib/libsnmp.so.0...done.
Reading symbols from /usr/lib/libpq.so.2.0...done.
Reading symbols from /usr/local/mysql/lib/mysql/libmysqlclient.so.6...done.
Reading symbols from /usr/local/lib/libmcrypt.so.4...done.
Reading symbols from /usr/lib/libltdl.so.0...done.
Reading symbols from /usr/lib/libxml.so.2...done.
Reading symbols from /usr/local/lib/libcurl.so.0...done.
Reading symbols from /lib/libresolv.so.2...done.
Reading symbols from /lib/libm.so.6...done.
Reading symbols from /lib/libcrypt.so.1...done.
Reading symbols from /lib/libnsl.so.1...done.
Reading symbols from /lib/libc.so.6...done.
Reading symbols from /lib/ld-linux.so.2...done.
Reading symbols from /lib/libnss_files.so.2...done.
Reading symbols from /usr/lib/gconv/ISO8859-1.so...done.
Reading symbols from /usr/local/lib/libmcrypt/blowfish.so...done.
Reading symbols from /usr/local/lib/libmcrypt/ecb.so...done.
#0  mdecrypt (td=0x820e068, buf=0x820e068, a=0x8213010, b=1074361008) at mcrypt_modules.c:383
383     {
(gdb) bt
#0  mdecrypt (td=0x820e068, buf=0x820e068, a=0x8213010, b=1074361008) at mcrypt_modules.c:383
#1  0x4009692b in mcrypt_enc_is_block_algorithm (td=0x820e068) at mcrypt_modules.c:333
#2  0x40096608 in mcrypt_module_open (algorithm=0x820e04c "blowfish", a_directory=0x0, mode=0x82132c4 "ecb", 
    m_directory=0x0) at mcrypt_modules.c:169
#3  0x807844b in php_if_mcrypt_module_open (ht=4, return_value=0x821287c, this_ptr=0x0, return_value_used=1)
    at mcrypt.c:418
#4  0x81404f9 in execute (op_array=0x820e0c4) at ./zend_execute.c:1489
#5  0x810907b in zend_execute_scripts (type=8, file_count=3) at zend.c:743
#6  0x8066dbc in php_execute_script (primary_file=0xbffffa80) at main.c:1166
#7  0x8064f79 in main (argc=2, argv=0xbffffaf4) at cgi_main.c:736

- Colin