Bug #77647 [NEW]: preload: Access violation in zend_mm_shutdown
| From: | mberchtold at gmail dot com | Date: | Thu, 21 Feb 2019 19:48:45 +0000 |
| Subject: | Bug #77647 [NEW]: preload: Access violation in zend_mm_shutdown | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-219685@lists.php.net to get a copy of this message | ||
From: mberchtold at gmail dot com
Operating system: Windows 10 x64
PHP version: master-Git-2019-02-21 (snap)
Package: opcache
Bug Type: Bug
Bug description:preload: Access violation in zend_mm_shutdown
Description:
------------
With preloading (preloading of zend framework 3, others) enabled,
visiting certain urls of the website crashes php-cgi.exe
When preloading is disabled, or when no classes are preloaded it does
not crash.
php master: r82d6759
> php8.dll!zend_mm_shutdown(_zend_mm_heap * heap, int full, int silent)
Line 2269 C
[Inline Frame] php8.dll!shutdown_memory_manager(int) C
php8.dll!php_module_startup(_sapi_module_struct * sf,
_zend_module_entry * additional_modules, unsigned int
num_additional_modules) Line 2405 C
php-cgi.exe!php_cgi_startup(_sapi_module_struct * sapi_module) Line
973 C
php-cgi.exe!main(int argc, char * * argv) Line 1921 C
[Inline Frame] php-cgi.exe!invoke_main() Line 78 C++
php-cgi.exe!__scrt_common_main_seh() Line 288 C++
kernel32.dll!00007ff81f3b81f4() Unknown
ntdll.dll!00007ff82174a251() Unknown
zend_mm_shutdown
...
Code:
/* move all chunks except of the first one into the cache */
p = heap->main_chunk->next;
while (p != heap->main_chunk) {
---> zend_mm_chunk *q = p->next;
// p is null
p->next = heap->cached_chunks;
heap->cached_chunks = p;
p = q;
heap->chunks_count--;
heap->cached_chunks_count++;
}
Locals:
+ heap 0x0000026899200040 {use_custom_heap=0x00000000
storage=0x0000000000000000 <NULL> size=0x0000000000000000
...} _zend_mm_heap *
+ heap->main_chunk 0x0000026899200000 {heap=0x0000026899200040
{use_custom_heap=0x00000000 storage=0x0000000000000000 <NULL> ...}
...} _zend_mm_chunk *
+ heap->main_chunk->next 0x0000000000000000 <NULL> _zend_mm_chunk *
+ p 0x0000000000000000 <NULL> _zend_mm_chunk *
For some reason, heap->main_chunk->next is NULL which looks unexpected
(heap corruption?).
Test script:
---------------
I don't have a reproducible case other than that it always crashes when
accessing a certain url on an internal website.
Expected result:
----------------
no crash
Actual result:
--------------
Unhandled exception thrown: read access violation.
--
Edit bug report at https://bugs.php.net/bug.php?id=77647&edit=1
--
Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=77647&r=trysnapshot54
Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=77647&r=trysnapshot55
Try a snapshot (trunk): https://bugs.php.net/fix.php?id=77647&r=trysnapshottrunk
Fixed in SVN: https://bugs.php.net/fix.php?id=77647&r=fixed
Fixed in release: https://bugs.php.net/fix.php?id=77647&r=alreadyfixed
Need backtrace: https://bugs.php.net/fix.php?id=77647&r=needtrace
Need Reproduce Script: https://bugs.php.net/fix.php?id=77647&r=needscript
Try newer version: https://bugs.php.net/fix.php?id=77647&r=oldversion
Not developer issue: https://bugs.php.net/fix.php?id=77647&r=support
Expected behavior: https://bugs.php.net/fix.php?id=77647&r=notwrong
Not enough info: https://bugs.php.net/fix.php?id=77647&r=notenoughinfo
Submitted twice: https://bugs.php.net/fix.php?id=77647&r=submittedtwice
register_globals: https://bugs.php.net/fix.php?id=77647&r=globals
PHP 4 support discontinued: https://bugs.php.net/fix.php?id=77647&r=php4
Daylight Savings: https://bugs.php.net/fix.php?id=77647&r=dst
IIS Stability: https://bugs.php.net/fix.php?id=77647&r=isapi
Install GNU Sed: https://bugs.php.net/fix.php?id=77647&r=gnused
Floating point limitations: https://bugs.php.net/fix.php?id=77647&r=float
No Zend Extensions: https://bugs.php.net/fix.php?id=77647&r=nozend
MySQL Configuration Error: https://bugs.php.net/fix.php?id=77647&r=mysqlcfg