Repository navigation
Fix SIGSEGV on request shutdown with PHP security fix (#1509) + prepare 1.17.1 - #1510
Merged
intuibase merged 13 commits intoOct 22, 2026
Merged
Conversation
🤖 GitHub commentsJust comment with:
|
🔍 Preview links for changed docs |
✅ Elastic Docs Style Checker (Vale)No issues found on modified lines! The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale. |
|
we have the same issue. Please merge this as soon as possible |
cant agree more |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #1509
Problem
PHP security releases (e.g. 8.3.36, 7.3.33-35 from sury) contain the fix "Avoid state corruption via bailout", which resets
EG(objects_store).object_buckets = NULLat the end ofshutdown_executor().The agent released zvals holding PHP objects (
lastErrorData– error backtrace with objects/args, andlastException) inelasticApmRequestPostDeactivate, i.e. aftershutdown_executor(). Releasing an object then dereferences the NULLobject_bucketsinzend_objects_store_del()-> SIGSEGV at the end of the request.This is not a regression in the agent: 1.16.0 and 1.17.0 crash the same way, but only on PHP versions containing that fix (verified: 1.17.0 exits 0 on PHP 8.3.35 and with SIGSEGV on 8.3.36).
Changes
lastErrorDataandlastExceptionin RSHUTDOWN (beforeshutdown_executor()); post deactivate no longer releases PHP objects.objects_released_before_executor_shutdown.phpt(fails with SIGSEGV on 1.17.0 + PHP 8.3.36, passes with this change). It only detects the bug on PHP versions containing the security fix.Testing
Verified manually on
php:8.3.36-cli: agent 1.17.0 -> exit 139, agent built from this branch -> exit 0. Full phpt suite and other PHP versions still to be run in CI.