Bug #77669 [Asn->Csd]: Crash in extract() when overwriting extracted array

Edit report at https://bugs.php.net/bug.php?id=77669&edit=1 ID: 77669 Updated by: nikic@php.net Reported by: profic at gmail dot com Summary: Crash in extract() when overwriting extracted array -Status: Assigned +Status: Closed Type: Bug Package: Reproducible crash Operating System: Ubuntu 18.04/Windows 7 PHP Version: 7.2.15 Assigned To: nikic Block user comment: N Private report: N New Comment: Automatic comment on behalf of nikita.ppv@gmail.com Revision: http://git.php.net/?p=php-src.git;a=commit;h=9ad9cc71ff3bb45532b22b4145ea3af90692b364 Log: Fixed bug #77669 Previous Comments: ------------------------------------------------------------------------ [2019-02-28 08:40:41] nikic@php.net Thanks for the valgrind log, it's very helpful. The problem is that extract() overwrites the same array it is currently extracting. There is protection for this, but apparently it is only being applied to one extract mode, not all of them ... ------------------------------------------------------------------------ [2019-02-26 15:08:22] profic at gmail dot com It got truncated, here is the rest: ==19654== Invalid read of size 8 ==19654== at 0x433610: zend_assign_to_variable (zend_execute.h:117) ==19654== by 0x433610: ZEND_FE_FETCH_R_SPEC_VAR_HANDLER (zend_vm_execute.h:16970) ==19654== by 0x458604: execute_ex (zend_vm_execute.h:60833) ==19654== by 0x45C3A6: zend_execute (zend_vm_execute.h:63776) ==19654== by 0x3AAD91: zend_execute_scripts (zend.c:1498) ==19654== by 0x464D59: php_cli_server_dispatch_router.isra.10 (php_cli_server.c:2117) ==19654== by 0x46574A: php_cli_server_dispatch (php_cli_server.c:2156) ==19654== by 0x46574A: php_cli_server_recv_event_read_request (php_cli_server.c:2379) ==19654== by 0x46608D: php_cli_server_do_event_for_each_fd_callback (php_cli_server.c:2457) ==19654== by 0x466C0D: php_cli_server_poller_iter_on_active (php_cli_server.c:846) ==19654== by 0x466C0D: php_cli_server_do_event_for_each_fd (php_cli_server.c:2480) ==19654== by 0x466C0D: php_cli_server_do_event_loop (php_cli_server.c:2490) ==19654== by 0x466C0D: do_cli_server (php_cli_server.c:2612) ==19654== by 0x1F44D1: main (php_cli.c:1406) ==19654== Address 0x16c7b6a8 is 8 bytes inside a block of size 264 free'd ==19654== at 0x4C30D3B: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==19654== by 0x3BC7E9: zend_array_destroy (zend_hash.c:1330) ==19654== by 0x3BC850: i_zval_ptr_dtor (zend_variables.h:49) ==19654== by 0x3BC850: zend_array_destroy (zend_hash.c:1306) ==19654== by 0x2C51A5: php_extract_prefix_invalid (array.c:2357) ==19654== by 0x2C51A5: zif_extract (array.c:2554) ==19654== by 0x45A641: ZEND_DO_FCALL_BY_NAME_SPEC_RETVAL_UNUSED_HANDLER (zend_vm_execute.h:738) ==19654== by 0x45A641: execute_ex (zend_vm_execute.h:59759) ==19654== by 0x45C3A6: zend_execute (zend_vm_execute.h:63776) ==19654== by 0x3AAD91: zend_execute_scripts (zend.c:1498) ==19654== by 0x464D59: php_cli_server_dispatch_router.isra.10 (php_cli_server.c:2117) ==19654== by 0x46574A: php_cli_server_dispatch (php_cli_server.c:2156) ==19654== by 0x46574A: php_cli_server_recv_event_read_request (php_cli_server.c:2379) ==19654== by 0x46608D: php_cli_server_do_event_for_each_fd_callback (php_cli_server.c:2457) ==19654== by 0x466C0D: php_cli_server_poller_iter_on_active (php_cli_server.c:846) ==19654== by 0x466C0D: php_cli_server_do_event_for_each_fd (php_cli_server.c:2480) ==19654== by 