Bug #69388 [NEW]: Use after free on recursieve calls to PHP compiler

From: dmitry Operating system: * PHP version: master-Git-2015-04-06 (Git) Package: Scripting Engine problem Bug Type: Bug Bug description:Use after free on recursieve calls to PHP compiler Description: ------------ The bug visible only with opcache disabled. PHP-5.5 and 5.6 are not affected. Test script: --------------- <?php error_reporting(E_ALL | E_STRICT); function handle_error($code, $message, $file, $line, $context) { if (!function_exists("bla")) { eval('function bla($s) {echo "$s\n";}'); } bla($message); } set_error_handler('handle_error'); eval('namespace {use Exception;}'); Expected result: ---------------- The use statement with non-compound name 'Exception' has no effect Actual result: -------------- The use statement with non-compound name 'Exception' has no effect ==24404== Invalid read of size 4 ==24404== at 0x85E9F42: _zend_is_inconsistent (zend_hash.c:44) ==24404== by 0x85EB22F: _zend_hash_add_or_update_i (zend_hash.c:475) ==24404== by 0x85EB522: _zend_hash_add (zend_hash.c:537) ==24404== by 0x85B6F4B: zend_hash_add_ptr (zend_hash.h:458) ==24404== by 0x85C2753: zend_compile_use (zend_compile.c:5188) ==24404== by 0x85C66B4: zend_compile_stmt (zend_compile.c:6726) ==24404== by 0x85C62E2: zend_compile_top_stmt (zend_compile.c:6630) ==24404== by 0x85C62C3: zend_compile_top_stmt (zend_compile.c:6625) ==24404== by 0x85C2C5D: zend_compile_namespace (zend_compile.c:5329) ==24404== by 0x85C66D4: zend_compile_stmt (zend_compile.c:6732) ==24404== by 0x85C62E2: zend_compile_top_stmt (zend_compile.c:6630) ==24404== by 0x85C62C3: zend_compile_top_stmt (zend_compile.c:6625) ==24404== Address 0x6d82b80 is 8 bytes inside a block of size 44 free'd ==24404== at 0x400826D: free (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so) ==24404== by 0x85B6142: _efree (zend_alloc.c:2216) ==24404== by 0x85BA838: zend_reset_import_tables (zend_compile.c:1628) ==24404== by 0x85BA8D7: zend_end_namespace (zend_compile.c:1648) ==24404== by 0x85BA90F: zend_do_end_compilation (zend_compile.c:1659) ==24404== by 0x859E02B: compile_string (zend_language_scanner.l:753) ==24404== by 0x8627865: ZEND_INCLUDE_OR_EVAL_SPEC_CONST_HANDLER (zend_vm_execute.h:3364) ==24404== by 0x8621632: execute_ex (zend_vm_execute.h:394) ==24404== by 0x85CAEEA: zend_call_function (zend_execute_API.c:838) ==24404== by 0x85CA732: call_user_function_ex (zend_execute_API.c:661) ==24404== by 0x85DD295: zend_error (zend.c:1231) ==24404== by 0x85C24F2: zend_compile_use (zend_compile.c:5125) -- Edit bug report at https://bugs.php.net/bug.php?id=69388&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=69388&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=69388&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=69388&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=69388&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=69388&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=69388&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=69388&r=needscript Try newer version: https://bugs.php.net/fix.php?id=69388&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=69388&r=support Expected behavior: https://bugs.php.net/fix.php?id=69388&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=69388&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=69388&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=69388&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=69388&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=69388&r=dst IIS Stability: https://bugs.php.net/fix.php?id=69388&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=69388&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=69388&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=69388&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=69388&r=mysqlcfg