Segfault on PHP 8.3 #11406

Activity

1. nicolas-grekas

   added

   Bug

   Status: Needs Triage

   on Jun 8, 2023
2. ramsey commented on Jun 9, 2023

   

   ramsey

   on Jun 9, 2023

   Member

   More actions

   Can you isolate the test where this is occurring?
3. ndossche commented on Jun 9, 2023

   

   ndossche

   on Jun 9, 2023

   Last edited by ndossche

   Member

   More actions

   Test that fails is EventAliasTest: ./phpunit src/Symfony/Bundle/SecurityBundle/Tests/Functional/EventAliasTest.php --testdox
   Fails at the first $dispatcher->dispatch call.
   ASAN report:

   ==330732==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000010 (pc 0x558a00b040f5 bp 0x7ffcadb71c20 sp 0x7ffcadb71c10 T0)
   ==330732==The signal is caused by a READ memory access.
   ==330732==Hint: address points to the zero page.
       #0 0x558a00b040f5 in zend_check_arg_send_type /home/niels/php-src/Zend/zend_compile.h:1061
       #1 0x558a00b37ce8 in ZEND_SEND_UNPACK_SPEC_HANDLER /home/niels/php-src/Zend/zend_vm_execute.h:2285
       #2 0x558a00c88280 in execute_ex /home/niels/php-src/Zend/zend_vm_execute.h:57113
       #3 0x558a00c9a071 in zend_execute /home/niels/php-src/Zend/zend_vm_execute.h:61445
       #4 0x558a00a8e66f in zend_execute_scripts /home/niels/php-src/Zend/zend.c:1859
       #5 0x558a0091145f in php_execute_script /home/niels/php-src/main/main.c:2482
       #6 0x558a00e6f03a in do_cli /home/niels/php-src/sapi/cli/php_cli.c:959
       #7 0x558a00e70d78 in main /home/niels/php-src/sapi/cli/php_cli.c:1328
       #8 0x7f6d55d5484f  (/usr/lib/libc.so.6+0x2384f) (BuildId: 2f005a79cd1a8e385972f5a102f16adba414d75e)
       #9 0x7f6d55d54909 in __libc_start_main (/usr/lib/libc.so.6+0x23909) (BuildId: 2f005a79cd1a8e385972f5a102f16adba414d75e)
       #10 0x558a00005784 in _start (/usr/local/bin/php+0x605784) (BuildId: 2d2cfd4f28feb94b5331e070c74c424d89c4b84a)
   
   

   zf->common.arg_info is NULL, so the access with arg_num derefs a NULL pointer.
   Regressed in 61e1f8a which indeed changed the variadic flag, causing the faulting path to be executed. There used to be a NULL check for arg_info but it was removed a long time ago in fd4844e
   Will look tonight.
4. ndossche

   added

   Status: Verified

   Category: Engine

   and removed

   Status: Needs Triage

   on Jun 9, 2023
5. Girgias

   assigned

   ndossche

   on Jun 9, 2023
6. ndossche

   added a commit that references this issue on Jun 9, 2023

   Fix phpGH-11406: segfault with unpacking and magic method closure

   ...

   This issue will close once commit d7fca5d is merged into the 'master' branch.

   d7fca5d
7. ndossche

   linked a pull request that will close this issueFix GH-11406: segfault with unpacking and magic method closure #11417on Jun 9, 2023
8. ndossche

   closed this as completedin 5c78980on Jun 13, 2023
9. nicolas-grekas commented on Jun 13, 2023

   

   nicolas-grekas

   on Jun 13, 2023

   ContributorAuthor

   More actions

   Thanks for fixing this @nielsdos!
   I was that this was merged on master, so the issue doesn't exist on previous versions right?
10. ndossche commented on Jun 13, 2023

    

    ndossche

    on Jun 13, 2023

    Last edited by ndossche

    Member

    More actions

    @nicolas-grekas Indeed, this bug only existed on master.
11. bwoebi

    added a commit that references this issue on Jan 31, 2024

    Fix phpGH-11406: segfault with unpacking and magic method closure

    ...

    This issue will close once commit 5c78980 is merged into the 'master' branch.

    5c78980