Bug #69868 [NEW]: Invalid read of size 1 in zend_compile_short_circuiting

From: arjen at react dot com Operating system: PHP version: 7.0Git-2015-06-18 (Git) Package: Scripting Engine problem Bug Type: Bug Bug description:Invalid read of size 1 in zend_compile_short_circuiting Description: ------------ Valgrind reports invalid read. USE_ZEND_ALLOC=0 valgrind --tool=memcheck --smc-check=all --error-limit=no --num-callers=30 --track-origins=yes --num-callers=30 --leak-check=full php-src/sapi/cli/php shortcircuit.php Caused by https://github.com/php/php-src/commit/3cfa58367b1b85d346d9be6cf9ae116c63571247 Test script: --------------- <?php class A { public static function get(array $v, $r) { if (!isset($r)) return array_shift($v); foreach ($r['allowed'] as $allowed) { if (in_array($allowed, $v)) return $allowed; foreach ($v as $version) if (0 === strpos($version, $allowed .'.')) return $version; } foreach ($r['ranges'] as $range) { foreach ($v as $version) { if ($range['min'] != '' && version_compare($range['min'], $version, '>')) continue; if ($range['max'] != '' && version_compare($range['max'], $version, '<') && (0 !== strpos($version, $range['max'] .'.'))) continue; if (in_array($version, $r['blocked'])) continue; return $version; } } } } Expected result: ---------------- No invalid read. Actual result: -------------- ==12725== Invalid read of size 1 ==12725== at 0x9261AA: zend_compile_short_circuiting (zend_compile.c:5914) ==12725== by 0x929691: zend_compile_expr (zend_compile.c:7013) ==12725== by 0x91FD69: zend_compile_if (zend_compile.c:3851) ==12725== by 0x9291A2: zend_compile_stmt (zend_compile.c:6904) ==12725== by 0x920CD7: zend_compile_stmt_list (zend_compile.c:4199) ==12725== by 0x9290B4: zend_compile_stmt (zend_compile.c:6861) ==12725== by 0x91FC10: zend_compile_foreach (zend_compile.c:3817) ==12725== by 0x929191: zend_compile_stmt (zend_compile.c:6901) ==12725== by 0x920CD7: zend_compile_stmt_list (zend_compile.c:4199) ==12725== by 0x9290B4: zend_compile_stmt (zend_compile.c:6861) ==12725== by 0x91FC10: zend_compile_foreach (zend_compile.c:3817) ==12725== by 0x929191: zend_compile_stmt (zend_compile.c:6901) ==12725== by 0x920CD7: zend_compile_stmt_list (zend_compile.c:4199) ==12725== by 0x9290B4: zend_compile_stmt (zend_compile.c:6861) ==12725== by 0x9227DC: zend_compile_func_decl (zend_compile.c:4717) ==12725== by 0x9291EB: zend_compile_stmt (zend_compile.c:6917) ==12725== by 0x920CD7: zend_compile_stmt_list (zend_compile.c:4199) ==12725== by 0x9290B4: zend_compile_stmt (zend_compile.c:6861) ==12725== by 0x9239A8: zend_compile_class_decl (zend_compile.c:5122) ==12725== by 0x92922C: zend_compile_stmt (zend_compile.c:6929) ==12725== by 0x928E8A: zend_compile_top_stmt (zend_compile.c:6839) ==12725== by 0x928E6C: zend_compile_top_stmt (zend_compile.c:6834) ==12725== by 0x8F13CF: compile_file (zend_language_scanner.l:607) ==12725== by 0x7711D8: phar_compile_file (phar.c:3310) ==12725== by 0x947185: zend_execute_scripts (zend.c:1383) ==12725== by 0x8B88B0: php_execute_script (main.c:2475) ==12725== by 0xA04906: do_cli (php_cli.c:967) ==12725== by 0xA058CE: main (php_cli.c:1334) ==12725== Address 0xc3eb2ff is 2,015 bytes inside a block of size 2,048 free'd ==12725== at 0x4C2C29E: realloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==12725== by 0x9146C3: _erealloc (zend_alloc.c:2233) ==12725== by 0x932BA1: op_array_alloc_ops (zend_opcode.c:48) ==12725== by 