[php-src] Issue #21302: SEGV in free_subpats_table

[email protected] (gitbugr)
Newsgroups php.bugs
Message-ID <[email protected]>
Issue: https://github.com/php/php-src/issues/21302
Author: gitbugr

### Description

Haven't been able to reproduce in 8.3, but still breaks in 8.5. This bug is occurring for some reason in our production code, preventing us from updating our instances to new aarch64 images with 8.4 installed. Unfortunately, we have not been able to determine how to build a minimally reproducible example.

This manifests in such a way as to break our php-fpm service, which then returns 502s and occasionally recovers itself, other times it stays broken until php-fpm is restarted.

We also believe we've seen this manifest in more than one place previously. We encountered a bug in our app that manifested in the same way, though we no longer have logs to confirm it. We got around it by restructuring some code and it no longer manifested. Unclear as to why, would guess it had something to do with memory layout at that time.

We have been using remi's binaries, but as part of debugging, have built PHP 8.4.18 with ASAN, and simulating the exact http request causing us problems with php-cgi gave us this:

```
AddressSanitizer:DEADLYSIGNAL
=================================================================
==284221==ERROR: AddressSanitizer: SEGV on unknown address 0xffff8d8fd2b0 (pc 0x00000061a1dc bp 0xfffffaff3a00 sp 0xfffffaff3a00 T0)
==284221==The signal is caused by a READ memory access.
    #0 0x61a1dc in free_subpats_table /root/asan/php-src-php-8.4.18/ext/pcre/php_pcre.c:523
    #1 0x61bda4 in php_free_pcre_cache /root/asan/php-src-php-8.4.18/ext/pcre/php_pcre.c:175
    #2 0x12dfb88 in zend_hash_destroy /root/asan/php-src-php-8.4.18/Zend/zend_hash.c:1781
    #3 0x61bca4 in zm_globals_dtor_pcre /root/asan/php-src-php-8.4.18/ext/pcre/php_pcre.c:316
    #4 0x1064ba0 in module_destructor /root/asan/php-src-php-8.4.18/Zend/zend_API.c:3353
    #5 0x13b0d60 in module_destructor_zval /root/asan/php-src-php-8.4.18/Zend/zend.c:904
    #6 0x12e2c80 in _zend_hash_del_el_ex /root/asan/php-src-php-8.4.18/Zend/zend_hash.c:1494
    #7 0x12e2c80 in _zend_hash_del_el /root/asan/php-src-php-8.4.18/Zend/zend_hash.c:1521
    #8 0x12e2c80 in zend_hash_graceful_reverse_destroy /root/asan/php-src-php-8.4.18/Zend/zend_hash.c:2046
    #9 0x1060be0 in zend_destroy_modules /root/asan/php-src-php-8.4.18/Zend/zend_API.c:2594
    #10 0x13b4430 in zend_shutdown /root/asan/php-src-php-8.4.18/Zend/zend.c:1166
    #11 0xf1a1e4 in php_module_shutdown /root/asan/php-src-php-8.4.18/main/main.c:2449
    #12 0x13c40ec in main /root/asan/php-src-php-8.4.18/sapi/cgi/cgi_main.c:2670
    #13 0xffff9607953c in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #14 0xffff96079614 in __libc_start_main_impl ../csu/libc-start.c:389
    #15 0x480dac in _start (/usr/local/bin/php-cgi+0x480dac)

SUMMARY: AddressSanitizer: SEGV /root/asan/php-src-php-8.4.18/ext/pcre/php_pcre.c:523 in free_subpats_table
```

- OPcache on/off makes no difference
- pcre.jit=0 makes no difference

Modules (sorry I haven't cut-down, was hard to run our app without some of them, unpicking and recompiling each time was proving to be a massive pain.):
```
[PHP Modules]
bcmath
bz2
calendar
cgi-fcgi
Core
ctype
curl
date
dom
exif
fileinfo
filter
gd
gettext
gmp
hash
iconv
igbinary
intl
json
libxml
mbstring
mysqli
mysqlnd
openssl
pcntl
pcre
PDO
pdo_mysql
pdo_sqlite
Phar
posix
random
redis
Reflection
session
shmop
SimpleXML
soap
sockets
sodium
SPL
sqlite3
standard
sysvmsg
sysvsem
sysvshm
tidy
tokenizer
xml
xmlreader
xmlwriter
xsl
zip

[Zend Modules]

```

I am in unfamiliar territory, I do not know much about php internals, nor have I touched C/gdb/valgrind/etc very much. Hopefully this is enough but if there is anything you need from me that would be of help, I will gladly do my best to provide! As mentioned, this is preventing us from upgrading to php 8.4 (or 8.5) at this moment

### PHP Version

```plain
PHP 8.4.18 (cgi-fcgi) (built: Feb 26 2026 13:16:29) (NTS)
Copyright (c) The PHP Group
Zend Engine v4.4.18, Copyright (c) Zend Technologies
```

### Operating System

AlmaLinux 9, AARCH64
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.