Bug #71859 [NEW]: zend_objects_store_call_destructors operates on realloced memory, crashing.

From: jasper dot mattsson at gmail dot com Operating system: PHP version: 7.0.4 Package: Reproducible crash Bug Type: Bug Bug description:zend_objects_store_call_destructors operates on realloced memory, crashing. Description: ------------ If a destructor instantiates new objects, objects->object_buckets might be reallocated in zend_objects_store_put, making obj_ptr dangle and sometimes crashing PHP. Test script: --------------- <?php class constructs_in_destructor { public function __destruct() { //We are now in zend_objects_store_call_destructors //This causes a realloc in zend_objects_store_put for ($i = 0; $i < 10000; ++$i) { $GLOBALS["a$i"] = new stdClass; } //Returns to zend_objects_store_call_destructors, to access freed memory. } } gc_disable(); $a = new constructs_in_destructor; //Create cycle so destructors are ran only in zend_objects_store_call_destructors $a->a = $a; // Create some objects so zend_objects_store_call_destructors has something // to do after constructs_in_destructor is destroyed. for ($i = 0; $i < 200; ++$i) { $GLOBALS["b$i"] = new stdClass; } Expected result: ---------------- No crash Actual result: -------------- #0 0x00000000008528ef in zend_objects_store_call_destructors (objects=0x1145ff0 <executor_globals+816>) at /var/lib/yaourt/yaourt-tmp-jasu/abs-php/src/php-7.0.4/Zend/zend_objects_API.c:54 #1 0x00000000007e9a57 in shutdown_destructors () at /var/lib/yaourt/yaourt-tmp-jasu/abs-php/src/php-7.0.4/Zend/zend_execute_API.c:242 #2 0x00000000008028c1 in zend_call_destructors () at /var/lib/yaourt/yaourt-tmp-jasu/abs-php/src/php-7.0.4/Zend/zend.c:952 #3 0x000000000076b5fe in php_request_shutdown (dummy=0x0) at /var/lib/yaourt/yaourt-tmp-jasu/abs-php/src/php-7.0.4/main/main.c:1774 #4 0x00000000008cc813 in do_cli (argc=2, argv=0x114b9f0) at /var/lib/yaourt/yaourt-tmp-jasu/abs-php/src/php-7.0.4/sapi/cli/php_cli.c:1142 #5 0x00000000008cd099 in main (argc=2, argv=0x114b9f0) at /var/lib/yaourt/yaourt-tmp-jasu/abs-php/src/php-7.0.4/sapi/cli/php_cli.c:1345 -- Edit bug report at https://bugs.php.net/bug.php?id=71859&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=71859&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=71859&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=71859&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=71859&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=71859&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=71859&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=71859&r=needscript Try newer version: https://bugs.php.net/fix.php?id=71859&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=71859&r=support Expected behavior: https://bugs.php.net/fix.php?id=71859&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=71859&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=71859&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=71859&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=71859&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=71859&r=dst IIS Stability: https://bugs.php.net/fix.php?id=71859&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=71859&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=71859&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=71859&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=71859&r=mysqlcfg