0x933EA0: get_next_op (zend_opcode.c:433) ==12725== by 0x91CD1E: zend_compile_args (zend_compile.c:2761) ==12725== by 0x91CF19: zend_compile_call_common (zend_compile.c:2821) ==12725== by 0x91E36B: zend_compile_call (zend_compile.c:3220) ==12725== by 0x929986: zend_compile_var (zend_compile.c:7100) ==12725== by 0x9295A1: zend_compile_expr (zend_compile.c:6980) ==12725== by 0x9258D7: zend_compile_binary_op (zend_compile.c:5728) ==12725== by 0x929631: zend_compile_expr (zend_compile.c:6998) ==12725== by 0x9260A9: zend_compile_short_circuiting (zend_compile.c:5897) ==12725== by 0x929691: zend_compile_expr (zend_compile.c:7013) ==12725== by 0x91FD69: zend_compile_if (zend_compile.c:3851) ==12725== by 0x9291A2: zend_compile_stmt (zend_compile.c:6904) ==12725== by 0x920CD7: zend_compile_stmt_list (zend_compile.c:4199) ==12725== by 0x9290B4: zend_compile_stmt (zend_compile.c:6861) ==12725== by 0x91FC10: zend_compile_foreach (zend_compile.c:3817) ==12725== by 0x929191: zend_compile_stmt (zend_compile.c:6901) ==12725== by 0x920CD7: zend_compile_stmt_list (zend_compile.c:4199) ==12725== by 0x9290B4: zend_compile_stmt (zend_compile.c:6861) ==12725== by 0x91FC10: zend_compile_foreach (zend_compile.c:3817) ==12725== by 0x929191: zend_compile_stmt (zend_compile.c:6901) ==12725== by 0x920CD7: zend_compile_stmt_list (zend_compile.c:4199) ==12725== by 0x9290B4: zend_compile_stmt (zend_compile.c:6861) ==12725== by 0x9227DC: zend_compile_func_decl (zend_compile.c:4717) ==12725== by 0x9291EB: zend_compile_stmt (zend_compile.c:6917) ==12725== by 0x920CD7: zend_compile_stmt_list (zend_compile.c:4199) ==12725== by 0x9290B4: zend_compile_stmt (zend_compile.c:6861) ==12725== by 0x9239A8: zend_compile_class_decl (zend_compile.c:5122) ==12725== ==12725== Invalid read of size 4 ==12725== at 0x926231: zend_compile_short_circuiting (zend_compile.c:5914) ==12725== by 0x929691: zend_compile_expr (zend_compile.c:7013) ==12725== by 0x91FD69: zend_compile_if (zend_compile.c:3851) ==12725== by 0x9291A2: zend_compile_stmt (zend_compile.c:6904) ==12725== by 0x920CD7: zend_compile_stmt_list (zend_compile.c:4199) ==12725== by 0x9290B4: zend_compile_stmt (zend_compile.c:6861) ==12725== by 0x91FC10: zend_compile_foreach (zend_compile.c:3817) ==12725== by 0x929191: zend_compile_stmt (zend_compile.c:6901) ==12725== by 0x920CD7: zend_compile_stmt_list (zend_compile.c:4199) ==12725== by 0x9290B4: zend_compile_stmt (zend_compile.c:6861) ==12725== by 0x91FC10: zend_compile_foreach (zend_compile.c:3817) ==12725== by 0x929191: zend_compile_stmt (zend_compile.c:6901) ==12725== by 0x920CD7: zend_compile_stmt_list (zend_compile.c:4199) ==12725== by 0x9290B4: zend_compile_stmt (zend_compile.c:6861) ==12725== by 0x9227DC: zend_compile_func_decl (zend_compile.c:4717) ==12725== by 0x9291EB: zend_compile_stmt (zend_compile.c:6917) ==12725== by 0x920CD7: zend_compile_stmt_list (zend_compile.c:4199) ==12725== by 0x9290B4: zend_compile_stmt (zend_compile.c:6861) ==12725== by 0x9239A8: zend_compile_class_decl (zend_compile.c:5122) ==12725== by 0x92922C: zend_compile_stmt (zend_compile.c:6929) ==12725== by 0x928E8A: zend_compile_top_stmt (zend_compile.c:6839) ==12725== by 0x928E6C: zend_compile_top_stmt (zend_compile.c:6834) ==12725== by 0x8F13CF: compile_file (zend_language_scanner.l:607) ==12725== by 0x7711D8: phar_compile_file (phar.c:3310) ==12725== by 0x947185: zend_execute_scripts (zend.c:1383) ==12725== by 0x8B88B0: