Bug #81435 [NEW]: Observer current_observed_frame may point to an old (overwritten) frame

From: bwoebi Operating system: MacOS 11 PHP version: 8.0.10 Package: Reproducible crash Bug Type: Bug Bug description:Observer current_observed_frame may point to an old (overwritten) frame Description: ------------ Observer current_observed_frame is unconditionally updated to prev_execute_data. However prev_execute_data may point to an unobserved function, causing current_observed_frame not to be updated until another observed function ends. Thus current_observed_frame may point to some already left unobserved function, which may already have been overwritten. Test script: --------------- Installing observers on a and d, <?php ini_set("memory_limit", "20M"); function d() {} // observed function c() { // gets prev_execute_data after end of d() d(); } function b() { c(); } function bailout(...$args) { array_map("str_repeat", ["\xFF"], [100000000]); } function a() { // observed (first_observed_frame) b(); bailout(1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15); // overwrite the vm_stack containing prev_execute_data } a(); Expected result: ---------------- No crash. Actual result: -------------- Crash, with current_observed_frame pointing to something not being a valid frame on the vm_stack: (gdb) bt #0 0x0000000012cd24c9 in zend_observer_fcall_end_all () at /usr/src/debug/php-8.0.10/Zend/zend_observer.c:235 #1 0x0000000012be059b in php_request_shutdown (dummy=dummy@entry=0x0) at /usr/src/debug/php-8.0.10/main/main.c:1777 -- Edit bug report at https://bugs.php.net/bug.php?id=81435&edit=1 -- Fix committed: https://bugs.php.net/fix.php?id=81435&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=81435&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=81435&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=81435&r=needscript Try newer version: https://bugs.php.net/fix.php?id=81435&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=81435&r=support Expected behavior: https://bugs.php.net/fix.php?id=81435&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=81435&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=81435&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=81435&r=globals PHP version support discontinued: https://bugs.php.net/fix.php?id=81435&r=phptooold Daylight Savings: https://bugs.php.net/fix.php?id=81435&r=dst IIS Stability: https://bugs.php.net/fix.php?id=81435&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=81435&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=81435&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=81435&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=81435&r=mysqlcfg