Bug #79815 [NEW]: Segfault in zend_string_release_ex

From: changochen1 at gmail dot com Operating system: PHP version: 8.0Git-2020-07-09 (Git) Package: Scripting Engine problem Bug Type: Bug Bug description:Segfault in zend_string_release_ex Description: ------------ Build config: '--enable-debug-assertions' '--enable-memory-sanitizer' Stack dump: --- ==136341==ERROR: MemorySanitizer: SEGV on unknown address 0x000000000084 (pc 0x00000133bb1f bp 0x0000ffffffff sp 0x7fff35759370 T136341) ==136341==The signal is caused by a READ memory access. ==136341==Hint: address points to the zero page. #0 0x133bb1e in zend_string_release_ex /home/yongheng/php_clean/Zend/zend_string.h:303:7 #1 0x133bb1e in destroy_op_array /home/yongheng/php_clean/Zend/zend_opcode.c:480 #2 0x1325ed0 in shutdown_executor /home/yongheng/php_clean/Zend/zend_execute_API.c:382:5 #3 0x137f423 in zend_deactivate /home/yongheng/php_clean/Zend/zend.c:1206:2 #4 0x10e72b3 in php_request_shutdown /home/yongheng/php_clean/main/main.c:1842:2 #5 0x17895cd in do_cli /home/yongheng/php_clean/sapi/cli/php_cli.c:1124:3 #6 0x1788c0f in main /home/yongheng/php_clean/sapi/cli/php_cli.c:1353:18 #7 0x7f21ba54db96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310 #8 0x43f9d9 in _start (/home/yongheng/php_clean/bld/sapi/cli/php+0x43f9d9) MemorySanitizer can not provide additional info. SUMMARY: MemorySanitizer: SEGV /home/yongheng/php_clean/Zend/zend_string.h:303:7 in zend_string_release_ex ==136341==ABORTING --- Test script: --------------- <? var_dump ( $m -> a ) ; var_dump ( empty ( $m ) ) ; var_dump ( empty ( $m ) ) ; var_dump ( empty ( $argv ) ) ; var_dump ( empty ( $m ) ) ; var_dump ( empty ( $m ) ) ; var_dump ( empty ( $m ) ) ; var_dump ( isset ( $m ) ) ; var_dump ( isset ( $m ) ) ; var_dump ( isset ( $m ) ) ; var_dump ( isset ( $m ) ) ; var_dump ( isset ( $m ) ) ; var_dump ( isset ( $m ) ) ; var_dump ( $m [ 0 ] ) ; var_dump ( $m [ 1 ] ) ; var_dump ( $m [ 2 ] ) ; var_dump ( $validGtOrEqual [ isset ( array ( - $f > unlink ( 'x' ) ) [ 0 ] ) ? var_dump ( 4 , 0 , 0 , 8 , array ( $valid_false , ob_start ( function ( $class_name ) { $counter ; static $a , $b , $c , $d , $e ; n . strtolower ( array ( o , $valid_true , p , false , array_merge , NULL , $$$$g , $valid_int2 , $invalid_int2 , $h , $valid_float1 , $invalid_float1 , $i , $valid_float2 , $invalid_float2 ) ) . 'x' ; 'x' . class_name . 'x' ; } ) , $j , $$$$invalid_int2 , 'x' => glob ( [ include __FILE__ ] ) [ array_key_exists ] [ k ] , $$invalid_float1 , i , valid_float2 , invalid_float2 ) ) : NULL ] ) ( m [ ] ) () ( m [] ) ; var_dump ( $m [ 'x' ] ) ; var_dump ( $m [ 'x' ] ) ; var_dump ( $m [ 1 ] ) ; var_dump ( $m [ 1 ] ) ; var_dump ( $m [ 1 ] ) ; var_dump ( $m [ 1 ] ) ; var_dump ( $l ) ; $wrongClassname :: $methodname () . 'x' ; -- Edit bug report at https://bugs.php.net/bug.php?id=79815&edit=1 -- Fix committed: https://bugs.php.net/fix.php?id=79815&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=79815&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=79815&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=79815&r=needscript Try newer version: https://bugs.php.net/fix.php?id=79815&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=79815&r=support Expected behavior: https://bugs.php.net/fix.php?id=79815&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=79815&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=79815&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=79815&r=globals PHP version support discontinued: https://bugs.php.net/fix.php?id=79815&r=phptooold Daylight Savings: https://bugs.php.net/fix.php?id=79815&r=dst IIS Stability: https://bugs.php.net/fix.php?id=79815&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=79815&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=79815&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=79815&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=79815&r=mysqlcfg