Bug #79781 [Opn]: zend_mm_heap corrupted in zend_array_destroy
| From: | nikic@php.net | Date: | Tue, 07 Jul 2020 14:44:48 +0000 |
| Subject: | Bug #79781 [Opn]: zend_mm_heap corrupted in zend_array_destroy | ||
| References: | 1 | Groups: | php.bugs |
| Request: | Send a blank email to php-bugs+get-227863@lists.php.net to get a copy of this message | ||
Edit report at https://bugs.php.net/bug.php?id=79781&edit=1
ID: 79781
Updated by: nikic@php.net
Reported by: changochen1 at gmail dot com
Summary: zend_mm_heap corrupted in zend_array_destroy
Status: Open
Type: Bug
Package: Scripting Engine problem
PHP Version: 8.0Git-2020-07-04 (Git)
Block user comment: N
Private report: N
New Comment:
I can't reproduce with this script under valgrind, but very likely this is the same issue as
bug #79788.
Previous Comments:
------------------------------------------------------------------------
[2020-07-04 00:37:05] changochen1 at gmail dot com
Description:
------------
Cmdline: php -f poc
Stack dump:
---
Fatal error: Allowed memory size of 134217728 bytes exhausted at
/home/yongheng/php_clean/Zend/zend_hash.c:2104 (tried to allocate 320 bytes) in
/home/yongheng/php_poc5.php on line 2
zend_mm_heap corrupted
MemorySanitizer:DEADLYSIGNAL
==230806==ERROR: MemorySanitizer: SEGV on unknown address 0x03e900038596 (pc 0x7fbc7c66d187 bp
0x000001e00000 sp 0x7ffc089355c8 T230806)
==230806==The signal is caused by a READ memory access.
#0 0x7fbc7c66d186 in kill
/build/glibc-OTsEL5/glibc-2.27/signal/../sysdeps/unix/syscall-template.S:78
#1 0x120f077 in zend_mm_panic /home/yongheng/php_clean/Zend/zend_alloc.c:364:2
#2 0x121628a in zend_mm_free_heap /home/yongheng/php_clean/Zend/zend_alloc.c
#3 0x13e29a8 in zend_array_destroy /home/yongheng/php_clean/Zend/zend_hash.c:1660:2
#4 0x174fdeb in zend_objects_store_free_object_storage
/home/yongheng/php_clean/Zend/zend_objects_API.c:117:6
#5 0x13246c0 in shutdown_executor /home/yongheng/php_clean/Zend/zend_execute_API.c:338:2
#6 0x137edc3 in zend_deactivate /home/yongheng/php_clean/Zend/zend.c:1206:2
#7 0x10e6c13 in php_request_shutdown /home/yongheng/php_clean/main/main.c:1876:2
#8 0x177a53d in do_cli /home/yongheng/php_clean/sapi/cli/php_cli.c:1127:3
#9 0x1779b7f in main /home/yongheng/php_clean/sapi/cli/php_cli.c:1357:18
#10 0x7fbc7c64fb96 in __libc_start_main
/build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310
#11 0x43f8c9 in _start (/home/yongheng/php_clean/bld/sapi/cli/php+0x43f8c9)
MemorySanitizer can not provide additional info.
SUMMARY: MemorySanitizer: SEGV
/build/glibc-OTsEL5/glibc-2.27/signal/../sysdeps/unix/syscall-template.S:78 in kill
==230806==ABORTING
...
---
Test script:
---------------
<?
a () ;
function a () {
a ( new ArrayIterator ( [ 1 ] ) ) ;
}
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=79781&edit=1