php_execute_script (main.c:2475) ==12725== by 0xA04906: do_cli (php_cli.c:967) ==12725== by 0xA058CE: main (php_cli.c:1334) ==12725== Address 0xc3eb2f0 is 2,000 bytes inside a block of size 2,048 free'd ==12725== at 0x4C2C29E: realloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==12725== by 0x9146C3: _erealloc (zend_alloc.c:2233) ==12725== by 0x932BA1: op_array_alloc_ops (zend_opcode.c:48) ==12725== by 0x933EA0: get_next_op (zend_opcode.c:433) ==12725== by 0x91CD1E: zend_compile_args (zend_compile.c:2761) ==12725== by 0x91CF19: zend_compile_call_common (zend_compile.c:2821) ==12725== by 0x91E36B: zend_compile_call (zend_compile.c:3220) ==12725== by 0x929986: zend_compile_var (zend_compile.c:7100) ==12725== by 0x9295A1: zend_compile_expr (zend_compile.c:6980) ==12725== by 0x9258D7: zend_compile_binary_op (zend_compile.c:5728) ==12725== by 0x929631: zend_compile_expr (zend_compile.c:6998) ==12725== by 0x9260A9: zend_compile_short_circuiting (zend_compile.c:5897) ==12725== by 0x929691: zend_compile_expr (zend_compile.c:7013) ==12725== by 0x91FD69: zend_compile_if (zend_compile.c:3851) ==12725== by 0x9291A2: zend_compile_stmt (zend_compile.c:6904) ==12725== by 0x920CD7: zend_compile_stmt_list (zend_compile.c:4199) ==12725== by 0x9290B4: zend_compile_stmt (zend_compile.c:6861) ==12725== by 0x91FC10: zend_compile_foreach (zend_compile.c:3817) ==12725== by 0x929191: zend_compile_stmt (zend_compile.c:6901) ==12725== by 0x920CD7: zend_compile_stmt_list (zend_compile.c:4199) ==12725== by 0x9290B4: zend_compile_stmt (zend_compile.c:6861) ==12725== by 0x91FC10: zend_compile_foreach (zend_compile.c:3817) ==12725== by 0x929191: zend_compile_stmt (zend_compile.c:6901) ==12725== by 0x920CD7: zend_compile_stmt_list (zend_compile.c:4199) ==12725== by 0x9290B4: zend_compile_stmt (zend_compile.c:6861) ==12725== by 0x9227DC: zend_compile_func_decl (zend_compile.c:4717) ==12725== by 0x9291EB: zend_compile_stmt (zend_compile.c:6917) ==12725== by 0x920CD7: zend_compile_stmt_list (zend_compile.c:4199) ==12725== by 0x9290B4: zend_compile_stmt (zend_compile.c:6861) ==12725== by 0x9239A8: zend_compile_class_decl (zend_compile.c:5122) -- Edit bug report at https://bugs.php.net/bug.php?id=69868&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=69868&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=69868&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=69868&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=69868&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=69868&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=69868&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=69868&r=needscript Try newer version: https://bugs.php.net/fix.php?id=69868&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=69868&r=support Expected behavior: https://bugs.php.net/fix.php?id=69868&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=69868&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=69868&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=69868&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=69868&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=69868&r=dst IIS Stability: https://bugs.php.net/fix.php?id=69868&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=69868&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=69868&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=69868&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=69868&r=mysqlcfg