[php-src] Issue #9990: zend_execute calls strncpy and overwrites stack

Issue: https://github.com/php/php-src/issues/9990 Author: Grover-D ### Description I am using phpbb 3.3.8. I have: mariadb 10.4.26-1 php-fpm 7.4.30-1 apache 2.4.54 This is a completely new installation. I was able to connect to install the system. I can work on the ACP without any issues. I have put in my forum structure without any issues. Then I went to register a user and agree to the conditions. I filled out the page with my ID,etc and get: ` Service Unavailable The server is temporarily unable to service your request due to maintenance downtime or capacity problems. Please try again later. ` This would imply something bad happened talking to the php-fpm system. Looking at the logs there, I see: 1 `[18-Nov-2022 15:42:30.741346] DEBUG: pid 9175350, fpm_pctl_perform_idle_server_maintenance(), line 382: [pool www] currently 0 active children, 16 spare children, 16 running children. Spawning rate 1 [18-Nov-2022 15:42:31.429597] DEBUG: pid 9175350, fpm_event_loop(), line 430: event module triggered 2 events [18-Nov-2022 15:42:31.429702] DEBUG: pid 9175350, fpm_event_loop(), line 430: event module triggered 1 events [18-Nov-2022 15:42:31.440999] DEBUG: pid 9175350, fpm_got_signal(), line 82: received SIGCHLD [18-Nov-2022 15:42:31.441022] DEBUG: pid 9175350, fpm_event_loop(), line 430: event module triggered 1 events [18-Nov-2022 15:42:31.441110] WARNING: pid 9175350, fpm_children_bury(), line 259: [pool www] child 11207038 exited on signal 4 (SIGILL) after 256870.558712 seconds from start [18-Nov-2022 15:42:31.441184] DEBUG: pid 9175350, fpm_children_make(), line 407: blocking signals before child birth [18-Nov-2022 15:42:31.449567] DEBUG: pid 9175350, fpm_children_make(), line 431: unblocking signals, child born [18-Nov-2022 15:42:31.449689] NOTICE: pid 9175350, fpm_children_make(), line 437: [pool www] child 11207040 started [18-Nov-2022 15:42:31.741848] DEBUG: pid 9175350, fpm_pctl_perform_idle_server_maintenance(), line 382: [pool www] currently 0 active children, 16 spare children, 16 running children. Spawning rate 1 [18-Nov-2022 15:42:32.741994] DEBUG: pid 9175350, fpm_pctl_perform_idle_server_maintenance(), line 382: [pool www] currently 0 active children, 16 spare children, 16 running children. Spawning rate` In the apache log I see: ` [Fri Nov 18 15:42:31.429807 2022] [proxy_fcgi:error] [pid 12648840:tid 12851] [client 9.211.126.63:54367] AH01067: Failed to read FastCGI header, referer: https://birch4.xxx.xxxxxx.xxx.com/PlayScreen/ucp.php?mode=register&sid=70daf83648343a147a3d8db77b71abb0 [Fri Nov 18 15:42:31.429855 2022] [proxy_fcgi:error] [pid 12648840:tid 12851] (70014)End of file found: [client 9.211.126.63:54367] AH01075: Error dispatching request to : , referer: https://birch4.xxx.xxxxxx.xxx.com/PlayScreen/ucp.php?mode=register&sid=70daf83648343a147a3d8db77b71abb0 ` Resulted in this output: ``` The system cannot register a user. ``` But I expected this output instead: ``` Registration completed. Looking at the system with the kernel debugger, we can see that the stack is corrupted. Further testing shows that the stack is corrupted at: pvthread+092C00 STACK: [9000000000E65F4]strncpy+0000F4 () [90000000014E960]__res_vinit+0008A0 (??, ??) [1003C4F10]00000001003C4F10 () [100099FA0]execute_ex+005300 (??) [1000A2430]zend_execute+000170 (??, ??) [1000DFF44]zend_execute_scripts+000078 (??, ??, ??) [00000000]00000000 () That's when the strncpy starts overwriting the back frame pointer and the return address. Note that there is also corruption further down in the stack as the bottom of the call stack is not shown. when entering strncpy. ``` ### PHP Version php 7.3.40 ### Operating System AIX 730