[php-src] Issue #11899: ASAN stack-buffer-underflow during opcache compilation
| From: | danog | Date: | Mon, 07 Aug 2023 14:34:42 +0000 |
| Subject: | [php-src] Issue #11899: ASAN stack-buffer-underflow during opcache compilation | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-245116@lists.php.net to get a copy of this message | ||
Issue: https://github.com/php/php-src/issues/11899
Author: danog
### Description
```
=================================================================
==3090547==ERROR: AddressSanitizer: stack-buffer-underflow on address 0x7faf09bfdba8 at pc
0x000000e23a2a bp 0x7ffc938631e0 sp 0x7ffc938631d8
WRITE of size 4 at 0x7faf09bfdba8 thread T0
#0 0xe23a29 in init_op cli-build/./Zend/zend_compile.c:103:2
#1 0xe233d2 in get_next_op cli-build/./Zend/zend_compile.c:126:2
#2 0xe2f8af in zend_emit_op_tmp cli-build/./Zend/zend_compile.c:2069:20
#3 0xe6d5fb in zend_compile_conditional cli-build/./Zend/zend_compile.c:9047:2
#4 0xe65b8e in zend_compile_expr_inner cli-build/./Zend/zend_compile.c:10277:4
#5 0xe46604 in zend_compile_expr cli-build/./Zend/zend_compile.c:10350:2
#6 0xe6666e in zend_compile_assign cli-build/./Zend/zend_compile.c:3220:4
#7 0xe65aa4 in zend_compile_expr_inner cli-build/./Zend/zend_compile.c:10233:4
#8 0xe46604 in zend_compile_expr cli-build/./Zend/zend_compile.c:10350:2
#9 0xe22a42 in zend_compile_stmt cli-build/./Zend/zend_compile.c:10192:4
#10 0xe39e96 in zend_compile_stmt_list cli-build/./Zend/zend_compile.c:6176:3
#11 0xe2288a in zend_compile_stmt cli-build/./Zend/zend_compile.c:10100:4
#12 0xe1fe3e in zend_compile_func_decl cli-build/./Zend/zend_compile.c:7428:2
#13 0xe2297e in zend_compile_stmt cli-build/./Zend/zend_compile.c:10153:4
#14 0xe39e96 in zend_compile_stmt_list cli-build/./Zend/zend_compile.c:6176:3
#15 0xe2288a in zend_compile_stmt cli-build/./Zend/zend_compile.c:10100:4
#16 0xe2118c in zend_compile_class_decl cli-build/./Zend/zend_compile.c:7909:2
#17 0xe1eb12 in zend_compile_top_stmt cli-build/./Zend/zend_compile.c:10075:3
#18 0xe1e901 in zend_compile_top_stmt cli-build/./Zend/zend_compile.c:10064:4
#19 0xda9820 in zend_compile cli-build/./Zend/zend_language_scanner.c:620:3
#20 0xda9207 in compile_file cli-build/./Zend/zend_language_scanner.c:655:14
#21 0x7faf14d4f425 in phar_compile_file ext-build/./ext/phar/phar.c:3355:9
#22 0xdaaf15 in compile_filename cli-build/./Zend/zend_language_scanner.c:706:11
#23 0x1210c22 in zend_include_or_eval cli-build/./Zend/zend_execute.c:4799:19
#24 0x10c38da in ZEND_INCLUDE_OR_EVAL_SPEC_CV_HANDLER
cli-build/./Zend/zend_vm_execute.h:38960:17
#25 0xfac9f5 in execute_ex cli-build/./Zend/zend_vm_execute.h:55835:7
#26 0xe91ef3 in zend_call_function cli-build/./Zend/zend_execute_API.c:947:3
#27 0xe94346 in zend_call_known_function cli-build/./Zend/zend_execute_API.c:1041:23
#28 0x8f254b in spl_perform_autoload cli-build/./ext/spl/php_spl.c:445:3
#29 0xe95f7d in zend_lookup_class_ex cli-build/./Zend/zend_execute_API.c:1207:7
#30 0xe98522 in zend_fetch_class_by_name cli-build/./Zend/zend_execute_API.c:1703:25
#31 0x11a9a12 in ZEND_FETCH_CLASS_CONSTANT_SPEC_CONST_CONST_HANDLER
cli-build/./Zend/zend_vm_execute.h:7147:10
#32 0xfac9f5 in execute_ex cli-build/./Zend/zend_vm_execute.h:55835:7
#33 0xfad2df in zend_execute cli-build/./Zend/zend_vm_execute.h:60408:2
#34 0xeed882 in zend_execute_scripts cli-build/./Zend/zend.c:1827:4
#35 0xcdbb3f in php_execute_script cli-build/./main/main.c:2542:13
#36 0x14e5db1 in do_cli cli-build/./sapi/cli/php_cli.c:964:5
#37 0x14e3726 in main cli-build/./sapi/cli/php_cli.c:1333:18
#38 0x7faf1c5f7082 in __libc_start_main
/build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16
#39 0x44761d in _start (/usr/bin/php+0x44761d)
Address 0x7faf09bfdba8 is a wild pointer.
SUMMARY: AddressSanitizer: stack-buffer-underflow cli-build/./Zend/zend_compile.c:103:2 in init_op
Shadow bytes around the buggy address:
0x0ff661377b20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0ff661377b30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0ff661377b40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0ff661377b50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0ff661377b60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0ff661377b70: 00 00 00 00 f1[f1]f1 f1 00 00 00 00 00 00 00 00
0x0ff661377b80: f2 f2 f2 f2 00 f2 f2 f2 00 00 f3 f3 00 00 00 00
0x0ff661377b90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0ff661377ba0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0ff661377bb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0ff661377bc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==3090547==ABORTING
```
### PHP Version
PHP 8.2.8
### Operating System
Ubuntu 20.04