[php-src] Issue #11409: Infinite recursion causes heap corruption with JIT enabled
| From: | edsrzf | Date: | Fri, 09 Jun 2023 08:07:47 +0000 |
| Subject: | [php-src] Issue #11409: Infinite recursion causes heap corruption with JIT enabled | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-244635@lists.php.net to get a copy of this message | ||
Issue: https://github.com/php/php-src/issues/11409
Author: edsrzf
### Description
The following code:
```php
<?php
class Base
{
protected $parts = ['a' => [], 'b' => []];
public function __construct() {}
public function build()
{
$this->parts['a'] = ['other'];
foreach ($this->parts as $parts) {
if (!empty($parts)) {
foreach ($parts as $part) {
new stdClass();
}
}
}
}
}
class Child extends Base
{
public function __construct()
{
parent::__construct(null);
}
}
class Service
{
public function run()
{
(new Child())->build();
$this->run();
}
}
(new Service())->run();
```
Resulted in this output:
```
[1] 64927 segmentation fault php -d xdebug.mode=off -d opcache.enable_cli=1 -d
opcache.jit_buffer_size=128
```
(Happens most of the time, but not 100% of the time, so try again if it doesn't happen the
first time.)
While reducing the input, I also sometimes encountered SIGBUS or the message
zend_mm_heap
corrupted with certain variations.
But I expected this output instead:
```
Fatal error: Allowed memory size of 134217728 bytes exhausted (tried to allocate 262144 bytes) in
file.php on line 28
```
The above is the output I get if I disable JIT.
### Other Details
The above output was when running on MacOS with arm64, but I originally encountered this on
Linux/amd64. I've also reproduced the issue with PHP 8.2.1, but haven't tried earlier than
that.
### PHP Version
PHP 8.2.6
### Operating System
MacOS 13