Bug #79760 [NEW]: Potential use after free if memory limit hit during GC

From: nikic Operating system: PHP version: 8.0Git-2020-06-30 (Git) Package: Scripting Engine problem Bug Type: Bug Bug description:Potential use after free if memory limit hit during GC Description: ------------ If a get_gc handler triggers the memory limit after the GC has decremented refcounts, we may end up freeing objects early. For example, running Laravel tests on master with default memory limit results in: php: /home/nikic/php/php-src-asan/Zend/zend_types.h:1162: zend_gc_delref: Assertion `p->refcount > 0' failed. with the following backtrace fragment from the _zend_bailout: #15 0x0000555556c5b818 in zend_std_get_properties (zobj=0x7fffe7992c08) at /home/nikic/php/php-src-asan/Zend/zend_object_handlers.c:110 #16 0x0000555556358910 in reflection_get_gc (obj=0x7fffe7992c08, gc_data=0x7fffffff8bd0, gc_data_count=0x7fffffff8b80) at /home/nikic/php/php-src-asan/ext/reflection/php_reflection.c:275 #17 0x0000555556c1f296 in gc_mark_grey (ref=0x7fffe7992c08, stack=0x7fffffff8d10) at /home/nikic/php/php-src-asan/Zend/zend_gc.c:827 #18 0x0000555556c20335 in gc_mark_roots (stack=0x7fffffff8d10) at /home/nikic/php/php-src-asan/Zend/zend_gc.c:979 #19 0x0000555556c23c23 in zend_gc_collect_cycles () at /home/nikic/php/php-src-asan/Zend/zend_gc.c:1464 Not sure how to fix this. -- Edit bug report at https://bugs.php.net/bug.php?id=79760&edit=1 -- Fix committed: https://bugs.php.net/fix.php?id=79760&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=79760&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=79760&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=79760&r=needscript Try newer version: https://bugs.php.net/fix.php?id=79760&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=79760&r=support Expected behavior: https://bugs.php.net/fix.php?id=79760&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=79760&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=79760&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=79760&r=globals PHP version support discontinued: https://bugs.php.net/fix.php?id=79760&r=phptooold Daylight Savings: https://bugs.php.net/fix.php?id=79760&r=dst IIS Stability: https://bugs.php.net/fix.php?id=79760&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=79760&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=79760&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=79760&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=79760&r=mysqlcfg