[Done v1.5.2] Memory Leak with PHP 5.4 and Zen v1.5.0RC1

Okay so ill break down my issue. There is some form of memory leak related to session handling in our install of zen 1.5.0RC1. When zen_href_link function attempts to add the session id to the URL is creates a memory leak the quickly maxes the total memory for PHP and crashes with a 500 internal server error.

After debugging a few days, I narrowed the issue down to the includes/functions/sessions.php file. When i copied the 1.3.9h version to the cart, the problem stopped. According to Dr Byte these are the changes between the 1.3.9 and 1.5.0 versions of sessions.php

• forced storing of session data in database (because of security risks and technical limitations of storing in files)
• session duration adjustments for admin-only sessions, for PCI compliance
• added a line to check whether the query_factory class is loaded when an obscure error condition from PHP 5.2 (2006) is triggered. (Essentially just updated the patch from 2006 by making sure it can load the needed file. The patch itself was already present in v1.3.9.)

We think the issue may be related to the 3rd change and a php configuration issue. Recently our host said they will be converting over to PHP 5.4 in april but wanted everyone to start using it now to test their sites prior to the forced change. In a .htaccess file in the root folder, the following was added to force php 5.4 usage:

AddType x-mapp-php6 .php
AddHandler x-mapp-php6 .php

Even if i remove said .htaccess the error still occurs. But here is the phpinfo() output from the server.

PHP Version: 5.4.10 (Zend: 2.4.0)   PHP Memory Limit: 90M PHP Safe Mode: Off 
PHP File Uploads: On    Max Size: 40M POST Max Size: 8M 
Database Data Size: 67,350 kB Database Index Size: 19,350 kB 

 
Zen Cart 1.5.0RC1
Database Patch Level: 1.5.0
v1.5.0RC1   [2011-10-24 13:51:49]   (Version Update 1.3.9->1.5.0RC1)



PHP Version 5.4.10 

System  Linux infong 2.4 #1 SMP Fri May 18 17:32:59 UTC 2012 i686 GNU/Linux  
Build Date  Jan 11 2013 10:02:17  
Configure Command  '../configure' '--program-suffix=6' '--with-pear=/usr/lib/php6' '--with-config-file-path=/usr/lib/php6' '--with-mysqli=/usr/bin/mysql_config' '--with-mysql=/usr' '--with-kerberos' '--with-imap-ssl' '--enable-soap' '--with-xsl' '--enable-mbstring=all' '--with-curl' '--with-mcrypt' '--with-gd' '--with-pdo-mysql' '--with-freetype-dir' '--with-libxml-dir' '--with-zlib' '--enable-debug=no' '--enable-safe-mode=no' '--enable-discard-path=no' '--with-png-dir' '--enable-track-vars' '--with-db' '--with-gdbm' '--enable-force-cgi-redirect' '--with-ttf' '--enable-ftp' '--enable-dbase' '--enable-memory-limit' '--enable-calendar' '--enable-wddx' '--with-jpeg-dir' '--enable-bcmath' '--enable-gd-imgstrttf' '--enable-shmop' '--enable-mhash' '--with-mhash' '--with-openssl' '--enable-xslt' '--with-xslt-sablot' '--with-dom' '--with-dom-xslt' '--with-dom-exslt' '--with-imap' '--with-iconv' '--with-bz2' '--with-gettext' '--enable-exif' '--with-sqlite' '--enable-sqlite-utf8' '--enable-zip' '--with-tidy' '--enable-intl'  
Server API  CGI/FastCGI  
Virtual Directory Support  disabled  
Configuration File (php.ini) Path  /usr/lib/php6  
Loaded Configuration File  /usr/lib/php6/php.ini  
Scan this dir for additional .ini files  (none)  
Additional .ini files parsed  (none)  
PHP API  20100412  
PHP Extension  20100525  
Zend Extension  220100525  
Zend Extension Build  API220100525,NTS  
PHP Extension Build  API20100525,NTS  
Debug Build  no  
Thread Safety  disabled  
Zend Signal Handling  disabled  
Zend Memory Manager  enabled  
Zend Multibyte Support  provided by mbstring  
IPv6 Support  enabled  
DTrace Support  disabled  
Registered PHP Streams https, ftps, compress.zlib, compress.bzip2, php, file, glob, data, http, ftp, phar, zip 
Registered Stream Socket Transports tcp, udp, unix, udg, ssl, sslv3, sslv2, tls 
Registered Stream Filters zlib.*, bzip2.*, convert.iconv.*, mcrypt.*, mdecrypt.*, string.rot13, string.toupper, string.tolower, string.strip_tags, convert.*, consumed, dechunk 

