Bug #71539 [PATCH]: Memory error on $arr[$a] =& $arr[$b] if RHS rehashes
Edit report at https://bugs.php.net/bug.php?id=71539&edit=1
ID: 71539
Patch added by: dmitry@php.net
Reported by: nikic@php.net
Summary: Memory error on $arr[$a] =& $arr[$b] if RHS rehashes
Status: Assigned
Type: Bug
Package: Scripting Engine problem
PHP Version: 7.0.3
Assigned To: dmitry
Block user comment: N
Private report: N
New Comment:
The following patch has been added/updated:
Patch Name: bug71539.diff
Revision: 1467815599
URL: https://bugs.php.net/patch-display.php?bug=71539&patch=bug71539.diff&revision=1467815599
Previous Comments:
------------------------------------------------------------------------
[2016-07-06 10:07:30] dmitry@php.net
The following patch has been added/updated:
Patch Name: bug71539.diff
Revision: 1467799650
URL: https://bugs.php.net/patch-display.php?bug=71539&patch=bug71539.diff&revision=1467799650
------------------------------------------------------------------------
[2016-03-19 14:23:12] nikic@php.net
Related To: Bug #71850
------------------------------------------------------------------------
[2016-02-06 15:55:55] nikic@php.net
Description:
------------
Reproduce code:
$array = [];
$array[0] =& $array[''];
The $array[''] is used to force a packed-to-hash conversion.
Output:
[Sat Feb 6 16:53:58 2016] Script: '/home/nikic/php-src/t203.php'
/home/nikic/php-src/Zend/zend_execute.c(577) : Freeing 0x7FEE3D6010E0 (24 bytes),
script=/home/nikic/php-src/t203.php
=== Total 1 memory leaks detected ===
First valgrind:
==30433== Invalid read of size 1
==30433== at 0xB7EAAD: zval_get_type (zend_types.h:330)
==30433== by 0xBB80A5: ZEND_ASSIGN_REF_SPEC_VAR_VAR_HANDLER (zend_vm_execute.h:19702)
==30433== by 0xB88A6F: execute_ex (zend_vm_execute.h:422)
==30433== by 0xB88C71: zend_execute (zend_vm_execute.h:466)
==30433== by 0xB247EC: zend_execute_scripts (zend.c:1427)
==30433== by 0xA630F9: php_execute_script (main.c:2484)
==30433== by 0xC0783C: do_cli (php_cli.c:974)
==30433== by 0xC08CD1: main (php_cli.c:1345)
==30433== Address 0xf47b680 is 16 bytes inside a block of size 264 free'd
==30433== at 0x4C2BDEC: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==30433== by 0xAE4EAD: _efree (zend_alloc.c:2453)
==30433== by 0xB379A8: zend_hash_packed_to_hash (zend_hash.c:220)
==30433== by 0xB3915C: _zend_hash_add_or_update_i (zend_hash.c:566)
==30433== by 0xB3951C: _zend_hash_add_new (zend_hash.c:640)
==30433== by 0xB852E5: zend_fetch_dimension_address_inner (zend_execute.c:1466)
==30433== by 0xB85AB4: zend_fetch_dimension_address (zend_execute.c:1681)
==30433== by 0xB861AE: zend_fetch_dimension_address_W (zend_execute.c:1772)
==30433== by 0xBDAB96: ZEND_FETCH_DIM_W_SPEC_CV_CONST_HANDLER (zend_vm_execute.h:36832)
==30433== by 0xB88A6F: execute_ex (zend_vm_execute.h:422)
==30433== by 0xB88C71: zend_execute (zend_vm_execute.h:466)
==30433== by 0xB247EC: zend_execute_scripts (zend.c:1427)
The cause is the opcode sequence:
@1 = FETCH_DIM_W $array 0
@2 = FETCH_DIM_W $array ""
ASSIGN_REF @1 @2
Where the second FETCH_DIM_W will reallocate the backing array while @1 still holds a pointer into
it.
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=71539&edit=1
Thread (9 messages)