Re: Sec Bug #81702 [Opn->Fbk]: JIT unit tests no longer show "Uncaught ArithmeticError: Bit shift by negative"

From: Date: Sun, 19 Dec 2021 22:12:32 +0000
Subject: Re: Sec Bug #81702 [Opn->Fbk]: JIT unit tests no longer show "Uncaught ArithmeticError: Bit shift by negative"
References: 1  Groups: php.bugs 
Request: Send a blank email to php-bugs+get-238498@lists.php.net to get a copy of this message
Small reproduction case: phpdir=/path/to/my/bld/php81 $phpdir/sapi/cli/.libs/lt-php -n \
    -d opcache.enable_cli=1 \
    -d opcache.jit_buffer_size=64M \
    -d opcache.jit_hot_loop=1 \
    -d opcache.jit_hot_return=1 \
    -d opcache.jit_hot_func=1 \
    -d opcache.jit_hot_side_exit=1 \
    -d zend_extension=$phpdir/modules/opcache.so \
    -f /var/tmp/segfault.php
and /var/tmp/segfault.php contains the PHP script from ext/opcache/tests/jit/bool_not_002.phpt or from ext/opcache/tests/jit/shift_right_004.phpt. Example: <?php function test() {
        $j = 2;
    for ($i = 0; $i < 10;
        $i + $b = $a + $a = $a + $a = $a +
                    $a = !$a +
                        $c[0] .= 0xfff0001/34028236692903846346336*6) {
            $a =!$a + $a &= 74444444 - 444 >> 4 - $j++;
        if ($j > 14) break;
    }
} test(); ?> Example output: Warning: Undefined variable $a in /var/tmp/segfault.php on line 6 Warning: Undefined variable $a in /var/tmp/segfault.php on line 6 Deprecated: Implicit conversion from float 1.0000000000000473 to int loses precision in /var/tmp/segfault.php on line 6 Deprecated: Implicit conversion from float 1.0000000000000473 to int loses precision in /var/tmp/segfault.php on line 6
/var/tmp/doit.sh: line 13: 23152 Segmentation fault      (core dumped) $phpdir/sapi/cli/.libs/lt-php -n -d opcache.enable_cli=1 -d opcache.jit_buffer_size=64M -d opcache.jit_hot_loop=1 -d opcache.jit_hot_return=1 -d opcache.jit_hot_func=1 -d opcache.jit_hot_side_exit=1 -d zend_extension=$phpdir/modules/opcache.so -f /var/tmp/segfault.php
gdb says core happens in #0 0x00007f678e4c51c4 in zend_value_error (format=0x7fffbf5e774f "") at /path/to/my/bld/php81/Zend/zend.c:1677
        va = {{gp_offset = 213, fp_offset = 1072693248, overflow_arg_area = 0x7f6781b19d38, reg_save_area = 0xd2a5e0}}
        message = 0x1 <Address 0x1 out of bounds>


« previous php.bugs (#238498) next »