 This program makes use of the Zend Scripting Language Engine:
Zend Engine v2.4.0, Copyright (c) 1998-2012 Zend Technologies
 


--------------------------------------------------------------------------------

PHP Credits

--------------------------------------------------------------------------------

Configuration
bcmath
BCMath support  enabled  

Directive Local Value Master Value 
bcmath.scale 0 0 


bz2
BZip2 Support  Enabled  
Stream Wrapper support  compress.bzip2://  
Stream Filter support  bzip2.decompress, bzip2.compress  
BZip2 Version  1.0.5, 10-Dec-2007  


calendar
Calendar support  enabled  


cgi-fcgi
Directive Local Value Master Value 
cgi.check_shebang_line 1 1 
cgi.discard_path 0 0 
cgi.fix_pathinfo 1 1 
cgi.force_redirect 1 1 
cgi.nph 0 0 
cgi.redirect_status_env no value no value 
cgi.rfc2616_headers 0 0 
fastcgi.logging 1 1 


Core
PHP Version  5.4.10  

Directive Local Value Master Value 
allow_url_fopen On On 
allow_url_include Off Off 
always_populate_raw_post_data Off Off 
arg_separator.input & & 
arg_separator.output & & 
asp_tags Off Off 
auto_append_file no value no value 
auto_globals_jit On On 
auto_prepend_file no value no value 
browscap /usr/lib/php6/browscap.ini /usr/lib/php6/browscap.ini 
default_charset no value no value 
default_mimetype text/html text/html 
disable_classes no value no value 
disable_functions no value no value 
display_errors Off On 
display_startup_errors Off Off 
doc_root no value no value 
docref_ext no value no value 
docref_root no value no value 
enable_dl On On 
enable_post_data_reading On On 
error_append_string no value no value 
error_log /************************* no value 
error_prepend_string no value no value 
error_reporting 22519 22519 
exit_on_timeout Off Off 
expose_php On On 
extension_dir /usr/lib/php/extensions/no-debug-non-zts-20060613 /usr/lib/php/extensions/no-debug-non-zts-20060613 
file_uploads On On 
highlight.comment #FF8000 #FF8000 
highlight.default #0000BB #0000BB 
highlight.html #000000 #000000 
highlight.keyword #007700 #007700 
highlight.string #DD0000 #DD0000 
html_errors On On 
ignore_repeated_errors Off Off 
ignore_repeated_source Off Off 
ignore_user_abort Off Off 
implicit_flush Off Off 
include_path .:/usr/lib/php6 .:/usr/lib/php6 
log_errors On Off 
log_errors_max_len 0 1024 
mail.add_x_header Off Off 
mail.force_extra_parameters no value no value 
mail.log no value no value 
max_execution_time 60 50000 
max_file_uploads 20 20 
max_input_nesting_level 64 64 
max_input_time -1 -1 
max_input_vars 5000 5000 
memory_limit 90M 90M 
open_basedir no value no value 
output_buffering 0 0 
output_handler no value no value 
post_max_size 8M 8M 
precision 14 14 
realpath_cache_size 16K 16K 
realpath_cache_ttl 120 120 
register_argc_argv On On 
report_memleaks On On 
report_zend_debug On On 
request_order no value no value 
sendmail_from no value no value 
sendmail_path /usr/sbin/sendmail -t -i /usr/sbin/sendmail -t -i 
serialize_precision 17 17 
short_open_tag On On 
SMTP localhost localhost 
smtp_port 25 25 
sql.safe_mode Off Off 
track_errors Off Off 
unserialize_callback_func no value no value 
upload_max_filesize 40M 40M 
upload_tmp_dir no value no value 
user_dir no value no value 
user_ini.cache_ttl 300 300 
user_ini.filename .user.ini .user.ini 
variables_order EGPCS EGPCS 
xmlrpc_error_number 0 0 
xmlrpc_errors Off Off 
zend.detect_unicode On On 
zend.enable_gc On On 
zend.multibyte Off Off 
zend.script_encoding no value no value 


