Bug #70398 [Asn]: SIGSEGV, Segmentation fault zend_ast_destroy_ex

Edit report at https://bugs.php.net/bug.php?id=70398&edit=1 ID: 70398 Updated by: bwoebi@php.net Reported by: opitz dot alexander at googlemail dot com Summary: SIGSEGV, Segmentation fault zend_ast_destroy_ex Status: Assigned Type: Bug Package: *General Issues Operating System: Linux PHP Version: 7.0.0RC1 Assigned To: laruence Block user comment: N Private report: N New Comment: That fixes the issue, but is it safe? There might be places directly operating on the zend_resource * and manipulating its refcount [under the assumption that all resources are refcounted]. Also, even if it should be safe, copy_constant_array() needs to be patched too. Previous Comments: ------------------------------------------------------------------------ [2015-09-02 15:22:37] laruence@php.net could you please verify whether the following patch fixed the problem? diff --git a/Zend/zend_builtin_functions.c b/Zend/zend_builtin_functions.c index fc834df..5dceaae 100644 --- a/Zend/zend_builtin_functions.c +++ b/Zend/zend_builtin_functions.c @@ -864,6 +864,10 @@ repeat: } ZVAL_DUP(&c.value, val); + if (Z_TYPE_INFO(c.value) == IS_RESOURCE_EX) { + /* disable resource constant destruction */ + Z_TYPE_INFO(c.value) = IS_RESOURCE; + } zval_ptr_dtor(&val_free); register_constant: c.flags = case_sensitive; /* non persistent */ ------------------------------------------------------------------------ [2015-09-02 15:15:29] laruence@php.net it can not work, since resource dtor may call some user function that uses constants ------------------------------------------------------------------------ [2015-09-02 12:48:19] bwoebi@php.net Related To: Bug #70399 ------------------------------------------------------------------------ [2015-09-02 12:33:21] bwoebi@php.net ./sapi/cli/php -r 'define("TEST", fopen("php://temp", "w+b"));' gives me a few invalid reads with valgrind. The fix is actually simple: In shutdown_executor(), move the call to clean_non_persistent_constants(); a few lines up above zend_close_rsrc_list(&EG(regular_list)); Though, I'm not sure if that might have side-effects [AFAIK, misordering in shutdown often causes subtle breaks] … so, can you please verify, Xinchen? ------------------------------------------------------------------------ [2015-09-02 09:26:12] laruence@php.net @ opitz , I asked bob to look into this one, and he already can reproduce it. but maybe fixed tomorrow. let's wait and see, thanks :) ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=70398 -- Edit this bug report at https://bugs.php.net/bug.php?id=70398&edit=1