Bug #77737 [NEW]: Heap corruption in zend_mm_gc

From: bugs-syssec at rub dot de Operating system: Linux PHP version: 7.3.3 Package: *General Issues Bug Type: Bug Bug description:Heap corruption in zend_mm_gc Description: ------------ $ ./php --version PHP 7.3.0 (cli) (built: Jan 17 2019 14:04:29) ( NTS ) Copyright (c) 1997-2018 The PHP Group Zend Engine v3.3.0-dev, Copyright (c) 1998-2018 Zend Technologies Test script: --------------- <?php $a = strtotime(A); spl_autoload($a); gc_mem_caches(); Expected result: ---------------- No crash. Actual result: -------------- ==12423== Memcheck, a memory error detector ==12423== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al. ==12423== Using Valgrind-3.13.0 and LibVEX; rerun with -h for copyright info ==12423== Command: ./php-plain heap_corrption-1-zend_mm_gc.php ==12423== ==12423== Invalid read of size 8 ==12423== at 0x36EB93: zend_mm_gc.part.11 (zend_alloc.c:1949) ==12423== by 0x3AB737: zif_gc_mem_caches (zend_builtin_functions.c:356) ==12423== by 0x41F3C7: ZEND_DO_ICALL_SPEC_RETVAL_UNUSED_HANDLER (zend_vm_execute.h:645) ==12423== by 0x41F3C7: execute_ex (zend_vm_execute.h:55414) ==12423== by 0x42352F: zend_execute (zend_vm_execute.h:60834) ==12423== by 0x3972F6: zend_execute_scripts (zend.c:1568) ==12423== by 0x336457: php_execute_script (main.c:2630) ==12423== by 0x42597D: do_cli (php_cli.c:997) ==12423== by 0x1E49B1: main (php_cli.c:1389) ==12423== Address 0x646a00000 is not stack'd, malloc'd or (recently) free'd ==12423== ==12423== ==12423== Process terminating with default action of signal 11 (SIGSEGV) ==12423== Access not within mapped region at address 0x646A00000 ==12423== at 0x36EB93: zend_mm_gc.part.11 (zend_alloc.c:1949) ==12423== by 0x3AB737: zif_gc_mem_caches (zend_builtin_functions.c:356) ==12423== by 0x41F3C7: ZEND_DO_ICALL_SPEC_RETVAL_UNUSED_HANDLER (zend_vm_execute.h:645) ==12423== by 0x41F3C7: execute_ex (zend_vm_execute.h:55414) ==12423== by 0x42352F: zend_execute (zend_vm_execute.h:60834) ==12423== by 0x3972F6: zend_execute_scripts (zend.c:1568) ==12423== by 0x336457: php_execute_script (main.c:2630) ==12423== by 0x42597D: do_cli (php_cli.c:997) ==12423== by 0x1E49B1: main (php_cli.c:1389) ==12423== If you believe this happened as a result of a stack ==12423== overflow in your program's main thread (unlikely but ==12423== possible), you can try to increase the size of the ==12423== main thread stack using the --main-stacksize= flag. ==12423== The main thread stack size used in this run was 8388608. ==12423== ==12423== HEAP SUMMARY: ==12423== in use at exit: 922,523 bytes in 6,198 blocks ==12423== total heap usage: 6,622 allocs, 424 frees, 1,125,821 bytes allocated ==12423== ==12423== LEAK SUMMARY: ==12423== definitely lost: 0 bytes in 0 blocks ==12423== indirectly lost: 0 bytes in 0 blocks ==12423== possibly lost: 692,368 bytes in 5,247 blocks ==12423== still reachable: 230,155 bytes in 951 blocks ==12423== suppressed: 0 bytes in 0 blocks ==12423== Rerun with --leak-check=full to see details of leaked memory ==12423== ==12423== For counts of detected and suppressed errors, rerun with: -v ==12423== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0) -- Edit bug report at https://bugs.php.net/bug.php?id=77737&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=77737&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=77737&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=77737&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=77737&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=77737&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=77737&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=77737&r=needscript Try newer version: https://bugs.php.net/fix.php?id=77737&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=77737&r=support Expected behavior: https://bugs.php.net/fix.php?id=77737&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=77737&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=77737&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=77737&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=77737&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=77737&r=dst IIS Stability: https://bugs.php.net/fix.php?id=77737&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=77737&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=77737&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=77737&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=77737&r=mysqlcfg