Bug #81435 [Asn->Csd]: Observer current_observed_frame may point to an old (overwritten) frame
| From: | git@php.net | Date: | Mon, 13 Sep 2021 14:17:57 +0000 |
| Subject: | Bug #81435 [Asn->Csd]: Observer current_observed_frame may point to an old (overwritten) frame | ||
| References: | 1 | Groups: | php.bugs |
| Request: | Send a blank email to php-bugs+get-236567@lists.php.net to get a copy of this message | ||
Edit report at https://bugs.php.net/bug.php?id=81435&edit=1
ID: 81435
Updated by: git@php.net
Reported by: bwoebi@php.net
Summary: Observer current_observed_frame may point to an old
(overwritten) frame
-Status: Assigned
+Status: Closed
Type: Bug
Package: Reproducible crash
Operating System: MacOS 11
PHP Version: 8.0.10
Assigned To: bwoebi
Block user comment: N
Private report: N
New Comment:
Automatic comment on behalf of bwoebi
Revision: https://github.com/php/php-src/commit/12b0f1b7cc67d479b780e38391837eaf44f5d570
Log: Fix #81435 Observer current_observed_frame may point to an old (overwritten) frame
Previous Comments:
------------------------------------------------------------------------
[2021-09-13 12:14:59] bwoebi@php.net
Description:
------------
Observer current_observed_frame is unconditionally updated to prev_execute_data. However
prev_execute_data may point to an unobserved function, causing current_observed_frame not to be
updated until another observed function ends.
Thus current_observed_frame may point to some already left unobserved function, which may already
have been overwritten.
Test script:
---------------
Installing observers on a and d,
<?php
ini_set("memory_limit", "20M");
function d() {} // observed
function c() { // gets prev_execute_data after end of d()
d();
}
function b() {
c();
}
function bailout(...$args) {
array_map("str_repeat", ["\xFF"], [100000000]);
}
function a() { // observed (first_observed_frame)
b();
bailout(1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15); // overwrite the vm_stack
containing prev_execute_data
}
a();
Expected result:
----------------
No crash.
Actual result:
--------------
Crash, with current_observed_frame pointing to something not being a valid frame on the vm_stack:
(gdb) bt
#0 0x0000000012cd24c9 in zend_observer_fcall_end_all () at
/usr/src/debug/php-8.0.10/Zend/zend_observer.c:235
#1 0x0000000012be059b in php_request_shutdown (dummy=dummy@entry=0x0) at
/usr/src/debug/php-8.0.10/main/main.c:1777
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=81435&edit=1