Bug #69025 [NEW]: Invalid read of size 4 when calling __callStatic.

From: arjen at react dot com Operating system: Linux PHP version: master-Git-2015-02-11 (Git) Package: Scripting Engine problem Bug Type: Bug Bug description:Invalid read of size 4 when calling __callStatic. Description: ------------ USE_ZEND_ALLOC=0 valgrind --track-origins=yes --leak-check=full php-src/sapi/cli/php script.php gives invalid read warning. Caused by https://github.com/php/php-src/commit/f5a9cfc33ab86e343b5cbf0d0a39a62037c32975 Test script: --------------- <?php class A { public static function __callStatic($method, $args) { } } A::init(); Expected result: ---------------- No memory error. Actual result: -------------- ==11916== Invalid read of size 4 ==11916== at 0x991BBF: ZEND_DO_FCALL_SPEC_HANDLER (zend_vm_execute.h:604) ==11916== by 0x991112: execute_ex (zend_vm_execute.h:352) ==11916== by 0x99126B: zend_execute (zend_vm_execute.h:381) ==11916== by 0x943954: zend_execute_scripts (zend.c:1277) ==11916== by 0x8BA620: php_execute_script (main.c:2549) ==11916== by 0x9E74B9: do_cli (php_cli.c:982) ==11916== by 0x9E8462: main (php_cli.c:1361) ==11916== Address 0xc59d414 is 4 bytes inside a block of size 64 free'd ==11916== at 0x4C2B200: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==11916== by 0x913ADC: _efree (zend_alloc.c:2208) ==11916== by 0x980B76: zend_std_callstatic_user_call (zend_object_handlers.c:1158) ==11916== by 0x991B70: ZEND_DO_FCALL_SPEC_HANDLER (zend_vm_execute.h:596) ==11916== by 0x991112: execute_ex (zend_vm_execute.h:352) ==11916== by 0x99126B: zend_execute (zend_vm_execute.h:381) ==11916== by 0x943954: zend_execute_scripts (zend.c:1277) ==11916== by 0x8BA620: php_execute_script (main.c:2549) ==11916== by 0x9E74B9: do_cli (php_cli.c:982) ==11916== by 0x9E8462: main (php_cli.c:1361) -- Edit bug report at https://bugs.php.net/bug.php?id=69025&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=69025&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=69025&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=69025&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=69025&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=69025&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=69025&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=69025&r=needscript Try newer version: https://bugs.php.net/fix.php?id=69025&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=69025&r=support Expected behavior: https://bugs.php.net/fix.php?id=69025&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=69025&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=69025&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=69025&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=69025&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=69025&r=dst IIS Stability: https://bugs.php.net/fix.php?id=69025&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=69025&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=69025&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=69025&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=69025&r=mysqlcfg