[php-src] Issue #9571: preg_match causes Conditional jump or move depends on uninitialised value(s) issue

From: Date: Sun, 18 Sep 2022 11:22:08 +0000
Subject: [php-src] Issue #9571: preg_match causes Conditional jump or move depends on uninitialised value(s) issue
Groups: php.bugs 
Request: Send a blank email to php-bugs+get-242433@lists.php.net to get a copy of this message
Issue: https://github.com/php/php-src/issues/9571 Author: navisoft ### Description The following code: ```c zval matches, matched, _router, function, _3args[3]; ZVAL_STRING(&function, "preg_match"); ZVAL_NULL(&matches); ZVAL_STRING(&_3args[0], "/\\/hello\\//"); ZVAL_STRING(&_3args[1], "foo"); ZVAL_NEW_REF(&_3args[2], &matches); call_user_function(NULL, NULL, &function, &matched, 3, _3args); zval_ptr_dtor(&function); zval_ptr_dtor(&_3args[0]); zval_ptr_dtor(&_3args[1]); zval_ptr_dtor(&_3args[2]); php_var_dump(&matched, 1); zval_ptr_dtor(&matched); zval_ptr_dtor(&matches); ``` valgrind command: ``` ZEND_DONT_UNLOAD_MODULES=1 USE_ZEND_ALLOC=0 valgrind --leak-check=full --show-reachable=no --track-origins=yes --log-file=test/output.txt /root/php-bin/DEBUG/bin/php -S localhost:8000 test/index.php ``` val: ``` ==9882== Conditional jump or move depends on uninitialised value(s) ==9882== at 0x2E4B94: ffcps_0 (pcre2_jit_neon_inc.h:308) ==9882== by 0xF736D0F: ??? ==9882== Uninitialised value was created by a heap allocation ==9882== at 0x484EFC8: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-arm64-linux.so) ==9882== by 0x6E79C7: __zend_malloc (zend_alloc.c:3056) ==9882== by 0x6E649B: _malloc_custom (zend_alloc.c:2418) ==9882== by 0x6E660F: _emalloc (zend_alloc.c:2537) ==9882== by 0x72A8887: zend_string_alloc (zend_string.h:144) ==9882== by 0x72A88F7: zend_string_init (zend_string.h:166) ==9882== by 0x72ABA4F: ___construct (test.c:418) ==9882== by 0x76651B: ZEND_DO_FCALL_SPEC_RETVAL_UNUSED_HANDLER (zend_vm_execute.h:1755) ==9882== by 0x7E8E9F: execute_ex (zend_vm_execute.h:55172) ==9882== by 0x7ED5A7: zend_execute (zend_vm_execute.h:59499) ==9882== by 0x725AAB: zend_execute_scripts (zend.c:1694) ==9882== by 0x83DF3F: php_cli_server_dispatch_router (php_cli_server.c:2168) ``` The issue will not happen if the subject is matched with the pattern: ``` ZVAL_STRING(&_3args[1], "/hello/"); ``` Or some case likes this (even it doesn't match): ``` ZVAL_STRING(&_3args[1], "/hello"); ``` ### PHP Version PHP 8.0.21-dev ### Operating System _No response_

« previous php.bugs (#242433) next »