Re: Sec Bug #81702 [Opn->Fbk]: JIT unit tests no longer show "Uncaught ArithmeticError: Bit shift by negative"
| From: | Rainer Jung | Date: | Sun, 19 Dec 2021 22:12:32 +0000 |
| Subject: | Re: Sec Bug #81702 [Opn->Fbk]: JIT unit tests no longer show "Uncaught ArithmeticError: Bit shift by negative" | ||
| References: | 1 | Groups: | php.bugs |
| Request: | Send a blank email to php-bugs+get-238498@lists.php.net to get a copy of this message | ||
Small reproduction case:
phpdir=/path/to/my/bld/php81
$phpdir/sapi/cli/.libs/lt-php -n \
-d opcache.enable_cli=1 \
-d opcache.jit_buffer_size=64M \
-d opcache.jit_hot_loop=1 \
-d opcache.jit_hot_return=1 \
-d opcache.jit_hot_func=1 \
-d opcache.jit_hot_side_exit=1 \
-d zend_extension=$phpdir/modules/opcache.so \
-f /var/tmp/segfault.php
and /var/tmp/segfault.php contains the PHP script from ext/opcache/tests/jit/bool_not_002.phpt or from ext/opcache/tests/jit/shift_right_004.phpt. Example:
<?php
function test() {
$j = 2;
for ($i = 0; $i < 10;
$i + $b = $a + $a = $a + $a = $a +
$a = !$a +
$c[0] .= 0xfff0001/34028236692903846346336*6) {
$a =!$a + $a &= 74444444 - 444 >> 4 - $j++;
if ($j > 14) break;
}
}
test();
?>
Example output:
Warning: Undefined variable $a in /var/tmp/segfault.php on line 6
Warning: Undefined variable $a in /var/tmp/segfault.php on line 6
Deprecated: Implicit conversion from float 1.0000000000000473 to int loses precision in /var/tmp/segfault.php on line 6
Deprecated: Implicit conversion from float 1.0000000000000473 to int loses precision in /var/tmp/segfault.php on line 6
/var/tmp/doit.sh: line 13: 23152 Segmentation fault (core dumped) $phpdir/sapi/cli/.libs/lt-php -n -d opcache.enable_cli=1 -d opcache.jit_buffer_size=64M -d opcache.jit_hot_loop=1 -d opcache.jit_hot_return=1 -d opcache.jit_hot_func=1 -d opcache.jit_hot_side_exit=1 -d zend_extension=$phpdir/modules/opcache.so -f /var/tmp/segfault.phpgdb says core happens in #0 0x00007f678e4c51c4 in zend_value_error (format=0x7fffbf5e774f "") at /path/to/my/bld/php81/Zend/zend.c:1677
va = {{gp_offset = 213, fp_offset = 1072693248, overflow_arg_area = 0x7f6781b19d38, reg_save_area = 0xd2a5e0}}
message = 0x1 <Address 0x1 out of bounds>