[php-src] Issue #12351: segfault in `zend_mm_alloc_small` triggered by call to `unserialize`

Issue: https://github.com/php/php-src/issues/12351 Author: gnif ### Description This is a large WordPress website running some commonly available community plugins. The site was working fine on PHP 7.4 but since upgrading to 8.2.6 and then subsequent 8.2.10 to see if the issue was resolved we are seeing segfaults on multiple servers in the cluster servicing this website. Every single fault is during a call to unserialize, here is the zbacktrace: ``` [0x7fb2ac2138e0] unserialize("a:5:{s:3:"AUD";a:8:{s:4:"name";s:3:"AUD";s:4:"rate";d:1;s:6:"symbol";s:3:"AU$";s:8:"position";s:4:"left";s: 9:"is_etalon";i:1;s:10:"hide_cents";i:0;s:11:"description";s:17:"Australian Dollar";s:4:"flag";s:88:"https://www.xxxxxxx.com/wp-content/p lugins/wooco...") [internal function] [0x7fb2ac213860] maybe_unserialize("a:5:{s:3:"AUD";a:8:{s:4:"name";s:3:"AUD";s:4:"rate";d:1;s:6:"symbol";s:3:"AU$";s:8:"position";s:4:"le ft";s:9:"is_etalon";i:1;s:10:"hide_cents";i:0;s:11:"description";s:17:"Australian Dollar";s:4:"flag";s:88:"https://www.xxxxxxx.com/wp-con tent/plugins/wooco...") /home/xxxxxxx/public_html/wp-includes/functions.php:650 [0x7fb2ac213650] get_option("woocs", array(2)[0x7fb2ac2136b0]) /home/xxxxxxx/public_html/wp-includes/option.php:253 [0x7fb2ac2135d0] WOOCS->get_currencies() /home/xxxxxxx/public_html/wp-content/plugins/woocommerce-currency-switcher/index.php:972 [0x7fb2ac213530] WOOCS->init_no_cents() /home/xxxxxxx/public_html/wp-content/plugins/woocommerce-currency-switcher/index.php:497 [0x7fb2ac213470] WOOCS->__construct() /home/xxxxxxx/public_html/wp-content/plugins/woocommerce-currency-switcher/index.php:82 [0x7fb2ac2133e0] (main) /home/xxxxxxx/public_html/wp-content/plugins/woocommerce-currency-switcher/index.php:2213 [0x7fb2ac213220] (main) /home/xxxxxxx/public_html/wp-settings.php:462 [0x7fb2ac2131a0] (main) /home/xxxxxxx/public_html/wp-config.php:72 [0x7fb2ac213100] (main) /home/xxxxxxx/public_html/wp-load.php:50 [0x7fb2ac213070] (main) /home/xxxxxxx/public_html/wp-blog-header.php:13 [0x7fb2ac213020] (main) /home/xxxxxxx/public_html/index.php:17 ``` And the PHP backtrace ``` #0 zend_mm_alloc_small (bin_num=11, heap=0x7fb2ac200040) at ./Zend/zend_alloc.c:1313 #1 zend_mm_alloc_heap (size=<optimized out>, heap=0x7fb2ac200040) at ./Zend/zend_alloc.c:1384 #2 _emalloc (size=<optimized out>) at ./Zend/zend_alloc.c:2601 #3 0x0000556923c3962a in zend_string_alloc (persistent=false, len=88) at ./Zend/zend_string.h:152 #4 zend_string_init (persistent=false, len=88, str=0x7fb2a6e89a92 "https://www.xxxxxxx.com/wp-content/plugins/woocommerce-currency-switcher/img/no_flag.png\";}s:3:\"NZD\";a:8:{s:4:\"name\";s:3:\"NZD\";s:4:\"rate\";d:1.07660000000000000142108547152020037174224853515625;s:6:\"symbol\";s:3:\"NZ$\";s:8:\"position\";s:4:\"left\";s:9:\"is_etalon\";i:0;s:10:\"hide_cents\";i:0;s:11:\"description\";s:18:\"New Zealand Dollar\";s:4:\"flag\";s:88:\"https://www.xxxxxxx.com/wp-content/plugins/woocommerce-currency-switcher/img/no_flag.png\";}s:3:\"GBP\";a:8:{s:4:\"name\";s:3:\"GBP\";s:4:\"rate\";d:0.502499999999999946709294817992486059665679931640625;s:6:\"symbol\";s:7:\"&pound;\";s:8:\"position\";s:4:\"left\";s:9:\"is_etalon\";i:0;s:10:\"hide_cents\";i:0;s:11:\"description\";s:13:\"British Pound\";s:4:\"flag\";s:88:\"https://www.xxxxxxx.com/wp-content/plugins/woocommerce-currency-switcher/img/no_flag.png\";}}") at ./Zend/zend_string.h:174 #5 zend_string_init_fast (len=88, str=0x7fb2a6e89a92 "https://www.xxxxxxx.com/wp-content/plugins/woocommerce-currency-switcher/img/no_flag.png\";}s:3:\"NZD\";a:8:{s:4:\"name\";s:3:\"NZD\";s:4:\"rate\";d:1.07660000000000000142108547152020037174224853515625;s:6:\"symbol\";s:3:\"NZ$\";s:8:\"position\";s:4:\"left\";s:9:\"is_etalon\";i:0;s:10:\"hide_cents\";i:0;s:11:\"description\";s:18:\"New Zealand Dollar\";s:4:\"flag\";s:88:\"https://www.xxxxxxx.com/wp-content/plugins/woocommerce-currency-switcher/img/no_flag.png\";}s:3:\"GBP\";a:8:{s:4:\"name\";s:3:\"GBP\";s:4:\"rate\";d:0.502499999999999946709294817992486059665679931640625;s:6:\"symbol\";s:7:\"&pound;\";s:8:\"position\";s:4:\"left\";s:9:\"is_etalon\";i:0;s:10:\"hide_cents\";i:0;s:11:\"description\";s:13:\"British Pound\";s:4:\"flag\";s:88:\"https://www.xxxxxxx.com/wp-content/plugins/woocommerce-currency-switcher/img/no_flag.png\";}}") at ./Zend/zend_string.h:184 #6 php_var_unserialize_internal (rval=0x7fb2a6e45fa0, p=0x7fff469fb468, max=<optimized out>, var_hash=0x7fff469fb470) at ./ext/standard/var_unserializer.c:1798 #7 0x0000556923c39110 in process_nested_array_data (elements=0, ht=0x7fb2a6f0bb28, var_hash=0x7fff469fb470, max=0x7fb2a6e89da2 "", p=0x7fff469fb468, rval=0x7fff469fb2a0) at ./ext/standard/var_unserializer.c:511 #8 php_var_unserialize_internal (rval=0x7fff469fb2a0, p=0x7fff469fb468, max=0x7fb2a6e89da2 "", var_hash=0x7fff469fb470) at ./ext/standard/var_unserializer.c:1742 #9 0x0000556923c39110 in process_nested_array_data (elements=2, ht=0x7fb2a6f0ba80, var_hash=0x7fff469fb470, max=0x7fb2a6e89da2 "", p=0x7fff469fb468, rval=0x7fff469fb390) at ./ext/standard/var_unserializer.c:511 #10 php_var_unserialize_internal (rval=0x7fff469fb390, p=0x7fff469fb468, max=0x7fb2a6e89da2 "", var_hash=0x7fff469fb470) at ./ext/standard/var_unserializer.c:1742 #11 0x0000556923c3ac47 in php_var_unserialize (rval=<optimized out>, p=<optimized