[php-src] Issue #9259: Setting opcache.interned_strings_buffer to a very high value leads to corruption of shm

From: Date: Fri, 05 Aug 2022 18:36:52 +0000
Subject: [php-src] Issue #9259: Setting opcache.interned_strings_buffer to a very high value leads to corruption of shm
Groups: php.bugs 
Request: Send a blank email to php-bugs+get-242134@lists.php.net to get a copy of this message
Issue: https://github.com/php/php-src/issues/9259
Author: arnaud-lb

### Description

The following code:

```php
<?php

class C {}

new C;
```

```
sapi/cli/php -d zend_extension=$(pwd)/modules/opcache.so -d opcache.enable_cli=1 -d
opcache.interned_strings_buffer=131072 test.php
```

Resulted in this output:
```
Floating point exception
```

But I expected this output instead:
```
```

opcache.interned_strings_buffer takes a number of megabytes, but it's easy to be
mistaken and to accidentally set it to an unexpectedly high value, like 16m.

This leads to integer overflows in the shared mm allocator, and then to memory corruptions. In this
case ZCSG(hash)->max_num_entries is set to zero, which causes an floating point
exception here:

```
Program received signal SIGFPE, Arithmetic exception.
0x00007ffff78aaede in zend_accel_hash_find_ex (accel_hash=0x5555564000b0, key=0x7ffff79f6078
<accel_globals+408>, data=1) at ext/opcache/zend_accelerator_hash.c:151
151		index = hash_value % accel_hash->max_num_entries;
(gdb) list
146	
147		hash_value = zend_string_hash_val(key);
148	#ifndef ZEND_WIN32
149		hash_value ^= ZCG(root_hash);
150	#endif
151		index = hash_value % accel_hash->max_num_entries;
152	
153		entry = accel_hash->hash_table[index];
154		while (entry) {
155			if (entry->hash_value == hash_value
```

### PHP Version

master

### Operating System

_No response_


Thread (1 message)

  • arnaud-lb
« previous php.bugs (#242134) next »