Bug #76844 [Opn]: PHP crashes on big file with array inside

Edit report at https://bugs.php.net/bug.php?id=76844&edit=1 ID: 76844 Updated by: cmb@php.net Reported by: denis at bitrix dot ru Summary: PHP crashes on big file with array inside Status: Open Type: Bug Package: opcache Operating System: Ubuntu 14.04.5 LTS PHP Version: 7.2.9 Block user comment: N Private report: N New Comment: On a quick glance, this looks like a stack overflow. Previous Comments: ------------------------------------------------------------------------ [2018-09-05 17:13:08] spam2 at rhsoft dot net check your opcache settings especially interned strings buffer ------------------------------------------------------------------------ [2018-09-05 17:03:28] denis at bitrix dot ru Description: ------------ I have auto generated 12M script which causes segmentation fault with opcache enabled. $ gdb -ex=r --args php restore.file_list.php GNU gdb (Ubuntu 7.7.1-0ubuntu5~14.04.3) 7.7.1 Copyright (C) 2014 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-linux-gnu". Type "show configuration" for configuration details. For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>. Find the GDB manual and other documentation resources online at: <http://www.gnu.org/software/gdb/documentation/>. For help, type "help". Type "apropos word" to search for commands related to "word"... Reading symbols from php...Reading symbols from /usr/lib/debug/.build-id/c0/4daf2c7bc6200e0a02e127d552d4290d6678e0.debug...done. done. Starting program: /usr/bin/php restore.file_list.php [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". Program received signal SIGSEGV, Segmentation fault. zend_ssa_check_scc_var (op_array=op_array@entry=0x7ffff5883008, ssa=ssa@entry=0x7ffff59de028, var=65384, index=index@entry=0x7fffffffa48c, dfs=dfs@entry=0x7fffe9801000, root=root@entry=0x7fffe9a01000, stack=stack@entry=0x7fffffffa490) at /build/php7.2-pz0P3X/php7.2-7.2.9/ext/opcache/Optimizer/zend_inference.c:173 173 { (gdb) bt 10 #0 zend_ssa_check_scc_var (op_array=op_array@entry=0x7ffff5883008, ssa=ssa@entry=0x7ffff59de028, var=65384, index=index@entry=0x7fffffffa48c, dfs=dfs@entry=0x7fffe9801000, root=root@entry=0x7fffe9a01000, stack=stack@entry=0x7fffffffa490) at /build/php7.2-pz0P3X/php7.2-7.2.9/ext/opcache/Optimizer/zend_inference.c:173 #1 0x00007ffff4a7eed6 in zend_ssa_check_scc_var (op_array=op_array@entry=0x7ffff5883008, ssa=ssa@entry=0x7ffff59de028, var=<optimized out>, index=index@entry=0x7fffffffa48c, dfs=dfs@entry=0x7fffe9801000, root=root@entry=0x7fffe9a01000, stack=stack@entry=0x7fffffffa490) at /build/php7.2-pz0P3X/php7.2-7.2.9/ext/opcache/Optimizer/zend_inference.c:182 #2 0x00007ffff4a7eed6 in zend_ssa_check_scc_var (op_array=op_array@entry=0x7ffff5883008, ssa=ssa@entry=0x7ffff59de028, var=<optimized out>, index=index@entry=0x7fffffffa48c, dfs=dfs@entry=0x7fffe9801000, root=root@entry=0x7fffe9a01000, stack=stack@entry=0x7fffffffa490) at /build/php7.2-pz0P3X/php7.2-7.2.9/ext/opcache/Optimizer/zend_inference.c:182 #3 0x00007ffff4a7eed6 in zend_ssa_check_scc_var (op_array=op_array@entry=0x7ffff5883008, ssa=ssa@entry=0x7ffff59de028, var=<optimized out>, index=index@entry=0x7fffffffa48c, dfs=dfs@entry=0x7fffe9801000, root=root@entry=0x7fffe9a01000, stack=stack@entry=0x7fffffffa490) at /build/php7.2-pz0P3X/php7.2-7.2.9/ext/opcache/Optimizer/zend_inference.c:182 #4 0x00007ffff4a7eed6 in zend_ssa_check_scc_var (op_array=op_array@entry=0x7ffff5883008, ssa=ssa@entry=0x7ffff59de028, var=<optimized out>, index=index@entry=0x7fffffffa48c, dfs=dfs@entry=0x7fffe9801000, root=root@entry=0x7fffe9a01000, stack=stack@entry=0x7fffffffa490) at /build/php7.2-pz0P3X/php7.2-7.2.9/ext/opcache/Optimizer/zend_inference.c:182 #5 0x00007ffff4a7eed6 in zend_ssa_check_scc_var (op_array=op_array@entry=0x7ffff5883008, ssa=ssa@entry=0x7ffff59de028, var=<optimized out>, index=index@entry=0x7fffffffa48c, dfs=dfs@entry=0x7fffe9801000, root=root@entry=0x7fffe9a01000, stack=stack@entry=0x7fffffffa490) at /build/php7.2-pz0P3X/php7.2-7.2.9/ext/opcache/Optimizer/zend_inference.c:182 #6 0x00007ffff4a7eed6 in zend_ssa_check_scc_var (op_array=op_array@entry=0x7ffff5883008, ssa=ssa@entry=0x7ffff59de028, var=<optimized out>, index=index@entry=0x7fffffffa48c, dfs=dfs@entry=0x7fffe9801000, root=root@entry=0x7fffe9a01000, stack=stack@entry=0x7fffffffa490) at /build/php7.2-pz0P3X/php7.2-7.2.9/ext/opcache/Optimizer/zend_inference.c:182 #7 0x00007ffff4a7eed6 in zend_ssa_check_scc_var (op_array=op_array@entry=0x7ffff5883008, ssa=ssa@entry=0x7ffff59de028, var=<optimized out>, index=index@entry=0x7fffffffa48c, dfs=dfs@entry=0x7fffe9801000, root=root@entry=0x7fffe9a01000, stack=stack@entry=0x7fffffffa490) at /build/php7.2-pz0P3X/php7.2-7.2.9/ext/opcache/Optimizer/zend_inference.c:182 #8 0x00007ffff4a7eed6 in zend_ssa_check_scc_var (op_array=op_array@entry=0x7ffff5883008, ssa=ssa@entry=0x7ffff59de028, var=<optimized out>, index=index@entry=0x7fffffffa48c, dfs=dfs@entry=0x7fffe9801000, root=root@entry=0x7fffe9a01000, stack=stack@entry=0x7fffffffa490) at /build/php7.2-pz0P3X/php7.2-7.2.9/ext/opcache/Optimizer/zend_inference.c:182 #9 0x00007ffff4a7eed6 in zend_ssa_check_scc_var (op_array=op_array@entry=0x7ffff5883008, ssa=ssa@entry=0x7ffff59de028, var=<optimized out>, index=index@entry=0x7fffffffa48c, dfs=dfs@entry=0x7fffe9801000, root=root@entry=0x7fffe9a01000, stack=stack@entry=0x7fffffffa490) at /build/php7.2-pz0P3X/php7.2-7.2.9/ext/opcache/Optimizer/zend_inference.c:182 (More stack frames follow...) (gdb) bt -1 #65394 0x00005555556422be in main (argc=2, argv=0x555555bfd6e0) at /build/php7.2-pz0P3X/php7.2-7.2.9/sapi/cli/php_cli.c:1404 (gdb) zbacktrace (gdb) Test script: --------------- The script is uploaded to https://my.pcloud.com/publink/show?code=XZMTED7ZcA3xXabVtHSiwtefBkWj74HBSY1y It is 12M length but very simple: $ head restore.file_list.php <? $a['modules/main/include/virtual_file_system.php'] = 1; $a['modules/main/include/epilog_popup_admin.php'] = 1; $a['modules/main/include/prolog_before.php'] = 1; $a['modules/main/include/condition.php'] = 1; $a['modules/main/include/mainpage.php'] = 1; $a['modules/main/include/epilog.php'] = 1; $a['modules/main/include/include_statistics_before.php'] = 1; $a['modules/main/include/include_statistics.php'] = 1; $a['modules/main/include/dbconn_error.php'] = 1; $ tail restore.file_list.php $a['components/bitrix/lists.element.edit/lang/en/ajax.php'] = 1; $a['components/bitrix/lists.element.edit/lang/en/component.php'] = 1; $a['components/bitrix/lists.element.edit/lang/en/.description.php'] = 1; $a['components/bitrix/lists.element.edit/.description.php'] = 1; $a['components/bitrix/tasks.interface.header/templates/.default/template.php'] = 1; $a['components/bitrix/tasks.interface.header/templates/.default/script.js'] = 1; $a['components/bitrix/tasks.interface.header/templates/.default/style.min.css'] = 1; $a['components/bitrix/tasks.interface.header/templates/.default/script.map.js'] = 1; $a['components/bitrix/tasks.interface.header/templates/.default/script.min.js'] = 1; $a['components/bitrix/tasks.interface.header/class.php'] = 1; Actual result: -------------- $ php -d opcache.enable_cli=0 restore.file_list.php $ $ php -d opcache.enable_cli=1 restore.file_list.php Segmentation fault ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=76844&edit=1