ctype
ctype functions  enabled  


curl
cURL support  enabled  
cURL Information  7.21.0  
Age  3  
Features  
AsynchDNS  No  
Debug  No  
GSS-Negotiate  Yes  
IDN  Yes  
IPv6  Yes  
Largefile  Yes  
NTLM  Yes  
SPNEGO  No  
SSL  Yes  
SSPI  No  
krb4  No  
libz  Yes  
CharConv  No  
Protocols  dict, file, ftp, ftps, http, https, imap, imaps, ldap, ldaps, pop3, pop3s, rtsp, scp, sftp, smtp, smtps, telnet, tftp  
Host  i486-pc-linux-gnu  
SSL Version  OpenSSL/0.9.8o  
ZLib Version  1.2.3.4  
libSSH Version  libssh2/1.2.6  


date
date/time support  enabled  
"Olson" Timezone Database Version  2012.10  
Timezone Database  internal  
Default timezone  America/New_York  

Directive Local Value Master Value 
date.default_latitude 31.7667 31.7667 
date.default_longitude 35.2333 35.2333 
date.sunrise_zenith 90.583333 90.583333 
date.sunset_zenith 90.583333 90.583333 
date.timezone no value no value 


dba
DBA support  enabled  
Supported handlers  gdbm cdb cdb_make inifile flatfile  

Directive Local Value Master Value 
dba.default_handler flatfile flatfile 


dom
DOM/XML  enabled  
DOM/XML API Version  20031129  
libxml Version  2.7.8  
HTML Support  enabled  
XPath Support  enabled  
XPointer Support  enabled  
Schema Support  enabled  
RelaxNG Support  enabled  


ereg
Regex Library  Bundled library enabled  


exif
EXIF Support  enabled  
EXIF Version  1.4 $Id$  
Supported EXIF Version  0220  
Supported filetypes  JPEG,TIFF  

Directive Local Value Master Value 
exif.decode_jis_intel JIS JIS 
exif.decode_jis_motorola JIS JIS 
exif.decode_unicode_intel UCS-2LE UCS-2LE 
exif.decode_unicode_motorola UCS-2BE UCS-2BE 
exif.encode_jis no value no value 
exif.encode_unicode ISO-8859-15 ISO-8859-15 


fileinfo
fileinfo support  enabled  
version  1.0.5  


filter
Input Validation and Filtering  enabled  
Revision  $Id: e523cdc8829892d1b4f9cb7c3c57b2ba1c36b9ea $  

Directive Local Value Master Value 
filter.default unsafe_raw unsafe_raw 
filter.default_flags no value no value 


ftp
FTP support  enabled  


gd
GD Support  enabled  
GD Version  bundled (2.0.34 compatible)  
FreeType Support  enabled  
FreeType Linkage  with freetype  
FreeType Version  2.4.2  
GIF Read Support  enabled  
GIF Create Support  enabled  
JPEG Support  enabled  
libJPEG Version  6b  
PNG Support  enabled  
libPNG Version  1.2.44  
WBMP Support  enabled  
XBM Support  enabled  

Directive Local Value Master Value 
gd.jpeg_ignore_warning 0 0 


gettext
GetText Support  enabled  


hash
hash support  enabled  
Hashing Engines  md2 md4 md5 sha1 sha224 sha256 sha384 sha512 ripemd128 ripemd160 ripemd256 ripemd320 whirlpool tiger128,3 tiger160,3 tiger192,3 tiger128,4 tiger160,4 tiger192,4 snefru snefru256 gost adler32 crc32 crc32b fnv132 fnv164 joaat haval128,3 haval160,3 haval192,3 haval224,3 haval256,3 haval128,4 haval160,4 haval192,4 haval224,4 haval256,4 haval128,5 haval160,5 haval192,5 haval224,5 haval256,5  


iconv
iconv support  enabled  
iconv implementation  glibc  
iconv library version  2.11.3  

Directive Local Value Master Value 
iconv.input_encoding ISO-8859-1 ISO-8859-1 
iconv.internal_encoding ISO-8859-1 ISO-8859-1 
iconv.output_encoding ISO-8859-1 ISO-8859-1 


imap
IMAP c-Client Version  2007e  
SSL Support  enabled  
Kerberos Support  enabled  


intl
Internationalization support enabled 
version  1.1.0  
ICU version  4.4.1  
ICU Data version  4.4.0.1  

Directive Local Value Master Value 
intl.default_locale no value no value 
intl.error_level 0 0 


json
json support  enabled  
json version  1.2.1  


libxml
libXML support  active  
libXML Compiled Version  2.7.8  
libXML Loaded Version  20708  
libXML streams  enabled  


mbstring
Multibyte Support  enabled  
Multibyte string engine  libmbfl  
HTTP input encoding translation  disabled  
libmbfl version  1.3.2  

mbstring extension makes use of "streamable kanji code filter and converter", which is distributed under the GNU Lesser General Public License version 2.1. 

