[php-maint] Bug#726295: php5: segfault on zend_deactivate

[William Dauchy]

Package: php5
Version: php5 5.4.4-14+deb7u5
Severity: normal
Tags: patch

We are sometines getting segfault with the following trace:

==22607== Invalid read of size 4
==22607==    at 0x84EA438: _zval_dtor_func (zend_variables.c:46)
==22607==    by 0x84DAA42: _zval_dtor (zend_variables.h:35)
==22607==    by 0x84DAAEF: i_zval_ptr_dtor (zend_execute.h:81)
==22607==    by 0x84DB851: _zval_ptr_dtor (zend_execute_API.c:428)
==22607==    by 0x84E032A: cleanup_user_class_data (zend_opcode.c:169)
==22607==    by 0x84E0419: zend_cleanup_user_class_data (zend_opcode.c:202)
==22607==    by 0x84FC771: zend_hash_reverse_apply (zend_hash.c:799)
==22607==    by 0x84DB4BE: shutdown_executor (zend_execute_API.c:289)
==22607==    by 0x84EC528: zend_deactivate (zend.c:939)
==22607==    by 0x84744D6: php_request_shutdown (main.c:1800)
==22607==    by 0x8585386: do_cli (php_cli.c:1176)
==22607==    by 0x8585B2F: main (php_cli.c:1377)
==22607==  Address 0x4949fa8 is 0 bytes inside a block of size 20 free'd
==22607==    at 0x4007F0F: free (vg_replace_malloc.c:446)
==22607==    by 0x84BFEA5: _efree (zend_alloc.c:2437)
==22607==    by 0x851CDEB: i_zval_ptr_dtor (zend_execute.h:82)
==22607==    by 0x8541EA6: ZEND_UNSET_DIM_SPEC_VAR_CONST_HANDLER (zend_vm_execute.h:15900)
==22607==    by 0x8521499: execute_ex (zend_vm_execute.h:356)
==22607==    by 0x85214FD: zend_execute (zend_vm_execute.h:381)
==22607==    by 0x84DD3D5: zend_call_function (zend_execute_API.c:941)
==22607==    by 0x85080A9: zend_call_method (zend_interfaces.c:97)
==22607==    by 0x8515232: zend_objects_destroy_object (zend_objects.c:123)
==22607==    by 0x851B546: zend_objects_store_del_ref_by_handle_ex (zend_objects_API.c:207)
==22607==    by 0x851B426: zend_objects_store_del_ref (zend_objects_API.c:173)
==22607==    by 0x84EA474: _zval_dtor_func (zend_variables.c:54)

It appears that we found a related bug upstream:
https://bugs.php.net/64720

The patch attached is here
http://git.php.net/?p=php-src.git;a=commit;h=77fffff15762137e2d8173df9b733b4cb70fc996

The patch seems more than needed for the wheezy version.

Thanks,
-- 
William