Bug #77338 [Ver]: get_browser with empty string

Edit report at https://bugs.php.net/bug.php?id=77338&edit=1 ID: 77338 Updated by: cmb@php.net Reported by: emondpph at gmail dot com Summary: get_browser with empty string Status: Verified Type: Bug Package: Reproducible crash Operating System: Mac OS Mojave PHP Version: 7.3.0 Assigned To: nikic Block user comment: N Private report: N New Comment: The latter is due to a confusion regarding re_options[1]; these are reported as 8, because PREG_JIT has been set[2], but the following pcre2_match() interprets them as PCRE2_NOTEMPTY_ATSTART, yielding no match. This might be a general problem affecting PCRE. [1] <https://github.com/php/php-src/blob/php-7.3.0/ext/standard/browscap.c#L623> [2] <https://github.com/php/php-src/blob/php-7.3.0/ext/pcre/php_pcre.c#L783> Previous Comments: ------------------------------------------------------------------------ [2018-12-23 18:30:51] nikic@php.net There's two things wrong here: An incorrect efree() that should be a zend_string_release() (also exists in 7.2), and the fact that we hit this code path at all on 7.3, which indicates a presumably not intended change in behavior. ------------------------------------------------------------------------ [2018-12-23 12:30:21] cmb@php.net I can confirm this with browscap.ini version 6000031. I get the following backtrace: #0 0x0000000008363745 in zend_mm_free_heap (heap=0x7ffffde00040, ptr=0x8af8250, __zend_filename=0x8556670 "/mnt/c/Users/cmb/php-dev/php-src/ext/standard/browscap.c", __zend_lineno=758, __zend_orig_filename=0x0, __zend_orig_lineno=0) at /mnt/c/Users/cmb/php-dev/php-src/Zend/zend_alloc.c:1398 #1 0x000000000836621c in _efree (ptr=0x8af8250, __zend_filename=0x8556670 "/mnt/c/Users/cmb/php-dev/php-src/ext/standard/browscap.c", __zend_lineno=758, __zend_orig_filename=0x0, __zend_orig_lineno=0) at /mnt/c/Users/cmb/php-dev/php-src/Zend/zend_alloc.c:2513 #2 0x00000000082592fb in zif_get_browser (execute_data=0x7ffffde1e100, return_value=0x7ffffde1e080) at /mnt/c/Users/cmb/php-dev/php-src/ext/standard/browscap.c:758 #3 0x00000000083fbffd in ZEND_DO_ICALL_SPEC_RETVAL_USED_HANDLER () at /mnt/c/Users/cmb/php-dev/php-src/Zend/zend_vm_execute.h:690 #4 0x000000000846312b in execute_ex (ex=0x7ffffde1e030) at /mnt/c/Users/cmb/php-dev/php-src/Zend/zend_vm_execute.h:55418 #5 0x0000000008468739 in zend_execute (op_array=0x7ffffde7b300, return_value=0x0) at /mnt/c/Users/cmb/php-dev/php-src/Zend/zend_vm_execute.h:60834 #6 0x000000000839a698 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /mnt/c/Users/cmb/php-dev/php-src/Zend/zend.c:1568 #7 0x0000000008310dfb in php_execute_script (primary_file=0x7ffffffedee0) at /mnt/c/Users/cmb/php-dev/php-src/main/main.c:2630 #8 0x000000000846b12d in do_cli (argc=3, argv=0x8aedd00) valgrind reports: ==10214== Memcheck, a memory error detector ==10214== Copyright (C) 2002-2015, and GNU GPL'd, by Julian Seward et al. ==10214== Using Valgrind-3.12.0.SVN and LibVEX; rerun with -h for copyright info ==10214== Command: sapi/cli/php -dbrowscap=/mnt/c/Users/cmb/php-dev/browscap.ini ../77338.php ==10214== bool(false) ==10214== Invalid read of size 4 ==10214== at 0x35E9AD: zend_string_release (zend_string.h:275) ==10214== by 0x36047E: browscap_bdata_dtor (browscap.c:488) ==10214== by 0x36063A: zm_shutdown_browscap (browscap.c:551) ==10214== by 0x3526C3: zm_shutdown_basic (basic_functions.c:3775) ==10214== by 0x4AC115: module_destructor (zend_API.c:2575) ==10214== by 0x4A0BEB: module_destructor_zval (zend.c:745) ==10214== by 0x4B67B1: _zend_hash_del_el_ex (zend_hash.c:1181) ==10214== by 