Multibyte (japanese) regex support  enabled  
Multibyte regex (oniguruma) backtrack check  On  
Multibyte regex (oniguruma) version  4.7.1  

Directive Local Value Master Value 
mbstring.detect_order no value no value 
mbstring.encoding_translation Off Off 
mbstring.func_overload 0 0 
mbstring.http_input pass pass 
mbstring.http_output pass pass 
mbstring.http_output_conv_mimetypes ^(text/|application/xhtml\+xml) ^(text/|application/xhtml\+xml) 
mbstring.internal_encoding no value no value 
mbstring.language neutral neutral 
mbstring.strict_detection Off Off 
mbstring.substitute_character no value no value 


mcrypt
mcrypt support enabled 
mcrypt_filter support enabled 
Version  2.5.8  
Api No  20021217  
Supported ciphers  cast-128 gost rijndael-128 twofish arcfour cast-256 loki97 rijndael-192 saferplus wake blowfish-compat des rijndael-256 serpent xtea blowfish enigma rc2 tripledes  
Supported modes  cbc cfb ctr ecb ncfb nofb ofb stream  

Directive Local Value Master Value 
mcrypt.algorithms_dir no value no value 
mcrypt.modes_dir no value no value 


mhash
MHASH support  Enabled  
MHASH API Version  Emulated Support  


mysql
MySQL Support enabled 
Active Persistent Links  0  
Active Links  1  
Client API version  5.1.66  
MYSQL_MODULE_TYPE  external  
MYSQL_SOCKET  /var/run/mysqld/mysqld.sock  
MYSQL_INCLUDE  -I/usr/include/mysql  
MYSQL_LIBS  -L/usr/lib -lmysqlclient  

Directive Local Value Master Value 
mysql.allow_local_infile On On 
mysql.allow_persistent On On 
mysql.connect_timeout 60 60 
mysql.default_host no value no value 
mysql.default_password no value no value 
mysql.default_port no value no value 
mysql.default_socket /tmp/mysqld.sock /tmp/mysqld.sock 
mysql.default_user no value no value 
mysql.max_links Unlimited Unlimited 
mysql.max_persistent Unlimited Unlimited 
mysql.trace_mode Off Off 


mysqli
MysqlI Support enabled 
Client API library version  5.1.66  
Active Persistent Links  0  
Inactive Persistent Links  0  
Active Links  0  
Client API header version  5.1.49  
MYSQLI_SOCKET  /var/run/mysqld/mysqld.sock  

Directive Local Value Master Value 
mysqli.allow_local_infile On On 
mysqli.allow_persistent On On 
mysqli.default_host no value no value 
mysqli.default_port 3306 3306 
mysqli.default_pw no value no value 
mysqli.default_socket /tmp/mysqld.sock /tmp/mysqld.sock 
mysqli.default_user no value no value 
mysqli.max_links Unlimited Unlimited 
mysqli.max_persistent Unlimited Unlimited 
mysqli.reconnect Off Off 


mysqlnd
mysqlnd enabled 
Version  mysqlnd 5.0.10 - 20111026 - $Id: b0b3b15c693b7f6aeb3aa66b646fee339f175e39 $  
Compression  supported  
SSL  supported  
Command buffer size  4096  
Read buffer size  32768  
Read timeout  31536000  
Collecting statistics  Yes  
Collecting memory statistics  No  
Tracing  n/a  
Loaded plugins  mysqlnd,example,debug_trace,auth_plugin_mysql_native_password,auth_plugin_mysql_clear_password  
API Extensions  pdo_mysql  

example statistics  
stat1  0  
stat2  0  


openssl
OpenSSL support  enabled  
OpenSSL Library Version  OpenSSL 0.9.8o 01 Jun 2010  
OpenSSL Header Version  OpenSSL 0.9.8o 01 Jun 2010  


pcre
PCRE (Perl Compatible Regular Expressions) Support  enabled  
PCRE Library Version  8.31 2012-07-06  

Directive Local Value Master Value 
pcre.backtrack_limit 1000000 1000000 
pcre.recursion_limit 100000 100000 


