Bug #81610 [NEW]: Interrupt on jump leads to dangling pointer

From: tstarling@php.net Operating system: PHP version: 8.1Git-2021-11-11 (Git) Package: Reproducible crash Bug Type: Bug Bug description: Interrupt on jump leads to dangling pointer Description: ------------ Handlers of jump-like opcodes update the opline to point to the jump target before checking EG(vm_interrupt) and calling the interrupt handler. If an exception is thrown by the interrupt handler, the ZEND_HANDLE_EXCEPTION handler will free the return value of the target opline, even though it has had no opportunity to run yet. There will be a PR. Test script: --------------- <?php /* Run with opcache.enable_cli=1 and send SIGUSR1 several times */ class C { public static $cond = 1; public static $a; } C::$a = [ C::$cond ]; // make countable zval function go() { while ( true ) { $cond = C::$cond; // T1 = FETCH_STATIC_PROP_R string("a") string("C") C::$a; // FREE T1 // JMPZ CV0($cond) 0000 if ( $cond ) // T1 = FETCH_STATIC_PROP_R string("a") string("C") // (not executed but T1 freed) C::$a; } } pcntl_async_signals( true ); pcntl_signal( SIGUSR1, function () { throw new Exception( 'ping' ); } ); while ( true ) { try { go(); } catch ( Exception $e ) {} } Actual result: -------------- It crashes after receiving about 4 SIGUSR1 signals. -- Edit bug report at https://bugs.php.net/bug.php?id=81610&edit=1 -- Fix committed: https://bugs.php.net/fix.php?id=81610&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=81610&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=81610&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=81610&r=needscript Try newer version: https://bugs.php.net/fix.php?id=81610&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=81610&r=support Expected behavior: https://bugs.php.net/fix.php?id=81610&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=81610&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=81610&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=81610&r=globals PHP version support discontinued: https://bugs.php.net/fix.php?id=81610&r=phptooold Daylight Savings: https://bugs.php.net/fix.php?id=81610&r=dst IIS Stability: https://bugs.php.net/fix.php?id=81610&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=81610&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=81610&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=81610&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=81610&r=mysqlcfg