Bug #81353 [Opn->Ver]: segfault with preloading and statically bound closure

Edit report at https://bugs.php.net/bug.php?id=81353&edit=1 ID: 81353 Updated by: nikic@php.net Reported by: mike@php.net Summary: segfault with preloading and statically bound closure -Status: Open +Status: Verified Type: Bug Package: opcache Operating System: Linux, macOS PHP Version: 7.4Git Block user comment: N Private report: N New Comment: We should be unsetting user defined error handlers before preloading. Previous Comments: ------------------------------------------------------------------------ [2021-08-16 07:51:47] mike@php.net ASAN report: 2021-08-16 09:47:50.462931+0200 php[45131:2277503] ==45131==ERROR: AddressSanitizer: heap-use-after-free on address 0x000106452ca0 at pc 0x000100dd7b74 bp 0x00016fdf7650 sp 0x00016fdf7648 2021-08-16 09:47:50.462937+0200 php[45131:2277503] READ of size 4 at 0x000106452ca0 thread T0 2021-08-16 09:47:50.462942+0200 php[45131:2277503] #0 0x100dd7b70 in zend_gc_refcount zend_types.h:1025 2021-08-16 09:47:50.462946+0200 php[45131:2277503] #1 0x100daa908 in ZEND_BIND_STATIC_SPEC_CV_UNUSED_HANDLER zend_vm_execute.h:46571 2021-08-16 09:47:50.462950+0200 php[45131:2277503] #2 0x100c16490 in execute_ex zend_vm_execute.h:53291 2021-08-16 09:47:50.462954+0200 php[45131:2277503] #3 0x100a91504 in zend_call_function zend_execute_API.c:820 2021-08-16 09:47:50.462958+0200 php[45131:2277503] #4 0x1005b1284 in zif_spl_autoload_call php_spl.c:452 2021-08-16 09:47:50.462962+0200 php[45131:2277503] #5 0x100a917c0 in zend_call_function zend_execute_API.c:833 2021-08-16 09:47:50.462966+0200 php[45131:2277503] #6 0x100a937a8 in zend_lookup_class_ex zend_execute_API.c:1002 2021-08-16 09:47:50.462970+0200 php[45131:2277503] #7 0x100a95fdc in zend_fetch_class_by_name zend_execute_API.c:1433 2021-08-16 09:47:50.462974+0200 php[45131:2277503] #8 0x100ce0aa0 in ZEND_NEW_SPEC_CONST_UNUSED_HANDLER zend_vm_execute.h:9255 2021-08-16 09:47:50.462978+0200 php[45131:2277503] #9 0x100c16490 in execute_ex zend_vm_execute.h:53291 2021-08-16 09:47:50.462982+0200 php[45131:2277503] #10 0x100a91504 in zend_call_function zend_execute_API.c:820 2021-08-16 09:47:50.462986+0200 php[45131:2277503] #11 0x100a8f2e8 in _call_user_function_ex zend_execute_API.c:645 2021-08-16 09:47:50.462993+0200 php[45131:2277503] #12 0x100adf550 in zend_error_va_list zend.c:1380 2021-08-16 09:47:50.462998+0200 php[45131:2277503] #13 0x100add7b8 in zend_error_at zend.c:1483 2021-08-16 09:47:50.463001+0200 php[45131:2277503] #14 0x107c21ce0 in preload_link ZendAccelerator.c:3809 2021-08-16 09:47:50.463005+0200 php[45131:2277503] #15 0x107c1d9f8 in accel_preload ZendAccelerator.c:4503 2021-08-16 09:47:50.463009+0200 php[45131:2277503] #16 0x107c18054 in accel_finish_startup ZendAccelerator.c:4830 2021-08-16 09:47:50.463013+0200 php[45131:2277503] #17 0x107c14ee4 in accel_post_startup ZendAccelerator.c:3059 2021-08-16 09:47:50.463016+0200 php[45131:2277503] #18 0x100adbae8 in zend_post_startup zend.c:1009 2021-08-16 09:47:50.463020+0200 php[45131:2277503] #19 0x100909bb0 in php_module_startup main.c:2397 2021-08-16 09:47:50.463024+0200 php[45131:2277503] #20 0x100e0f084 in php_cli_startup php_cli.c:410 2021-08-16 09:47:50.463027+0200 php[45131:2277503] #21 0x100e0b788 in main php_cli.c:1327 2021-08-16 09:47:50.463031+0200 php[45131:2277503] #22 0x1a119542c in start+0x0 (libdyld.dylib:arm64e+0x1842c) 2021-08-16 09:47:50.463034+0200 php[45131:2277503] 2021-08-16 09:47:50.463038+0200 php[45131:2277503] 0x000106452ca0 is located 0 bytes inside of 56-byte region [0x000106452ca0,0x000106452cd8) 2021-08-16 09:47:50.463042+0200 php[45131:2277503] freed by thread T0 here: 2021-08-16 09:47:50.463045+0200 php[45131:2277503] #0 0x10213f2b4 in wrap_free+0x98 (libclang_rt.asan_osx_dynamic.dylib:arm64e+0x3f2b4) 2021-08-16 09:47:50.463049+0200 php[45131:2277503] #1 0x100a1f280 in _efree_custom zend_alloc.c:2426 2021-08-16 09:47:50.463053+0200 php[45131:2277503] #2 0x100a1f138 in _efree zend_alloc.c:2546 2021-08-16 09:47:50.463057+0200 php[45131:2277503] #3 0x100b2e790 in zend_array_destroy zend_hash.c:1637 2021-08-16 09:47:50.463060+0200 php[45131:2277503] #4 0x100a9fee8 in destroy_op_array zend_opcode.c:428 2021-08-16 09:47:50.463064+0200 php[45131:2277503] #5 0x100b9d90c in zend_closure_free_storage zend_closures.c:474 2021-08-16 09:47:50.463075+0200 php[45131:2277503] #6 0x100bebdd0 in zend_objects_store_free_object_storage zend_objects_API.c:104 2021-08-16 09:47:50.463079+0200 php[45131:2277503] #7 0x107c1ca58 in accel_preload ZendAccelerator.c:4435 2021-08-16 09:47:50.463083+0200 php[45131:2277503] #8 0x107c18054 in accel_finish_startup ZendAccelerator.c:4830 2021-08-16 09:47:50.463087+0200 php[45131:2277503] #9 0x107c14ee4 in accel_post_startup ZendAccelerator.c:3059 2021-08-16 09:47:50.463090+0200 php[45131:2277503] #10 0x100adbae8 in zend_post_startup zend.c:1009 2021-08-16 09:47:50.463094+0200 php[45131:2277503] #11 0x100909bb0 in php_module_startup main.c:2397 2021-08-16 09:47:50.463098+0200 php[45131:2277503] #12 0x100e0f084 in php_cli_startup php_cli.c:410 2021-08-16 09:47:50.463102+0200 php[45131:2277503] #13 0x100e0b788 in main php_cli.c:1327 2021-08-16 09:47:50.463105+0200 php[45131:2277503] #14 0x1a119542c in start+0x0 (libdyld.dylib:arm64e+0x1842c) 2021-08-16 09:47:50.463109+0200 php[45131:2277503] 2021-08-16 09:47:50.463112+0200 php[45131:2277503] previously allocated by thread T0 here: 2021-08-16 09:47:50.463116+0200 php[45131:2277503] #0 0x10213f178 in wrap_malloc+0x94 (libclang_rt.asan_osx_dynamic.dylib:arm64e+0x3f178) 2021-08-16 09:47:50.463120+0200 php[45131:2277503] #1 0x100a1f9a0 in __zend_malloc zend_alloc.c:2982 2021-08-16 09:47:50.463123+0200 php[45131:2277503] #2 0x100a1f080 in _malloc_custom zend_alloc.c:2417 2021-08-16 09:47:50.463127+0200 php[45131:2277503] #3 0x100a1ef28 in _emalloc zend_alloc.c:2536 2021-08-16 09:47:50.463131+0200 php[45131:2277503] #4 0x100b22ab4 in zend_array_dup zend_hash.c:2047 2021-08-16 09:47:50.463134+0200 php[45131:2277503] #5 0x100b996fc in zend_create_closure zend_closures.c:704 2021-08-16 09:47:50.463138+0200 php[45131:2277503] #6 0x100d725c0 in ZEND_DECLARE_LAMBDA_FUNCTION_SPEC_CONST_UNUSED_HANDLER zend_vm_execute.h:9548 2021-08-16 09:47:50.463142+0200 php[45131:2277503] #7 0x100c16490 in execute_ex zend_vm_execute.h:53291 2021-08-16 09:47:50.463146+0200 php[45131:2277503] #8 0x100c16930 in zend_execute zend_vm_execute.h:57593 2021-08-16 09:47:50.463150+0200 php[45131:2277503] #9 0x107c1c690 in accel_preload ZendAccelerator.c:4372 2021-08-16 09:47:50.463153+0200 php[45131:2277503] #10 0x107c18054 in accel_finish_startup ZendAccelerator.c:4830 2021-08-16 09:47:50.463157+0200 php[45131:2277503] #11 0x107c14ee4 in accel_post_startup ZendAccelerator.c:3059 2021-08-16 09:47:50.463161+0200 php[45131:2277503] #12 0x100adbae8 in zend_post_startup zend.c:1009 2021-08-16 09:47:50.463164+0200 php[45131:2277503] #13 0x100909bb0 in php_module_startup main.c:2397 2021-08-16 09:47:50.463168+0200 php[45131:2277503] #14 0x100e0f084 in php_cli_startup php_cli.c:410 2021-08-16 09:47:50.463171+0200 php[45131:2277503] #15 0x100e0b788 in main