0x466C0D: php_cli_server_do_event_loop (php_cli_server.c:2490) ==19654== by 0x466C0D: do_cli_server (php_cli_server.c:2612) ==19654== by 0x1F44D1: main (php_cli.c:1406) ==19654== Block was alloc'd at ==19654== at 0x4C2FB0F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==19654== by 0x37EE88: __zend_malloc (zend_alloc.c:2829) ==19654== by 0x3BA5A0: zend_hash_real_init_ex (zend_hash.c:135) ==19654== by 0x3BA5A0: zend_hash_check_init (zend_hash.c:163) ==19654== by 0x3BA5A0: _zend_hash_index_add_or_update_i (zend_hash.c:715) ==19654== by 0x3BA5A0: _zend_hash_index_add_new (zend_hash.c:829) ==19654== by 0x3F4BC6: zend_fetch_dimension_address_inner (zend_execute.c:1517) ==19654== by 0x3F4BC6: zend_fetch_dimension_address_inner_W (zend_execute.c:1604) ==19654== by 0x43CC50: ZEND_ASSIGN_DIM_SPEC_CV_TMPVAR_OP_DATA_VAR_HANDLER (zend_vm_execute.h:47310) ==19654== by 0x45577D: execute_ex (zend_vm_execute.h:63077) ==19654== by 0x45C3A6: zend_execute (zend_vm_execute.h:63776) ==19654== by 0x3AAD91: zend_execute_scripts (zend.c:1498) ==19654== by 0x464D59: php_cli_server_dispatch_router.isra.10 (php_cli_server.c:2117) ==19654== by 0x46574A: php_cli_server_dispatch (php_cli_server.c:2156) ==19654== by 0x46574A: php_cli_server_recv_event_read_request (php_cli_server.c:2379) ==19654== by 0x46608D: php_cli_server_do_event_for_each_fd_callback (php_cli_server.c:2457) ==19654== by 0x466C0D: php_cli_server_poller_iter_on_active (php_cli_server.c:846) ==19654== by 0x466C0D: php_cli_server_do_event_for_each_fd (php_cli_server.c:2480) ==19654== by 0x466C0D: php_cli_server_do_event_loop (php_cli_server.c:2490) ==19654== by 0x466C0D: do_cli_server (php_cli_server.c:2612) ==19654== ==19654== Invalid read of size 4 ==19654== at 0x3FE125: _zval_ptr_dtor_nogc (zend_variables.h:39) ==19654== by 0x3FE125: ZEND_FE_FREE_SPEC_TMPVAR_HANDLER (zend_vm_execute.h:48511) ==19654== by 0x4559F2: execute_ex (zend_vm_execute.h:63140) ==19654== by 0x45C3A6: zend_execute (zend_vm_execute.h:63776) ==19654== by 0x3AAD91: zend_execute_scripts (zend.c:1498) ==19654== by 0x464D59: php_cli_server_dispatch_router.isra.10 (php_cli_server.c:2117) ==19654== by 0x46574A: php_cli_server_dispatch (php_cli_server.c:2156) ==19654== by 0x46574A: php_cli_server_recv_event_read_request (php_cli_server.c:2379) ==19654== by 0x46608D: php_cli_server_do_event_for_each_fd_callback (php_cli_server.c:2457) ==19654== by 0x466C0D: php_cli_server_poller_iter_on_active (php_cli_server.c:846) ==19654== by 0x466C0D: php_cli_server_do_event_for_each_fd (php_cli_server.c:2480) ==19654== by 0x466C0D: php_cli_server_do_event_loop (php_cli_server.c:2490) ==19654== by 0x466C0D: do_cli_server (php_cli_server.c:2612) ==19654== by 0x1F44D1: main (php_cli.c:1406) ==19654== Address 0x16c7aa70 is 0 bytes inside a block of size 56 free'd ==19654== at 0x4C30D3B: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==19654== by 0x3BC850: i_zval_ptr_dtor (zend_variables.h:49) ==19654== by 0x3BC850: zend_array_destroy (zend_hash.c:1306) ==19654== by 0x2C51A5: php_extract_prefix_invalid (array.c:2357) ==19654== by 0x2C51A5: zif_extract (array.c:2554) ==19654== by 0x45A641: ZEND_DO_FCALL_BY_NAME_SPEC_RETVAL_UNUSED_HANDLER (zend_vm_execute.h:738) ==19654== by 0x45A641: execute_ex (zend_vm_execute.h:59759) ==19654== by 0x45C3A6: zend_execute (zend_vm_execute.h:63776) ==19654== by 0x3AAD91: zend_execute_scripts (zend.c:1498) ==19654== by 0x464D59: php_cli_server_dispatch_router.isra.10 (php_cli_server.c:2117) ==19654== by 0x46574A: php_cli_server_dispatch (php_cli_server.c:2156) ==19654== by 0x46574A: php_cli_server_recv_event_read_request (php_cli_server.c:2379) ==19654== by 0x46608D: php_cli_server_do_event_for_each_fd_callback (php_cli_server.c:2457) ==19654== by 0x466C0D: php_cli_server_poller_iter_on_active (php_cli_server.c:846) ==19654== by 0x466C0D: php_cli_server_do_event_for_each_fd (php_cli_server.c:2480) ==19654== by 0x466C0D: php_cli_server_do_event_loop (php_cli_server.c:2490) ==19654== by 0x466C0D: do_cli_server (php_cli_server.c:2612) ==19654== by 0x1F44D1: main (php_cli.c:1406) ==19654== Block was alloc'd at ==19654== at 0x4C2FB0F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==19654== by 0x37EE88: __zend_malloc (zend_alloc.c:2829) ==19654== by 0x3BDEC1: zend_array_dup (zend_hash.c:1764) ==19654== by 0x43CDEF: ZEND_ASSIGN_DIM_SPEC_CV_TMPVAR_OP_DATA_VAR_HANDLER (zend_vm_execute.h:47298) ==19654== by 0x45577D: execute_ex (zend_vm_execute.h:63077) ==19654== by 0x45C3A6: zend_execute (zend_vm_execute.h:63776) ==19654== by 0x3AAD91: zend_execute_scripts (zend.c:1498) ==19654== by 0x464D59: php_cli_server_dispatch_router.isra.10 (php_cli_server.c:2117) ==19654== by 0x46574A: php_cli_server_dispatch (php_cli_server.c:2156) ==19654== by 0x46574A: php_cli_server_recv_event_read_request (php_cli_server.c:2379) ==19654== by 0x46608D: php_cli_server_do_event_for_each_fd_callback (php_cli_server.c:2457) ==19654== by 0x466C0D: php_cli_server_poller_iter_on_active (php_cli_server.c:846) ==19654== by 0x466C0D: php_cli_server_do_event_for_each_fd (php_cli_server.c:2480) ==19654== by 0x466C0D: php_cli_server_do_event_loop (php_cli_server.c:2490) ==19654== by 0x466C0D: do_cli_server (php_cli_server.c:2612) ==19654== by 0x1F44D1: main (php_cli.c:1406) ==19654== ==19654== Invalid read of size 4 ==19654== at 0x3BCBF1: i_zval_ptr_dtor (zend_variables.h:48) ==19654== by 0x3BCBF1: zend_symtable_clean (zend_hash.c:1416) ==19654== by 0x452614: zend_clean_and_cache_symbol_table (zend_execute.c:2093) ==19654== by 0x452A5D: zend_leave_helper_SPEC (zend_vm_execute.h:468) ==19654== by 0x4582B6: ZEND_RETURN_SPEC_VAR_HANDLER (zend_vm_execute.h:15997) ==19654== by 0x4582B6: execute_ex (zend_vm_execute.h:60785) ==19654== by 0x45C3A6: zend_execute (zend_vm_execute.h:63776) ==19654== by 0x3AAD91: zend_execute_scripts (zend.c:1498) ==19654== by 0x464D59: php_cli_server_dispatch_router.isra.10 (php_cli_server.c:2117) ==19654== by 0x46574A: php_cli_server_dispatch (php_cli_server.c:2156) ==19654== by 0x46574A: php_cli_server_recv_event_read_request (php_cli_server.c:2379) ==19654== by 0x46608D: php_cli_server_do_event_for_each_fd_callback (php_cli_server.c:2457) ==19654== by 0x466C0D: php_cli_server_poller_iter_on_active (php_cli_server.c:846) ==19654== by 0x466C0D: php_cli_server_do_event_for_each_fd (php_cli_server.c:2480) ==19654== by 0x466C0D: php_cli_server_do_event_loop (php_cli_server.c:2490) ==19654== by 0x466C0D: do_cli_server (php_cli_server.c:2612) ==19654== by 0x1F44D1: main (php_cli.c:1406) ==19654== Address 0x16c7aa70 is 0 bytes inside a block of size 56 free'd ==19654== at 0x4C30D3B: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==19654== by 0x3BC850: i_zval_ptr_dtor (zend_variables.h:49) ==19654== by 0x3BC850: zend_array_destroy (zend_hash.c:1306) ==19654== by 0x2C51A5: php_extract_prefix_invalid (array.c:2357) ==19654== by 0x2C51A5: zif_extract (array.c:2554) ==19654== by 