out>, max=<optimized out>, var_hash=<optimized out>) at ./ext/standard/var_unserializer.c:853 #12 0x0000556923c29fb4 in php_unserialize_with_options (function_name=0x556923db086e "unserialize", options=<optimized out>, buf_len=1674, buf=0x7fb2a6e89718 "a:5:{s:3:\"AUD\";a:8:{s:4:\"name\";s:3:\"AUD\";s:4:\"rate\";d:1;s:6:\"symbol\";s:3:\"AU$\";s:8:\"position\";s:4:\"left\";s:9:\"is_etalon\";i:1;s:10:\"hide_cents\";i:0;s:11:\"description\";s:17:\"Australian Dollar\";s:4:\"flag\";s:88:\"https://www.xxxxxxx.com/wp-content/plugins/woocommerce-currency-switcher/img/no_flag.png\";}s:3:\"USD\";a:8:{s:4:\"name\";s:3:\"USD\";s:4:\"rate\";d:0.71679999999999999271693695845897309482097625732421875;s:6:\"symbol\";s:3:\"US$\";s:8:\"position\";s:4:\"left\";s:9:\"is_etalon\";i:0;s:10:\"hide_cents\";i:0;s:11:\"description\";s:9:\"US Dollar\";s:4:\"flag\";s:88:\"https://www.xxxxxxx.com/wp-content/plugins/woocommerce-currency-switcher/img/no_flag.png\";}s:3:\"EUR\";a:8:{s:4:\"name\";s:3:\"EUR\";s:4:\"rate\";d:0.6449000000000000287769807982840575277805328369140625;s:6:\"symbol\";s:6:\"&euro;\";s:8:\"position\";s:10:\"left_space\";s:9:\"is_etalon\";i:0;s:10:\"hide_cents\";i:0;s:11:\"description\";s:4:\"Euro\";s:4:\"flag\";s:88:\"https://www.xxxxxxx.com/wp-content/plugins/woocommerce-currency-switcher/img/no_flag.png\";}s:3:\"NZD\";a:8:{s:4:\"name\";s:3:\"NZD\";s:4:\"rate\";d:1.07660000000000000142108547152020037174224853515625;s:6:\"symbol\";s:3:\"NZ$\";s:8:\"position\";s:4:\"left\";s:9:\"is_etalon\";i:0;s:10:\"hide_cents\";i:0;s:11:\"description\";s:18:\"New Zealand Dollar\";s:4:\"flag\";s:88:\"https://www.xxxxxxx.com/wp-content/plugins/woocommerce-currency-switcher/img/no_flag.png\";}s:3:\"GBP\";a:8:{s:4:\"name\";s:3:\"GBP\";s:4:\"rate\";d:0.502499999999999946709294817992486059665679931640625;s:6:\"symbol\";s:7:\"&pound;\";s:8:\"position\";s:4:\"left\";s:9:\"is_etalon\";i:0;s:10:\"hide_cents\";i:0;s:11:\"description\";s:13:\"British Pound\";s:4:\"flag\";s:88:\"https://www.xxxxxxx.com/wp-content/plugins/woocommerce-currency-switcher/img/no_flag.png\";}}", return_value=0x7fb2ac2138c0) at ./ext/standard/var.c:1406 #13 php_unserialize_with_options (return_value=0x7fb2ac2138c0, buf=0x7fb2a6e89718 "a:5:{s:3:\"AUD\";a:8:{s:4:\"name\";s:3:\"AUD\";s:4:\"rate\";d:1;s:6:\"symbol\";s:3:\"AU$\";s:8:\"position\";s:4:\"left\";s:9:\"is_etalon\";i:1;s:10:\"hide_cents\";i:0;s:11:\"description\";s:17:\"Australian Dollar\";s:4:\"flag\";s:88:\"https://www.xxxxxxx.com/wp-content/plugins/woocommerce-currency-switcher/img/no_flag.png\";}s:3:\"USD\";a:8:{s:4:\"name\";s:3:\"USD\";s:4:\"rate\";d:0.71679999999999999271693695845897309482097625732421875;s:6:\"symbol\";s:3:\"US$\";s:8:\"position\";s:4:\"left\";s:9:\"is_etalon\";i:0;s:10:\"hide_cents\";i:0;s:11:\"description\";s:9:\"US