#40632 [NEW]: setcookie() with huge lifetime causes segfault or "zend_mm_heap corrupted"

[phpbugs at thequod dot de]

From: phpbugs at thequod dot de
Operating system: Ubuntu Linux
PHP version: 5CVS-2007-02-25 (CVS)
PHP Bug Type: Reproducible crash
Bug description: setcookie() with huge lifetime causes segfault or "zend_mm_heap corrupted"

Description:
------------
We use a quite huge cookie lifetime in our application
(b2evolution) which causes a segmentation fault with
current CVS.

When I rename the cookie name and value, it
becomes "zend_mm_heap corrupted" instead.

Reproduce code:
---------------
# "zend_mm_heap corrupted":
setcookie( 'foo', 'bar', 1487806696, '/blogs/', '.b2cvs18.local' );

# "Segmentation fault":
setcookie( 'cookieb2evosession', '33_9Bm6MWngjfF745MSCgoqREt3umW7ttC6',
1487806696, '/blogs/', '.b2cvs18.local' );


Expected result:
----------------
Nothing.

Actual result:
--------------
zend_mm_heap corrupted

or

Segmentation fault

--
Edit bug report at [url]http://bugs.php.net/?id=40632&edit=1[/url]
--
Try a CVS snapshot (PHP 4.4): [url]http://bugs.php.net/fix.php?id=40632&r=trysnapshot44[/url]
Try a CVS snapshot (PHP 5.2): [url]http://bugs.php.net/fix.php?id=40632&r=trysnapshot52[/url]
Try a CVS snapshot (PHP 6.0): [url]http://bugs.php.net/fix.php?id=40632&r=trysnapshot60[/url]
Fixed in CVS: [url]http://bugs.php.net/fix.php?id=40632&r=fixedcvs[/url]
Fixed in release: [url]http://bugs.php.net/fix.php?id=40632&r=alreadyfixed[/url]
Need backtrace: [url]http://bugs.php.net/fix.php?id=40632&r=needtrace[/url]
Need Reproduce Script: [url]http://bugs.php.net/fix.php?id=40632&r=needscript[/url]
Try newer version: [url]http://bugs.php.net/fix.php?id=40632&r=oldversion[/url]
Not developer issue: [url]http://bugs.php.net/fix.php?id=40632&r=support[/url]
Expected behavior: [url]http://bugs.php.net/fix.php?id=40632&r=notwrong[/url]
Not enough info: [url]http://bugs.php.net/fix.php?id=40632&r=notenoughinfo[/url]
Submitted twice: [url]http://bugs.php.net/fix.php?id=40632&r=submittedtwice[/url]
register_globals: [url]http://bugs.php.net/fix.php?id=40632&r=globals[/url]
PHP 3 support discontinued: [url]http://bugs.php.net/fix.php?id=40632&r=php3[/url]
Daylight Savings: [url]http://bugs.php.net/fix.php?id=40632&r=dst[/url]
IIS Stability: [url]http://bugs.php.net/fix.php?id=40632&r=isapi[/url]
Install GNU Sed: [url]http://bugs.php.net/fix.php?id=40632&r=gnused[/url]
Floating point limitations: [url]http://bugs.php.net/fix.php?id=40632&r=float[/url]
No Zend Extensions: [url]http://bugs.php.net/fix.php?id=40632&r=nozend[/url]
MySQL Configuration Error: [url]http://bugs.php.net/fix.php?id=40632&r=mysqlcfg[/url]

[phpbugs at thequod dot de]

ID: 40632
User updated by: phpbugs at thequod dot de
Reported By: phpbugs at thequod dot de
Status: Open
Bug Type: Reproducible crash
Operating System: Ubuntu Linux
PHP Version: 5CVS-2007-02-25 (CVS)
New Comment:

This does not seem to be related to the lifetime alone
(which is time()+10 years), but I can reproduce it with:
setcookie( 'foo', '33_9Bm6MWngjfF745MSCgoqREt3umW7ttC6',
time() )
, too.

OTOH
setcookie( 'foo', 'bar', time() );
or
setcookie( 'foo', '33_9Bm6MWngjfF745MSCgoqREt3umW7ttC6' );
do not segfault.


Previous Comments:
------------------------------------------------------------------------

[2007-02-25 23:46:34] phpbugs at thequod dot de

Description:
------------
We use a quite huge cookie lifetime in our application
(b2evolution) which causes a segmentation fault with
current CVS.

When I rename the cookie name and value, it
becomes "zend_mm_heap corrupted" instead.