PDO
PDO support enabled 
PDO drivers  sqlite, mysql  


pdo_mysql
PDO Driver for MySQL enabled 
Client API version  mysqlnd 5.0.10 - 20111026 - $Id: b0b3b15c693b7f6aeb3aa66b646fee339f175e39 $  

Directive Local Value Master Value 
pdo_mysql.default_socket /tmp/mysql.sock /tmp/mysql.sock 


pdo_sqlite
PDO Driver for SQLite 3.x enabled 
SQLite Library  3.7.7.1  


Phar
Phar: PHP Archive support enabled 
Phar EXT version  2.0.1  
Phar API version  1.1.1  
SVN revision  $Id: cc7eac717db60fe3deade794d4ae082fe97279ed $  
Phar-based phar archives  enabled  
Tar-based phar archives  enabled  
ZIP-based phar archives  enabled  
gzip compression  enabled  
bzip2 compression  enabled  
Native OpenSSL support  enabled  

Phar based on pear/PHP_Archive, original concept by Davey Shafik.
Phar fully realized by Gregory Beaver and Marcus Boerger.
Portions of tar implementation Copyright (c) 2003-2009 Tim Kientzle. 

Directive Local Value Master Value 
phar.cache_list no value no value 
phar.readonly On On 
phar.require_hash On On 


posix
Revision  $Id: 967584c6fadb3467f31abe8e13caa8764df85867 $  


Reflection
Reflection enabled 
Version  $Id: 60f1e547a6dd00239162151e701566debdcee660 $  


session
Session Support  enabled  
Registered save handlers  files user sqlite  
Registered serializer handlers  php php_binary wddx  

Directive Local Value Master Value 
session.auto_start Off Off 
session.cache_expire 180 180 
session.cache_limiter nocache nocache 
session.cookie_domain .*********** no value 
session.cookie_httponly Off Off 
session.cookie_lifetime 0 0 
session.cookie_path /shop/wfadmin / 
session.cookie_secure Off Off 
session.entropy_file /dev/urandom /dev/urandom 
session.entropy_length 32 32 
session.gc_divisor 2 100 
session.gc_maxlifetime 900 1440 
session.gc_probability 1 1 
session.hash_bits_per_character 4 4 
session.hash_function 0 0 
session.name zenAdminID PHPSESSID 
session.referer_check no value no value 
session.save_handler user files 
session.save_path **************shop/cache /tmp 
session.serialize_handler php php 
session.upload_progress.cleanup On On 
session.upload_progress.enabled On On 
session.upload_progress.freq 1% 1% 
session.upload_progress.min_freq 1 1 
session.upload_progress.name PHP_SESSION_UPLOAD_PROGRESS PHP_SESSION_UPLOAD_PROGRESS 
session.upload_progress.prefix upload_progress_ upload_progress_ 
session.use_cookies On On 
session.use_only_cookies On On 
session.use_trans_sid 0 0 


shmop
shmop support  enabled  


SimpleXML
Simplexml support enabled 
Revision  $Id: 5514f0fc897197ca9a199fb93b8b5d9135ad711a $  
Schema support  enabled  


soap
Soap Client  enabled  
Soap Server  enabled  

Directive Local Value Master Value 
soap.wsdl_cache 1 1 
soap.wsdl_cache_dir /tmp /tmp 
soap.wsdl_cache_enabled 1 1 
soap.wsdl_cache_limit 5 5 
soap.wsdl_cache_ttl 86400 86400 


SPL
SPL support enabled 
Interfaces  Countable, OuterIterator, RecursiveIterator, SeekableIterator, SplObserver, SplSubject  
Classes  AppendIterator, ArrayIterator, ArrayObject, BadFunctionCallException, BadMethodCallException, CachingIterator, CallbackFilterIterator, DirectoryIterator, DomainException, EmptyIterator, FilesystemIterator, FilterIterator, GlobIterator, InfiniteIterator, InvalidArgumentException, IteratorIterator, LengthException, LimitIterator, LogicException, MultipleIterator, NoRewindIterator, OutOfBoundsException, OutOfRangeException, OverflowException, ParentIterator, RangeException, RecursiveArrayIterator, RecursiveCachingIterator, RecursiveCallbackFilterIterator, RecursiveDirectoryIterator, RecursiveFilterIterator, RecursiveIteratorIterator, RecursiveRegexIterator, RecursiveTreeIterator, RegexIterator, RuntimeException, SplDoublyLinkedList, SplFileInfo, SplFileObject, SplFixedArray, SplHeap, SplMinHeap, SplMaxHeap, SplObjectStorage, SplPriorityQueue, SplQueue, SplStack, SplTempFileObject, UnderflowException, UnexpectedValueException  