php_cli.c:1327 2021-08-16 09:47:50.463175+0200 php[45131:2277503] #16 0x1a119542c in start+0x0 (libdyld.dylib:arm64e+0x1842c) ------------------------------------------------------------------------ [2021-08-16 07:20:55] mike@php.net Looks like it has to do with the static arrays and calling Closure::bind() with a class scope in composer's autoload_static. ------------------------------------------------------------------------ [2021-08-16 06:17:08] mike@php.net ASAN backtrace: frame #5: 0x0000000100dd7bf4 php`zend_gc_refcount(p=0x0000000106452ca0) at zend_types.h:1025:12 frame #6: 0x0000000100daa98c php`ZEND_BIND_STATIC_SPEC_CV_UNUSED_HANDLER(execute_data=0x0000000110604f20) at zend_vm_execute.h:46571:13 frame #7: 0x0000000100c16514 php`execute_ex(ex=0x0000000110604f20) at zend_vm_execute.h:53291:7 frame #8: 0x0000000100a915d4 php`zend_call_function(fci=0x000000016fdf8a70, fci_cache=0x000000016fdf8ad0) at zend_execute_API.c:820:3 frame #9: 0x00000001005b1354 php`zif_spl_autoload_call(execute_data=0x0000000110604ec0, return_value=0x000000016fdf9ce0) at php_spl.c:452:4 frame #10: 0x0000000100a91890 php`zend_call_function(fci=0x000000016fdf9d00, fci_cache=0x000000016fdf9d60) at zend_execute_API.c:833:4 frame #11: 0x0000000100a93878 php`zend_lookup_class_ex(name=0x000000010647da80, key=0x000000010647da20, flags=512) at zend_execute_API.c:1002:7 frame #12: 0x0000000100a960ac php`zend_fetch_class_by_name(class_name=0x000000010647da80, key=0x000000010647da20, fetch_type=512) at zend_execute_API.c:1433:19 frame #13: 0x0000000100ce0b24 php`ZEND_NEW_SPEC_CONST_UNUSED_HANDLER(execute_data=0x0000000110604b80) at zend_vm_execute.h:9255:9 frame #14: 0x0000000100c16514 php`execute_ex(ex=0x0000000110604820) at zend_vm_execute.h:53291:7 frame #15: 0x0000000100a915d4 php`zend_call_function(fci=0x000000016fdfb4a0, fci_cache=0x000000016fdfa830) at zend_execute_API.c:820:3 frame #16: 0x0000000100a8f3b8 php`_call_user_function_ex(object=0x0000000000000000, function_name=0x000000016fdfb7b0, retval_ptr=0x000000016fdfb790, param_count=5, params=0x000000016fdfb720, no_separation=1) at zend_execute_API.c:645:9 frame #17: 0x0000000100adf620 php`zend_error_va_list(type=2, error_filename="/private/tmp/php-crash-preload-error_handler/vendor/google/apiclient/src/aliases.php", error_lineno=64, format="Can't preload already declared class %s", args="Ø¿F\U00000006\U00000001") at zend.c:1380:8 frame #18: 0x0000000100add888 php`zend_error_at(type=2, filename="/private/tmp/php-crash-preload-error_handler/vendor/google/apiclient/src/aliases.php", lineno=64, format="Can't preload already declared class %s") at zend.c:1483:2 frame #19: 0x0000000107c21ce4 opcache.so`preload_link at ZendAccelerator.c:3809:5 frame #20: 0x0000000107c1d9fc opcache.so`accel_preload(config="/tmp/php-crash-preload-error_handler/index.php") at ZendAccelerator.c:4503:4 frame #21: 0x0000000107c18058 opcache.so`accel_finish_startup at ZendAccelerator.c:4830:8 frame #22: 0x0000000107c14ee8 opcache.so`accel_post_startup at ZendAccelerator.c:3059:9 frame #23: 0x0000000100adbbb8 php`zend_post_startup at zend.c:1009:7 frame #24: 0x0000000100909c80 php`php_module_startup(sf=0x00000001017b3ae0, additional_modules=0x0000000000000000, num_additional_modules=0) at main.c:2397:6 frame #25: 0x0000000100e0f108 php`php_cli_startup(sapi_module=0x00000001017b3ae0) at php_cli.c:410:6 frame #26: 0x0000000100e0b80c php`main(argc=7, argv=0x000000016fdff078) at php_cli.c:1327:6 ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=81353 -- Edit this bug report at https://bugs.php.net/bug.php?id=81353&edit=1