Reproduce code:
---------------
# "zend_mm_heap corrupted":
setcookie( 'foo', 'bar', 1487806696, '/blogs/', '.b2cvs18.local' );

# "Segmentation fault":
setcookie( 'cookieb2evosession', '33_9Bm6MWngjfF745MSCgoqREt3umW7ttC6',
1487806696, '/blogs/', '.b2cvs18.local' );


Expected result:
----------------
Nothing.

Actual result:
--------------
zend_mm_heap corrupted

or

Segmentation fault


------------------------------------------------------------------------


--
Edit this bug report at [url]http://bugs.php.net/?id=40632&edit=1[/url]

[phpbugs at thequod dot de]

ID: 40632
User updated by: phpbugs at thequod dot de
-Summary: setcookie() with huge lifetime causes segfault or
"zend_mm_heap corrupted"
Reported By: phpbugs at thequod dot de
Status: Open
Bug Type: Reproducible crash
Operating System: Ubuntu Linux
PHP Version: 5CVS-2007-02-25 (CVS)
New Comment:

changed "Summary"


Previous Comments:
------------------------------------------------------------------------

[2007-02-25 23:57:29] phpbugs at thequod dot de

This does not seem to be related to the lifetime alone
(which is time()+10 years), but I can reproduce it with:
setcookie( 'foo', '33_9Bm6MWngjfF745MSCgoqREt3umW7ttC6',
time() )
, too.

OTOH
setcookie( 'foo', 'bar', time() );
or
setcookie( 'foo', '33_9Bm6MWngjfF745MSCgoqREt3umW7ttC6' );
do not segfault.

------------------------------------------------------------------------

[2007-02-25 23:46:34] phpbugs at thequod dot de

Description:
------------
We use a quite huge cookie lifetime in our application
(b2evolution) which causes a segmentation fault with
current CVS.

When I rename the cookie name and value, it
becomes "zend_mm_heap corrupted" instead.

Reproduce code:
---------------
# "zend_mm_heap corrupted":
setcookie( 'foo', 'bar', 1487806696, '/blogs/', '.b2cvs18.local' );

# "Segmentation fault":
setcookie( 'cookieb2evosession', '33_9Bm6MWngjfF745MSCgoqREt3umW7ttC6',
1487806696, '/blogs/', '.b2cvs18.local' );


Expected result:
----------------
Nothing.

Actual result:
--------------
zend_mm_heap corrupted

or

Segmentation fault


------------------------------------------------------------------------


--
Edit this bug report at [url]http://bugs.php.net/?id=40632&edit=1[/url]

[iliaa@php.net]

ID: 40632
Updated by: [email]iliaa@php.net[/email]
Reported By: phpbugs at thequod dot de
-Status: Open
+Status: Closed
Bug Type: Reproducible crash
Operating System: Ubuntu Linux
PHP Version: 5CVS-2007-02-25 (CVS)
New Comment:

This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
[url]http://snaps.php.net/[/url].

Thank you for the report, and for helping us make PHP better.




Previous Comments:
------------------------------------------------------------------------

[2007-02-25 23:59:43] phpbugs at thequod dot de

changed "Summary"

------------------------------------------------------------------------

[2007-02-25 23:57:29] phpbugs at thequod dot de

This does not seem to be related to the lifetime alone
(which is time()+10 years), but I can reproduce it with:
setcookie( 'foo', '33_9Bm6MWngjfF745MSCgoqREt3umW7ttC6',
time() )
, too.

OTOH
setcookie( 'foo', 'bar', time() );
or
setcookie( 'foo', '33_9Bm6MWngjfF745MSCgoqREt3umW7ttC6' );
do not segfault.

------------------------------------------------------------------------

[2007-02-25 23:46:34] phpbugs at thequod dot de

Description:
------------
We use a quite huge cookie lifetime in our application
(b2evolution) which causes a segmentation fault with
current CVS.

When I rename the cookie name and value, it
becomes "zend_mm_heap corrupted" instead.

Reproduce code:
---------------
# "zend_mm_heap corrupted":
setcookie( 'foo', 'bar', 1487806696, '/blogs/', '.b2cvs18.local' );

# "Segmentation fault":
setcookie( 'cookieb2evosession', '33_9Bm6MWngjfF745MSCgoqREt3umW7ttC6',
1487806696, '/blogs/', '.b2cvs18.local' );


Expected result:
----------------
Nothing.

Actual result:
--------------
zend_mm_heap corrupted

or

Segmentation fault


------------------------------------------------------------------------


--
Edit this bug report at [url]http://bugs.php.net/?id=40632&edit=1[/url]