Dollar\";s:4:\"flag\";s:88:\"https://www.xxxxxxx.com/wp-content/plugins/woocommerce-currency-switcher/img/no_flag.png\";}s:3:\"EUR\";a:8:{s:4:\"name\";s:3:\"EUR\";s:4:\"rate\";d:0.6449000000000000287769807982840575277805328369140625;s:6:\"symbol\";s:6:\"&euro;\";s:8:\"position\";s:10:\"left_space\";s:9:\"is_etalon\";i:0;s:10:\"hide_cents\";i:0;s:11:\"description\";s:4:\"Euro\";s:4:\"flag\";s:88:\"https://www.xxxxxxx.com/wp-content/plugins/woocommerce-currency-switcher/img/no_flag.png\";}s:3:\"NZD\";a:8:{s:4:\"name\";s:3:\"NZD\";s:4:\"rate\";d:1.07660000000000000142108547152020037174224853515625;s:6:\"symbol\";s:3:\"NZ$\";s:8:\"position\";s:4:\"left\";s:9:\"is_etalon\";i:0;s:10:\"hide_cents\";i:0;s:11:\"description\";s:18:\"New Zealand Dollar\";s:4:\"flag\";s:88:\"https://www.xxxxxxx.com/wp-content/plugins/woocommerce-currency-switcher/img/no_flag.png\";}s:3:\"GBP\";a:8:{s:4:\"name\";s:3:\"GBP\";s:4:\"rate\";d:0.502499999999999946709294817992486059665679931640625;s:6:\"symbol\";s:7:\"&pound;\";s:8:\"position\";s:4:\"left\";s:9:\"is_etalon\";i:0;s:10:\"hide_cents\";i:0;s:11:\"description\";s:13:\"British Pound\";s:4:\"flag\";s:88:\"https://www.xxxxxxx.com/wp-content/plugins/woocommerce-currency-switcher/img/no_flag.png\";}}", buf_len=1674, options=<optimized out>, function_name=0x556923db086e "unserialize") at ./ext/standard/var.c:1334 #14 0x0000556930e24644 in ?? () #15 0x0000000000000001 in ?? () #16 0x0000000000000003 in ?? () #17 0x00000004ac200040 in ?? () #18 0x00007fff469fb4f0 in ?? () #19 0x0000000000000001 in ?? () #20 0x0000000000000001 in ?? () #21 0x00007fb2a6e45480 in ?? () #22 0x0000556900000003 in ?? () #23 0x0000000000000002 in ?? () #24 0x0000000000000001 in ?? () #25 0x0000556925ed44c0 in ?? () #26 0x0000000000000001 in ?? () #27 0x0000556925ed44c0 in ?? () #28 0x3743e960f3c58a00 in ?? () #29 0x00007fff469fb870 in ?? () #30 0x00007fb2ac277000 in ?? () #31 0x00007fb2ac213020 in ?? () #32 0x0000556923f3f500 in ?? () #33 0x0000000000000000 in ?? () ``` And the PHP modules loaded ``` [PHP Modules] calendar cgi-fcgi Core ctype curl date dom exif FFI fileinfo filter ftp gd gettext gmp hash iconv igbinary json libxml mbstring memcache memcached msgpack mysqli mysqlnd openssl pcre PDO pdo_mysql pdo_sqlite Phar posix random readline Reflection session shmop SimpleXML sockets sodium SPL sqlite3 standard sysvmsg sysvsem sysvshm tidy tokenizer xml xmlreader xmlrpc xmlwriter xsl Zend OPcache zip zlib [Zend Modules] Zend OPcache ``` Setting USE_ZEND_ALLOC=0 does not change this behaviour at all. ### PHP Version 8.2.10 ### Operating System Debian 11.7