0x45A641: ZEND_DO_FCALL_BY_NAME_SPEC_RETVAL_UNUSED_HANDLER (zend_vm_execute.h:738) ==19654== by 0x45A641: execute_ex (zend_vm_execute.h:59759) ==19654== by 0x45C3A6: zend_execute (zend_vm_execute.h:63776) ==19654== by 0x3AAD91: zend_execute_scripts (zend.c:1498) ==19654== by 0x464D59: php_cli_server_dispatch_router.isra.10 (php_cli_server.c:2117) ==19654== by 0x46574A: php_cli_server_dispatch (php_cli_server.c:2156) ==19654== by 0x46574A: php_cli_server_recv_event_read_request (php_cli_server.c:2379) ==19654== by 0x46608D: php_cli_server_do_event_for_each_fd_callback (php_cli_server.c:2457) ==19654== by 0x466C0D: php_cli_server_poller_iter_on_active (php_cli_server.c:846) ==19654== by 0x466C0D: php_cli_server_do_event_for_each_fd (php_cli_server.c:2480) ==19654== by 0x466C0D: php_cli_server_do_event_loop (php_cli_server.c:2490) ==19654== by 0x466C0D: do_cli_server (php_cli_server.c:2612) ==19654== by 0x1F44D1: main (php_cli.c:1406) ==19654== Block was alloc'd at ==19654== at 0x4C2FB0F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==19654== by 0x37EE88: __zend_malloc (zend_alloc.c:2829) ==19654== by 0x3BDEC1: zend_array_dup (zend_hash.c:1764) ==19654== by 0x43CDEF: ZEND_ASSIGN_DIM_SPEC_CV_TMPVAR_OP_DATA_VAR_HANDLER (zend_vm_execute.h:47298) ==19654== by 0x45577D: execute_ex (zend_vm_execute.h:63077) ==19654== by 0x45C3A6: zend_execute (zend_vm_execute.h:63776) ==19654== by 0x3AAD91: zend_execute_scripts (zend.c:1498) ==19654== by 0x464D59: php_cli_server_dispatch_router.isra.10 (php_cli_server.c:2117) ==19654== by 0x46574A: php_cli_server_dispatch (php_cli_server.c:2156) ==19654== by 0x46574A: php_cli_server_recv_event_read_request (php_cli_server.c:2379) ==19654== by 0x46608D: php_cli_server_do_event_for_each_fd_callback (php_cli_server.c:2457) ==19654== by 0x466C0D: php_cli_server_poller_iter_on_active (php_cli_server.c:846) ==19654== by 0x466C0D: php_cli_server_do_event_for_each_fd (php_cli_server.c:2480) ==19654== by 0x466C0D: php_cli_server_do_event_loop (php_cli_server.c:2490) ==19654== by 0x466C0D: do_cli_server (php_cli_server.c:2612) ==19654== by 0x1F44D1: main (php_cli.c:1406) ==19654== ==19654== Invalid read of size 1 ==19654== at 0x3A88E0: _zval_dtor_func (zend_variables.c:33) ==19654== by 0x3BCD90: i_zval_ptr_dtor (zend_variables.h:49) ==19654== by 0x3BCD90: zend_symtable_clean (zend_hash.c:1416) ==19654== by 0x452614: zend_clean_and_cache_symbol_table (zend_execute.c:2093) ==19654== by 0x452A5D: zend_leave_helper_SPEC (zend_vm_execute.h:468) ==19654== by 0x4582B6: ZEND_RETURN_SPEC_VAR_HANDLER (zend_vm_execute.h:15997) ==19654== by 0x4582B6: execute_ex (zend_vm_execute.h:60785) ==19654== by 0x45C3A6: zend_execute (zend_vm_execute.h:63776) ==19654== by 0x3AAD91: zend_execute_scripts (zend.c:1498) ==19654== by 0x464D59: php_cli_server_dispatch_router.isra.10 (php_cli_server.c:2117) ==19654== by 0x46574A: php_cli_server_dispatch (php_cli_server.c:2156) ==19654== by 0x46574A: php_cli_server_recv_event_read_request (php_cli_server.c:2379) ==19654== by 0x46608D: php_cli_server_do_event_for_each_fd_callback (php_cli_server.c:2457) ==19654== by 0x466C0D: php_cli_server_poller_iter_on_active (php_cli_server.c:846) ==19654== by 0x466C0D: php_cli_server_do_event_for_each_fd (php_cli_server.c:2480) ==19654== by 0x466C0D: php_cli_server_do_event_loop (php_cli_server.c:2490) ==19654== by 0x466C0D: do_cli_server (php_cli_server.c:2612) ==19654== by 0x1F44D1: main (php_cli.c:1406) ==19654== Address 