[php-src] Issue #9171: PHP 8.0.20 segfault in zend_mm_alloc_small

Issue: https://github.com/php/php-src/issues/9171 Author: Xmister ### Description Hi, This issue happens frequently (but not always) when we try to parse an xml response. The php code leading to the parse is nothing special, just a basic Drupal 7 site calling xml_parse from [xmlrpc.inc](https://github.com/drupal/drupal/blob/cc540ac81d393aa8c122f4e8f9b994b9561a9609/includes/xmlrpc.inc#L215) ``` (gdb) zbacktrace [0x7fd042a15b40] xml_parse(object[0x7fd042a15b90], "...") [internal function] ``` Here is what I find weird. If I'm understanding the values right, the next free slot (heap->free_slot[6], which is 0x7fd03c101cb000) is having 2 extra zeros than the rest of the values, and thus pointing out of memory. Here is the gdb output with the full backtrace: ``` #0 zend_mm_alloc_small (bin_num=6, heap=0x7fd042a00040) at /usr/local/src/php-8.0.20/Zend/zend_alloc.c:1255 warning: Source file is more recent than executable. 1255 heap->free_slot[bin_num] = p->next_free_slot; (gdb) print bin_num $1 = 6 (gdb) print heap->free_slot $2 = {0x7fd042a01170, 0x7fd042a5c390, 0x7fd042b21a50, 0x7fd03c102a20, 0x7fd03c132ca8, 0x7fd03c1296f0, 0x7fd03c101cb000, 0x7fd03c0b2c80, 0x7fd03c045280, 0x7fd03c01f840, 0x7fd042bfeaf0, 0x7fd042a82e00, 0x7fd03c04a3c0, 0x7fd042a84b40, 0x7fd042a8d7e0, 0x7fd03c054400, 0x7fd03c0ff5c0, 0x7fd042a87600, 0x7fd03c01d1c0, 0x7fd042aa5800, 0x7fd03c099700, 0x7fd042bf0900, 0x7fd042b83a80, 0x7fd042b87400, 0x7fd042b7b800, 0x7fd042ab5c00, 0x7fd042acb000, 0x7fd042bfa000, 0x7fd042b34200, 0x7fd042bee800} (gdb) bt 20 #0 zend_mm_alloc_small (bin_num=6, heap=0x7fd042a00040) at /usr/local/src/php-8.0.20/Zend/zend_alloc.c:1255 #1 _emalloc_56 () at /usr/local/src/php-8.0.20/Zend/zend_alloc.c:2467 #2 0x000000000083e489 in _zend_new_array_0 () at /usr/local/src/php-8.0.20/Zend/zend_hash.c:271 #3 0x000000000079d143 in _xml_startElementHandler (userData=0x7fd03c01d380, name=<optimized out>, attributes=0x0) at /usr/local/src/php-8.0.20/ext/xml/xml.c:643 #4 0x000000000079dd02 in _start_element_handler (user=0x7fd042a82c80, name=<optimized out>, attributes=0x0) at /usr/local/src/php-8.0.20/ext/xml/compat.c:82 #5 0x00007fd04ce922f8 in xmlParseStartTag () from /usr/lib/x86_64-linux-gnu/libxml2.so.2 #6 0x00007fd04cea14d9 in ?? () from /usr/lib/x86_64-linux-gnu/libxml2.so.2 #7 0x00007fd04cea26db in xmlParseChunk () from /usr/lib/x86_64-linux-gnu/libxml2.so.2 #8 0x000000000079e305 in php_XML_Parse (parser=0x7fd042a82c80, data=<optimized out>, data_len=<optimized out>, is_final=<optimized out>) at /usr/local/src/php-8.0.20/ext/xml/compat.c:566 #9 0x000000000079ab6b in zif_xml_parse (execute_data=<optimized out>, return_value=0x7fd042a15a20) at /usr/local/src/php-8.0.20/ext/xml/xml.c:1270 #10 0x00007fd03d9e1b3c in tideways_xhprof_execute_internal (execute_data=0x7fd042a15b40, return_value=0x7fd042a15a20) at /usr/local/src/php-8.0.20/php-xhprof-extension-5.0.4/tideways_xhprof.c:230 #11 0x00000000004650c7 in ZEND_DO_FCALL_SPEC_OBSERVER_HANDLER () at /usr/local/src/php-8.0.20/Zend/zend_vm_execute.h:1973 #12 0x000000000089bd68 in execute_ex (ex=0x7fd042a00040) at /usr/local/src/php-8.0.20/Zend/zend_vm_execute.h:55256 #13 0x00007fd03e49b7b2 in nr_zend_call_orig_execute_special () at /home/hudson/workspace/php-release-agent/label/centos5-64-nrcamp/agent/php_user_instrument.c:70 #14 0x00007fd03e4802c6 in nr_php_execute_enabled () at /home/hudson/workspace/php-release-agent/label/centos5-64-nrcamp/agent/php_execute.c:1197 #15 0x00007fd03e4809f2 in nr_php_execute () at /home/hudson/workspace/php-release-agent/label/centos5-64-nrcamp/agent/php_execute.c:1340 #16 0x000000000046503e in ZEND_DO_FCALL_SPEC_OBSERVER_HANDLER () at /usr/local/src/php-8.0.20/Zend/zend_vm_execute.h:1938 #17 0x000000000089bd68 in execute_ex (ex=0x7fd042a00040) at /usr/local/src/php-8.0.20/Zend/zend_vm_execute.h:55256 #18 0x00007fd03e49b7b2 in nr_zend_call_orig_execute_special () at /home/hudson/workspace/php-release-agent/label/centos5-64-nrcamp/agent/php_user_instrument.c:70 #19 0x00007fd03e4802c6 in nr_php_execute_enabled () at /home/hudson/workspace/php-release-agent/label/centos5-64-nrcamp/agent/php_execute.c:1197 ``` ### PHP Version PHP 8.0.20 ### Operating System Ubuntu 16.04