[php-src] Issue #11899: ASAN stack-buffer-underflow during opcache compilation

From: Date: Mon, 07 Aug 2023 14:34:42 +0000
Subject: [php-src] Issue #11899: ASAN stack-buffer-underflow during opcache compilation
Groups: php.bugs 
Request: Send a blank email to php-bugs+get-245116@lists.php.net to get a copy of this message
Issue: https://github.com/php/php-src/issues/11899 Author: danog ### Description ``` ================================================================= ==3090547==ERROR: AddressSanitizer: stack-buffer-underflow on address 0x7faf09bfdba8 at pc 0x000000e23a2a bp 0x7ffc938631e0 sp 0x7ffc938631d8 WRITE of size 4 at 0x7faf09bfdba8 thread T0 #0 0xe23a29 in init_op cli-build/./Zend/zend_compile.c:103:2 #1 0xe233d2 in get_next_op cli-build/./Zend/zend_compile.c:126:2 #2 0xe2f8af in zend_emit_op_tmp cli-build/./Zend/zend_compile.c:2069:20 #3 0xe6d5fb in zend_compile_conditional cli-build/./Zend/zend_compile.c:9047:2 #4 0xe65b8e in zend_compile_expr_inner cli-build/./Zend/zend_compile.c:10277:4 #5 0xe46604 in zend_compile_expr cli-build/./Zend/zend_compile.c:10350:2 #6 0xe6666e in zend_compile_assign cli-build/./Zend/zend_compile.c:3220:4 #7 0xe65aa4 in zend_compile_expr_inner cli-build/./Zend/zend_compile.c:10233:4 #8 0xe46604 in zend_compile_expr cli-build/./Zend/zend_compile.c:10350:2 #9 0xe22a42 in zend_compile_stmt cli-build/./Zend/zend_compile.c:10192:4 #10 0xe39e96 in zend_compile_stmt_list cli-build/./Zend/zend_compile.c:6176:3 #11 0xe2288a in zend_compile_stmt cli-build/./Zend/zend_compile.c:10100:4 #12 0xe1fe3e in zend_compile_func_decl cli-build/./Zend/zend_compile.c:7428:2 #13 0xe2297e in zend_compile_stmt cli-build/./Zend/zend_compile.c:10153:4 #14 0xe39e96 in zend_compile_stmt_list cli-build/./Zend/zend_compile.c:6176:3 #15 0xe2288a in zend_compile_stmt cli-build/./Zend/zend_compile.c:10100:4 #16 0xe2118c in zend_compile_class_decl cli-build/./Zend/zend_compile.c:7909:2 #17 0xe1eb12 in zend_compile_top_stmt cli-build/./Zend/zend_compile.c:10075:3 #18 0xe1e901 in zend_compile_top_stmt cli-build/./Zend/zend_compile.c:10064:4 #19 0xda9820 in zend_compile cli-build/./Zend/zend_language_scanner.c:620:3 #20 0xda9207 in compile_file cli-build/./Zend/zend_language_scanner.c:655:14 #21 0x7faf14d4f425 in phar_compile_file ext-build/./ext/phar/phar.c:3355:9 #22 0xdaaf15 in compile_filename cli-build/./Zend/zend_language_scanner.c:706:11 #23 0x1210c22 in zend_include_or_eval cli-build/./Zend/zend_execute.c:4799:19 #24 0x10c38da in ZEND_INCLUDE_OR_EVAL_SPEC_CV_HANDLER cli-build/./Zend/zend_vm_execute.h:38960:17 #25 0xfac9f5 in execute_ex cli-build/./Zend/zend_vm_execute.h:55835:7 #26 0xe91ef3 in zend_call_function cli-build/./Zend/zend_execute_API.c:947:3 #27 0xe94346 in zend_call_known_function cli-build/./Zend/zend_execute_API.c:1041:23 #28 0x8f254b in spl_perform_autoload cli-build/./ext/spl/php_spl.c:445:3 #29 0xe95f7d in zend_lookup_class_ex cli-build/./Zend/zend_execute_API.c:1207:7 #30 0xe98522 in zend_fetch_class_by_name cli-build/./Zend/zend_execute_API.c:1703:25 #31 0x11a9a12 in ZEND_FETCH_CLASS_CONSTANT_SPEC_CONST_CONST_HANDLER cli-build/./Zend/zend_vm_execute.h:7147:10 #32 0xfac9f5 in execute_ex cli-build/./Zend/zend_vm_execute.h:55835:7 #33 0xfad2df in zend_execute cli-build/./Zend/zend_vm_execute.h:60408:2 #34 0xeed882 in zend_execute_scripts cli-build/./Zend/zend.c:1827:4 #35 0xcdbb3f in php_execute_script cli-build/./main/main.c:2542:13 #36 0x14e5db1 in do_cli cli-build/./sapi/cli/php_cli.c:964:5 #37 0x14e3726 in main cli-build/./sapi/cli/php_cli.c:1333:18 #38 0x7faf1c5f7082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16 #39 0x44761d in _start (/usr/bin/php+0x44761d) Address 0x7faf09bfdba8 is a wild pointer. SUMMARY: AddressSanitizer: stack-buffer-underflow cli-build/./Zend/zend_compile.c:103:2 in init_op Shadow bytes around the buggy address: 0x0ff661377b20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0ff661377b30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0ff661377b40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0ff661377b50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0ff661377b60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x0ff661377b70: 00 00 00 00 f1[f1]f1 f1 00 00 00 00 00 00 00 00 0x0ff661377b80: f2 f2 f2 f2 00 f2 f2 f2 00 00 f3 f3 00 00 00 00 0x0ff661377b90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0ff661377ba0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0ff661377bb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0ff661377bc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Shadow gap: cc ==3090547==ABORTING ``` ### PHP Version PHP 8.2.8 ### Operating System Ubuntu 20.04

« previous php.bugs (#245116) next »