SQLite
SQLite support enabled 
PECL Module version  2.0-dev $Id: sqlite.c 299692 2010-05-24 14:11:39Z dmitry $  
SQLite Library  2.8.17  
SQLite Encoding  UTF-8  

Directive Local Value Master Value 
sqlite.assoc_case 0 0 


sqlite3
SQLite3 support enabled 
SQLite3 module version  0.7  
SQLite Library  3.7.7.1  

Directive Local Value Master Value 
sqlite3.extension_dir no value no value 


standard
Dynamic Library Support  enabled  
Path to sendmail  /usr/sbin/sendmail -t -i  

Directive Local Value Master Value 
assert.active 1 1 
assert.bail 0 0 
assert.callback no value no value 
assert.quiet_eval 0 0 
assert.warning 1 1 
auto_detect_line_endings 0 0 
default_socket_timeout 60 60 
from no value no value 
url_rewriter.tags a=href,area=href,frame=src,form=fakeentry,fieldset= a=href,area=href,frame=src,form=fakeentry,fieldset= 
user_agent no value no value 


tidy
Tidy support enabled 
libTidy Release  25 March 2009  
Extension Version  2.0 ($Id$)  

Directive Local Value Master Value 
tidy.clean_output 0 0 
tidy.default_config no value no value 


tokenizer
Tokenizer Support  enabled  


wddx
WDDX Support enabled 
WDDX Session Serializer  enabled  


xml
XML Support  active  
XML Namespace Support  active  
libxml2 Version  2.7.8  


xmlreader
XMLReader  enabled  


xmlwriter
XMLWriter  enabled  


xsl
XSL  enabled  
libxslt Version  1.1.26  
libxslt compiled against libxml Version  2.7.8  
EXSLT  enabled  
libexslt Version  1.1.26  


zip
Zip  enabled  
Extension Version  $Id: 74f868b5c3320a31af332207df35d4ff525cba1e $  
Zip version  1.11.0  
Libzip version  0.10.1  


zlib
ZLib Support enabled 
Stream Wrapper  compress.zlib://  
Stream Filter  zlib.inflate, zlib.deflate  
Compiled Version  1.2.3.4  
Linked Version  1.2.3.4  

Directive Local Value Master Value 
zlib.output_compression Off Off 
zlib.output_compression_level -1 -1 
zlib.output_handler no value no value 


Additional Modules
Module Name 

Now for installed modifcations we have the following:

XCheckout - Ajax Checkout System
COWOA Module - Checkout Without Account Module

In hindsight, I'm guessing that maybe it's not about the 2006 patch for reloading query_factory if it's missing.
Instead it's more likely that the session storage is now forced to database instead of to file. Did you have your old site set to STORE_SESSIONS in 'file'?

Have you tested all of this with a fresh uncustomized copy of Zen Cart, without any plugins or modifications made? ie: just a fresh install with demo data?

That information would be very helpful.

The config file shows STORE_SESSIONS set to db.

DrByte:

In hindsight, I'm guessing that maybe it's not about the 2006 patch for reloading query_factory if it's missing.
Instead it's more likely that the session storage is now forced to database instead of to file. Did you have your old site set to STORE_SESSIONS in 'file'?

Is this store using shared SSL, or does it have its own SSL to match your domain name?

I debugged the sessions file and i manually added the 3 changes one at a time to see when it has an issue. The issue occurs when this statement is gone in the new file versus the old:

if (STORE_SESSIONS == 'db') {
SESSION FUNCTIONS HERE
}

In the new version that is no longer around those functions as you force it to store in the database, however when its added back into the current version of the sessions file the leak goes away. And i verified our config is set to use the database.

Has our own SSL for our domain, no shared SSL.

DrByte:

Is this store using shared SSL, or does it have its own SSL to match your domain name?

See my post in this thread, it has the solution and explanation:

http://www.zen-cart.com/showthread.php?207435-php-5-4-fatal-error-Allowed-memory-size-of-83886080-bytes-exhausted/page2

Changes committed to v1.6.0 https://github.com/zencart/zencart/commit/8f47bc47bdf6c8a189f51d00e26deb80026d2886 and will be included in v1.5.2.