0x4B687D: _zend_hash_del_el (zend_hash.c:1204) ==10214== by 0x4B80D4: zend_hash_graceful_reverse_destroy (zend_hash.c:1658) ==10214== by 0x4A9EE7: zend_destroy_modules (zend_API.c:2013) ==10214== by 0x4A1048: zend_shutdown (zend.c:976) ==10214== by 0x418A2A: php_module_shutdown (main.c:2489) ==10214== Address 0x6176e54 is 4 bytes inside a block of size 32 free'd ==10214== at 0x4C2CDDB: free (vg_replace_malloc.c:530) ==10214== by 0x46E1F1: _efree (zend_alloc.c:2508) ==10214== by 0x3612FA: zif_get_browser (browscap.c:758) ==10214== by 0x503FFC: ZEND_DO_ICALL_SPEC_RETVAL_USED_HANDLER (zend_vm_execute.h:690) ==10214== by 0x56B12A: execute_ex (zend_vm_execute.h:55418) ==10214== by 0x570738: zend_execute (zend_vm_execute.h:60834) ==10214== by 0x4A2697: zend_execute_scripts (zend.c:1568) ==10214== by 0x418DFA: php_execute_script (main.c:2630) ==10214== by 0x57312C: do_cli (php_cli.c:997) ==10214== by 0x573FE2: main (php_cli.c:1389) ==10214== Block was alloc'd at ==10214== at 0x4C2BBAF: malloc (vg_replace_malloc.c:299) ==10214== by 0x46EE6D: __zend_malloc (zend_alloc.c:2904) ==10214== by 0x4DA185: zend_string_alloc (zend_string.h:133) ==10214== by 0x4DA9FF: zend_interned_strings_init (zend_string.c:98) ==10214== by 0x4A0F76: zend_startup (zend.c:889) ==10214== by 0x417F1A: php_module_startup (main.c:2179) ==10214== by 0x5721A7: php_cli_startup (php_cli.c:420) ==10214== by 0x573F5A: main (php_cli.c:1356) ==10214== ==10214== Invalid read of size 4 ==10214== at 0x4C6C3A: zend_string_release (zend_string.h:275) ==10214== by 0x4C70AF: free_ini_entry (zend_ini.c:91) ==10214== by 0x4B67B1: _zend_hash_del_el_ex (zend_hash.c:1181) ==10214== by 0x4B687D: _zend_hash_del_el (zend_hash.c:1204) ==10214== by 0x4B8351: zend_hash_apply_with_argument (zend_hash.c:1716) ==10214== by 0x4C75B4: zend_unregister_ini_entries (zend_ini.c:278) ==10214== by 0x3E71F7: zm_shutdown_url_scanner_ex (url_scanner_ex.re:979) ==10214== by 0x352744: zm_shutdown_basic (basic_functions.c:3778) ==10214== by 0x4AC115: module_destructor (zend_API.c:2575) ==10214== by 0x4A0BEB: module_destructor_zval (zend.c:745) ==10214== by 0x4B67B1: _zend_hash_del_el_ex (zend_hash.c:1181) ==10214== by 0x4B687D: _zend_hash_del_el (zend_hash.c:1204) ==10214== Address 0x6176e54 is 4 bytes inside a block of size 32 free'd ==10214== at 0x4C2CDDB: free (vg_replace_malloc.c:530) ==10214== by 0x46E1F1: _efree (zend_alloc.c:2508) ==10214== by 0x3612FA: zif_get_browser (browscap.c:758) ==10214== by 0x503FFC: ZEND_DO_ICALL_SPEC_RETVAL_USED_HANDLER (zend_vm_execute.h:690) ==10214== by 0x56B12A: execute_ex (zend_vm_execute.h:55418) ==10214== by 0x570738: zend_execute (zend_vm_execute.h:60834) ==10214== by 0x4A2697: zend_execute_scripts (zend.c:1568) ==10214== by 0x418DFA: php_execute_script (main.c:2630) ==10214== by 0x57312C: do_cli (php_cli.c:997) ==10214== by 0x573FE2: main (php_cli.c:1389) ==10214== Block was alloc'd at ==10214== at 0x4C2BBAF: malloc (vg_replace_malloc.c:299) ==10214== by 0x46EE6D: __zend_malloc (zend_alloc.c:2904) ==10214== by 0x4DA185: zend_string_alloc (zend_string.h:133) ==10214== by 0x4DA9FF: zend_interned_strings_init (zend_string.c:98) ==10214== by 0x4A0F76: zend_startup (zend.c:889) ==10214== by 0x417F1A: php_module_startup (main.c:2179) ==10214== by 0x5721A7: php_cli_startup (php_cli.c:420) ==10214== by 0x573F5A: main (php_cli.c:1356) ==10214== ==10214== Invalid read of size 4 ==10214== at 0x4DA8EE: _str_dtor (zend_string.c:62) ==10214== by 0x4B7228: zend_hash_destroy (zend_hash.c:1417) ==10214== by 0x4DAB28: zend_interned_strings_dtor (zend_string.c:118) ==10214== by 0x418A68: php_module_shutdown (main.c:2514) ==10214== by 0x57403D: main (php_cli.c:1404) ==10214== Address 0x6176e54 is 4 bytes inside a block of size 32 free'd ==10214== at 0x4C2CDDB: free (vg_replace_malloc.c:530) ==10214== by 0x46E1F1: _efree (zend_alloc.c:2508) ==10214== by 0x3612FA: zif_get_browser (browscap.c:758) ==10214== by 0x503FFC: ZEND_DO_ICALL_SPEC_RETVAL_USED_HANDLER (zend_vm_execute.h:690) ==10214== by 0x56B12A: execute_ex (zend_vm_execute.h:55418) ==10214== by 0x570738: zend_execute (zend_vm_execute.h:60834) ==10214== by 0x4A2697: zend_execute_scripts (zend.c:1568) ==10214== by 0x418DFA: php_execute_script (main.c:2630) ==10214== by 0x57312C: do_cli (php_cli.c:997) ==10214== by 0x573FE2: main (php_cli.c:1389) ==10214== Block was alloc'd at ==10214== at 0x4C2BBAF: malloc (vg_replace_malloc.c:299) ==10214== by 0x46EE6D: __zend_malloc (zend_alloc.c:2904) ==10214== by 0x4DA185: zend_string_alloc (zend_string.h:133) ==10214== by 0x4DA9FF: zend_interned_strings_init (zend_string.c:98) ==10214== by 0x4A0F76: zend_startup (zend.c:889) ==10214== by 0x417F1A: php_module_startup (main.c:2179) ==10214== by 0x5721A7: php_cli_startup (php_cli.c:420) ==10214== by 0x573F5A: main (php_cli.c:1356) ==10214== ==10214== Invalid free() / delete / delete[] / realloc() ==10214== at 0x4C2CDDB: free (vg_replace_malloc.c:530) ==10214== by 0x4DA90C: _str_dtor (zend_string.c:62) ==10214== by 0x4B7228: zend_hash_destroy (zend_hash.c:1417) ==10214== by 0x4DAB28: zend_interned_strings_dtor (zend_string.c:118) ==10214== by 0x418A68: php_module_shutdown (main.c:2514) ==10214== by 0x57403D: main (php_cli.c:1404) ==10214== Address 0x6176e50 is 0 bytes inside a block of size 32 free'd ==10214== at 0x4C2CDDB: free (vg_replace_malloc.c:530) ==10214== by 0x46E1F1: _efree (zend_alloc.c:2508) ==10214== by 0x3612FA: zif_get_browser (browscap.c:758) ==10214== by 0x503FFC: ZEND_DO_ICALL_SPEC_RETVAL_USED_HANDLER (zend_vm_execute.h:690) ==10214== by 0x56B12A: execute_ex (zend_vm_execute.h:55418) ==10214== by 0x570738: zend_execute (zend_vm_execute.h:60834) ==10214== by 0x4A2697: zend_execute_scripts (zend.c:1568) ==10214== by 0x418DFA: php_execute_script (main.c:2630) ==10214== by 0x57312C: do_cli (php_cli.c:997) ==10214== by 0x573FE2: main (php_cli.c:1389) ==10214== Block was alloc'd at ==10214== at 0x4C2BBAF: malloc (vg_replace_malloc.c:299) ==10214== by 0x46EE6D: __zend_malloc (zend_alloc.c:2904) ==10214== by 0x4DA185: zend_string_alloc (zend_string.h:133) ==10214== by 0x4DA9FF: zend_interned_strings_init (zend_string.c:98) ==10214== by 0x4A0F76: zend_startup (zend.c:889) ==10214== by 0x417F1A: php_module_startup (main.c:2179) ==10214== by 0x5721A7: php_cli_startup (php_cli.c:420) ==10214== by 0x573F5A: main (php_cli.c:1356) ==10214== ==10214== ==10214== HEAP SUMMARY: ==10214== in use at exit: 446,368 bytes in 10,237 blocks ==10214== total heap usage: 941,165 allocs, 930,929 frees, 84,327,874 bytes allocated ==10214== ==10214== LEAK SUMMARY: ==10214== definitely lost: 446,312 bytes in 10,236 blocks ==10214== indirectly lost: 0 bytes in 0 blocks ==10214== possibly lost: 56 bytes in 1 blocks ==10214== still reachable: 0 bytes in 0 blocks ==10214== suppressed: 0 bytes in 0 blocks ==10214== Rerun with --leak-check=full to see details of leaked memory ==10214== ==10214== For counts of detected and suppressed errors, rerun with: -v ==10214== ERROR SUMMARY: 958 errors from 4 contexts (suppressed: 0 from 0) ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=77338 -- Edit this bug report at https://bugs.php.net/bug.php?id=77338&edit=1