Bug #74843 [Opn->Fbk]: Use-after-free Cycle GC in combination with Reflection API

Edit report at https://bugs.php.net/bug.php?id=74843&edit=1 ID: 74843 Updated by: cmb@php.net Reported by: stesie@php.net Summary: Use-after-free Cycle GC in combination with Reflection API -Status: Open +Status: Feedback Type: Bug Package: Reproducible crash Operating System: Linux Ubuntu/16.04 PHP Version: 7.0.20 -Assigned To: +Assigned To: cmb Block user comment: N Private report: N New Comment: Is this still an issue with any of the actively supported PHP versions[1]? [1] <https://www.php.net/supported-versions.php> Previous Comments: ------------------------------------------------------------------------ [2017-07-02 08:28:25] stesie@php.net Description: ------------ Hello, unfortunately I cannot reduce this down to a simple test script; yet the problem is reproducible on multiple machines. The problem is triggered by the integration test suite of Symfony CMF Sandbox, (Travis log here: https://travis-ci.org/symfony-cmf/cmf-sandbox/builds/248151096) Things I already found out -> affects PHP versions from 7.0.x branch (tested 7.0.1 and 7.0.20) -> 7.1.x not affected -> ZTS must be *enabled* -> PHP does not crash with -d zend.enable_gc=0 PHP with ASAN compiled with ./configure --enable-maintainer-zts --prefix=/testing-7.1.0 --with-readline --with-openssl --with-curl CFLAGS="-fsanitize=address -fno-omit-frame-pointer -fno-optimize-sibling-calls -O0 -ggdb" LDFLAGS="-fsanitize=address -ggdb" Actual result: -------------- root@0dbebda4d8b8:~/cmf-sandbox# /testing/bin/php -d memory_limit=-1 vendor/bin/simple-phpunit -vvv --debug tests/Functional/StaticPageTest.php PHPUnit 5.7.21 by Sebastian Bergmann and contributors. Runtime: PHP 7.0.20 Configuration: /root/cmf-sandbox/phpunit.xml.dist Testing Tests\Functional\StaticPageTest Starting test 'Tests\Functional\StaticPageTest::testContent with data set #0 ('/en', 'Homepage')'. . Starting test 'Tests\Functional\StaticPageTest::testContent with data set #1 ('/en/projects', 'The projects')'. ================================================================= ==1994==ERROR: AddressSanitizer: heap-use-after-free on address 0x607000181950 at pc 0x000000fe1834 bp 0x7fff64d34bc0 sp 0x7fff64d34bb0 READ of size 4 at 0x607000181950 thread T0 #0 0xfe1833 in zval_refcount_p /tmp/php-7.0.20/Zend/zend_types.h:812 #1 0xfe1833 in zval_update_constant_ex /tmp/php-7.0.20/Zend/zend_execute_API.c:563 #2 0xabfecc in zim_reflection_parameter_getDefaultValue /tmp/php-7.0.20/ext/reflection/php_reflection.c:2872 #3 0x11d2ef5 in ZEND_DO_FCALL_SPEC_HANDLER /tmp/php-7.0.20/Zend/zend_vm_execute.h:842 #4 0x11c5546 in execute_ex /tmp/php-7.0.20/Zend/zend_vm_execute.h:414 #5 0xfe7e79 in zend_call_function /tmp/php-7.0.20/Zend/zend_execute_API.c:867 #6 0xc5397b in zif_call_user_func /tmp/php-7.0.20/ext/standard/basic_functions.c:4786 #7 0x11cf78a in ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER /tmp/php-7.0.20/Zend/zend_vm_execute.h:714 #8 0x11c5546 in execute_ex /tmp/php-7.0.20/Zend/zend_vm_execute.h:414 #9 0xfe7e79 in zend_call_function /tmp/php-7.0.20/Zend/zend_execute_API.c:867 #10 0xc5397b in zif_call_user_func /tmp/php-7.0.20/ext/standard/basic_functions.c:4786 #11 0x11cf78a in ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER /tmp/php-7.0.20/Zend/zend_vm_execute.h:714 #12 0x11c5546 in execute_ex /tmp/php-7.0.20/Zend/zend_vm_execute.h:414 #13 0xfe7e79 in zend_call_function /tmp/php-7.0.20/Zend/zend_execute_API.c:867 #14 0xac7258 in zim_reflection_method_invokeArgs /tmp/php-7.0.20/ext/reflection/php_reflection.c:3355 #15 0x11d2ef5 in ZEND_DO_FCALL_SPEC_HANDLER /tmp/php-7.0.20/Zend/zend_vm_execute.h:842 #16 0x11c5546 in execute_ex /tmp/php-7.0.20/Zend/zend_vm_execute.h:414 #17 0x11c72d1 in zend_execute /tmp/php-7.0.20/Zend/zend_vm_execute.h:458 #18 0x104226f in zend_execute_scripts /tmp/php-7.0.20/Zend/zend.c:1443 #19 0xe2ce69 in php_execute_script /tmp/php-7.0.20/main/main.c:2492 #20 0x147143b in do_cli /tmp/php-7.0.20/sapi/cli/php_cli.c:977 #21 0x14740c1 in main /tmp/php-7.0.20/sapi/cli/php_cli.c:1347 #22 0x7f3afd69082f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) #23 0x42c678 in _start (/testing/bin/php+0x42c678) 0x607000181950 is located 0 bytes inside of 72-byte region [0x607000181950,0x607000181998) freed by thread T0 here: #0 0x7f3aff3342ca in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x982ca) #1 0xf6f6ef in _efree /tmp/php-7.0.20/Zend/zend_alloc.c:2472 #2 0x103396d in zend_string_free /tmp/php-7.0.20/Zend/zend_string.h:263 #3 0x103396d in _zval_dtor_func_for_ptr /tmp/php-7.0.20/Zend/zend_variables.c:89 #4 0x116b19c in i_zval_ptr_dtor /tmp/php-7.0.20/Zend/zend_variables.h:58 #5 0x116b19c in zend_object_std_dtor /tmp/php-7.0.20/Zend/zend_objects.c:69 #6 0x112591d in zend_gc_collect_cycles /tmp/php-7.0.20/Zend/zend_gc.c:1128 #7 0x111b5fc in gc_possible_root /tmp/php-7.0.20/Zend/zend_gc.c:236 #8 0x11c7be1 in gc_check_possible_root /tmp/php-7.0.20/Zend/zend_gc.h:149 #9 0x11c7be1 in i_free_compiled_variables /tmp/php-7.0.20/Zend/zend_execute.c:2080 #10 0x11c7be1 in zend_leave_helper_SPEC /tmp/php-7.0.20/Zend/zend_vm_execute.h:470 #11 0x11fa6bd in ZEND_RETURN_SPEC_CONST_HANDLER /tmp/php-7.0.20/Zend/zend_vm_execute.h:3136 #12 0x11c5546 in execute_ex /tmp/php-7.0.20/Zend/zend_vm_execute.h:414 #13 0x11c72d1 in zend_execute /tmp/php-7.0.20/Zend/zend_vm_execute.h:458 #14 0x104226f in zend_execute_scripts /tmp/php-7.0.20/Zend/zend.c:1443 #15 0xe2ce69 in php_execute_script /tmp/php-7.0.20/main/main.c:2492 #16 0x147143b in do_cli /tmp/php-7.0.20/sapi/cli/php_cli.c:977 #17 0x14740c1 in main /tmp/php-7.0.20/sapi/cli/php_cli.c:1347 #18 0x7f3afd69082f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) previously allocated by thread T0 here: #0 0x7f3aff334602 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98602) #1 0xf726d1 in __zend_malloc /tmp/php-7.0.20/Zend/zend_alloc.c:2864 #2 0xf6f166 in _emalloc /tmp/php-7.0.20/Zend/zend_alloc.c:2457 #3 0xf7c25e in zend_string_alloc Zend/zend_string.h:121 #4 0xf7c25e in zend_concat3 /tmp/php-7.0.20/Zend/zend_compile.c:731 #5 0xf7c466 in zend_concat_names /tmp/php-7.0.20/Zend/zend_compile.c:742 #6 0xf7c668 in zend_prefix_with_ns /tmp/php-7.0.20/Zend/zend_compile.c:748 #7 0xf7d295 in zend_resolve_non_class_name /tmp/php-7.0.20/Zend/zend_compile.c:821 #8 0xf7d4a7 in zend_resolve_const_name /tmp/php-7.0.20/Zend/zend_compile.c:833 #9 0xfcd01b in zend_compile_const_expr_const /tmp/php-7.0.20/Zend/zend_compile.c:6965 #10 0xfcdb07 in zend_compile_const_expr /tmp/php-7.0.20/Zend/zend_compile.c:7021 #11 0xfcdb60 in zend_const_expr_to_zval /tmp/php-7.0.20/Zend/zend_compile.c:7037 #12 0xfabe01 in zend_compile_params /tmp/php-7.0.20/Zend/zend_compile.c:4571 #13 0xfb0d91 in zend_compile_func_decl /tmp/php-7.0.20/Zend/zend_compile.c:4968 #14 0xfce75f in zend_compile_stmt /tmp/php-7.0.20/Zend/zend_compile.c:7151 #15 0xfaa532 in zend_compile_stmt_list /tmp/php-7.0.20/Zend/zend_compile.c:4429 #16 0xfce5f2 in zend_compile_stmt /tmp/php-7.0.20/Zend/zend_compile.c:7095 #17 0xfb680f in zend_compile_class_decl /tmp/php-7.0.20/Zend/zend_compile.c:5376 #18 0xfce7af in zend_compile_stmt /tmp/php-7.0.20/Zend/zend_compile.c:7163 #19 0xfcdfb7 in zend_compile_top_stmt /tmp/php-7.0.20/Zend/zend_compile.c:7069 #20 0xfcdf5f in zend_compile_top_stmt /tmp/php-7.0.20/Zend/zend_compile.c:7064 #21 0xed1af9 in compile_file Zend/zend_language_scanner.l:608 #22 0xa4b394 in phar_compile_file /tmp/php-7.0.20/ext/phar/phar.c:3337 #23 0xed25dd in compile_filename Zend/zend_language_scanner.l:649 #24 0x136aec8 in ZEND_INCLUDE_OR_EVAL_SPEC_CV_HANDLER /tmp/php-7.0.20/Zend/zend_vm_execute.h:29518 #25 0x11c5546 in execute_ex /tmp/php-7.0.20/Zend/zend_vm_execute.h:414 #26 0xfe7e79 in zend_call_function /tmp/php-7.0.20/Zend/zend_execute_API.c:867 #27 0x10f7df2 in zend_call_method /tmp/php-7.0.20/Zend/zend_interfaces.c:104 #28 0xb4da85 in zif_spl_autoload_call /tmp/php-7.0.20/ext/spl/php_spl.c:421 #29 0xfe8486 in zend_call_function /tmp/php-7.0.20/Zend/zend_execute_API.c:887 #30 0xfeb72b in zend_lookup_class_ex /tmp/php-7.0.20/Zend/zend_execute_API.c:1049 SUMMARY: AddressSanitizer: heap-use-after-free /tmp/php-7.0.20/Zend/zend_types.h:812 zval_refcount_p Shadow bytes around the buggy address: 0x0c0e800282d0: 00 fa fa fa fa fa 00 00 00 00 00 00 00 00 00 fa 0x0c0e800282e0: fa fa fa fa 00 00 00 00 00 00 00 00 00 fa fa fa 0x0c0e800282f0: fa fa 00 00 00 00 00 00 00 00 00 00 fa fa fa fa 0x0c0e80028300: 00 00 00 00 00 00 00 00 00 fa fa fa fa fa 00 00 0x0c0e80028310: 00 00 00 00 00 00 00 fa fa fa fa fa 00 00 00 00 =>0x0c0e80028320: 00 00 00 00 00 fa fa fa fa fa[fd]fd fd fd fd fd 0x0c0e80028330: fd fd fd fa fa fa fa fa 00 00 00 00 00 00 00 00 0x0c0e80028340: 00 00 fa fa fa fa 00 00 00 00 00 00 00 00 00 00 0x0c0e80028350: fa fa fa fa 00 00 00 00 00 00 00 00 00 fa fa fa 0x0c0e80028360: fa fa 00 00 00 00 00 00 00 00 00 fa fa fa fa fa 0x0c0e80028370: 00 00 00 00 00 00 00 00 00 fa fa fa fa fa 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Heap right redzone: fb Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack partial redzone: f4 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe ==1994==ABORTING ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=74843&edit=1