Repository navigation
bcmul memory leak #17398
Description
Description
The following code:
<?php
$timestamp = mktime(8, 8, 8, 8, 8, 2008);
bcmul($fusion,$fusion,$timestamp);Resulted in this output:
==814951==ERROR: LeakSanitizer: detected memory leaks
Direct leak of 40 byte(s) in 1 object(s) allocated from:
#0 0x6807ed in malloc (/home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php+0x6807ed)
#1 0x3ba8473 in __zend_malloc /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_alloc.c:3280:14
#2 0xe4b4e0 in _bc_new_num_nonzeroed_ex_internal /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/bcmath/libbcmath/src/init.c:50:10
#3 0xe4a3b3 in _bc_new_num_ex /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/bcmath/libbcmath/src/init.c:64:16
#4 0xe4bded in bc_init_numbers /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/bcmath/libbcmath/src/init.c:93:16
#5 0xdfd0eb in zm_globals_ctor_bcmath /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/bcmath/bcmath.c:105:2
#6 0x3505234 in tsrm_update_active_threads /home/phpfuzz/WorkSpace/flowfusion/php-src/TSRM/TSRM.c:265:7
#7 0x35042ba in ts_allocate_id /home/phpfuzz/WorkSpace/flowfusion/php-src/TSRM/TSRM.c:306:2
#8 0x3bfc111 in zend_startup_module_ex /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_API.c:2421:3
#9 0x3c01b5e in zend_startup_module_zval /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_API.c:2445:10
#10 0x4833163 in zend_hash_apply /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_hash.c:2085:13
#11 0x3c00d8b in zend_startup_modules /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_API.c:2568:2
#12 0x3537ba2 in php_module_startup /home/phpfuzz/WorkSpace/flowfusion/php-src/main/main.c:2289:2
#13 0x4d5ae58 in php_cli_startup /home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php_cli.c:397:9
#14 0x4d50c79 in main /home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php_cli.c:1280:6
#15 0x7f54919ced8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
SUMMARY: AddressSanitizer: 40 byte(s) leaked in 1 allocation(s).
PHP Version
nightly
Operating System
No response
Reacted by Saki Takamachi
Activity
YuanchengJiang commentedon Jan 8, 2025
SakiTakamachi commentedon Jan 27, 2025
@YuanchengJiang
Sorry, I haven't been feeling well for a while.
What is the value of
$fusionhere?YuanchengJiang commentedon Jan 27, 2025
@SakiTakamachi it is an undefined variable.
SakiTakamachi commentedon Jan 27, 2025
@YuanchengJiang
Thanks, I understand it.
This doesn't happen with the
Numberclass, only with functions.The memory exhaustion occurs when converting the resulting
bc_numstructure to string, and theNumberclass already has the argumentbc_numstructure free at this point, so it won't leak.On the other hand, in the function,
firstandsecondare released after the line that actually performs string conversion, so a memory leak occurs here.php-src/ext/bcmath/bcmath.c
Line 318 in 60ee42e
edit:
This probably occurs in all previous versions.
ndossche commentedon Jan 27, 2025
@SakiTakamachi I don't think that's right. Those allocations happen through ZendMM and so their leaks are surpressed. OP's report is about the globals, which are allocated through system malloc. Those are refcounted objects, so due to the bailout the refcounts never dropped to 1 once GSHUTDOWN happens, resulting in a persistent memleak.
SakiTakamachi commentedon Jan 27, 2025
The only time it leaks is when using
BCGvalues.I wrote it wrong. The error occurred before the
BCGrefcount was lowered.Merge branch 'PHP-8.3' into PHP-8.4
Merge branch 'PHP-8.4'
Fixed GH-17398: bcmul memory leak (#17615)