0x16c7aa74 is 4 bytes inside a block of size 56 free'd ==19654== at 0x4C30D3B: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==19654== by 0x3BC850: i_zval_ptr_dtor (zend_variables.h:49) ==19654== by 0x3BC850: zend_array_destroy (zend_hash.c:1306) ==19654== by 0x2C51A5: php_extract_prefix_invalid (array.c:2357) ==19654== by 0x2C51A5: zif_extract (array.c:2554) ==19654== by 0x45A641: ZEND_DO_FCALL_BY_NAME_SPEC_RETVAL_UNUSED_HANDLER (zend_vm_execute.h:738) ==19654== by 0x45A641: execute_ex (zend_vm_execute.h:59759) ==19654== by 0x45C3A6: zend_execute (zend_vm_execute.h:63776) ==19654== by 0x3AAD91: zend_execute_scripts (zend.c:1498) ==19654== by 0x464D59: php_cli_server_dispatch_router.isra.10 (php_cli_server.c:2117) ==19654== by 0x46574A: php_cli_server_dispatch (php_cli_server.c:2156) ==19654== by 0x46574A: php_cli_server_recv_event_read_request (php_cli_server.c:2379) ==19654== by 0x46608D: php_cli_server_do_event_for_each_fd_callback (php_cli_server.c:2457) ==19654== by 0x466C0D: php_cli_server_poller_iter_on_active (php_cli_server.c:846) ==19654== by 0x466C0D: php_cli_server_do_event_for_each_fd (php_cli_server.c:2480) ==19654== by 0x466C0D: php_cli_server_do_event_loop (php_cli_server.c:2490) ==19654== by 0x466C0D: do_cli_server (php_cli_server.c:2612) ==19654== by 0x1F44D1: main (php_cli.c:1406) ==19654== Block was alloc'd at ==19654== at 0x4C2FB0F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==19654== by 0x37EE88: __zend_malloc (zend_alloc.c:2829) ==19654== by 0x3BDEC1: zend_array_dup (zend_hash.c:1764) ==19654== by 0x43CDEF: ZEND_ASSIGN_DIM_SPEC_CV_TMPVAR_OP_DATA_VAR_HANDLER (zend_vm_execute.h:47298) ==19654== by 0x45577D: execute_ex (zend_vm_execute.h:63077) ==19654== by 0x45C3A6: zend_execute (zend_vm_execute.h:63776) ==19654== by 0x3AAD91: zend_execute_scripts (zend.c:1498) ==19654== by 0x464D59: php_cli_server_dispatch_router.isra.10 (php_cli_server.c:2117) ==19654== by 0x46574A: php_cli_server_dispatch (php_cli_server.c:2156) ==19654== by 0x46574A: php_cli_server_recv_event_read_request (php_cli_server.c:2379) ==19654== by 0x46608D: php_cli_server_do_event_for_each_fd_callback (php_cli_server.c:2457) ==19654== by 0x466C0D: php_cli_server_poller_iter_on_active (php_cli_server.c:846) ==19654== by 0x466C0D: php_cli_server_do_event_for_each_fd (php_cli_server.c:2480) ==19654== by 0x466C0D: php_cli_server_do_event_loop (php_cli_server.c:2490) ==19654== by 0x466C0D: do_cli_server (php_cli_server.c:2612) ==19654== by 0x1F44D1: main (php_cli.c:1406) ==19654== ^C==19654== ==19654== HEAP SUMMARY: ==19654== in use at exit: 100,556 bytes in 1,544 blocks ==19654== total heap usage: 206,894 allocs, 205,350 frees, 33,961,003 bytes allocated ==19654== ==19654== LEAK SUMMARY: ==19654== definitely lost: 7,032 bytes in 13 blocks ==19654== indirectly lost: 5,332 bytes in 42 blocks ==19654== possibly lost: 0 bytes in 0 blocks ==19654== still reachable: 88,192 bytes in 1,489 blocks ==19654== suppressed: 0 bytes in 0 blocks ==19654== Rerun with --leak-check=full to see details of leaked memory ==19654== ==19654== For counts of detected and suppressed errors, rerun with: -v ==19654== Use --track-origins=yes to see where uninitialised values come from ==19654== ERROR SUMMARY: 142 errors from 26 contexts (suppressed: 0 from 0) u7n@ags:/srv/zags-broadcast/web$ ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=77669 -- Edit this bug report at https://bugs.php.net/bug.php?id=77669&edit=1