Skip to content

TMPVAR object with hook creating a self-reference leaks #18907

Closed
Closed
TMPVAR object with hook creating a self-reference leaks#18907
Assignees
iluuu1994
Labels
BugCategory: EngineStatus: Verified

Description

@ndossche
ndossche
opened on Jun 22, 2025

Description

The following code:

<?php

class Foo {
    public $prop { get {
        $this->prop = $this;
        return $this;
    }}
}

(new Foo)->prop;

Resulted in this output:

=================================================================
==706473==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 56 byte(s) in 1 object(s) allocated from:
    #0 0x7f3c37120e15 in malloc /usr/src/debug/gcc/gcc/libsanitizer/asan/asan_malloc_linux.cpp:67
    #1 0x556f537019ed in __zend_malloc /run/media/niels/MoreData/php-src/Zend/zend_alloc.c:3518
    #2 0x556f536fd981 in _emalloc /run/media/niels/MoreData/php-src/Zend/zend_alloc.c:2762
    #3 0x556f53aad029 in zend_objects_new /run/media/niels/MoreData/php-src/Zend/zend_objects.c:210
    #4 0x556f537149d4 in _object_and_properties_init /run/media/niels/MoreData/php-src/Zend/zend_API.c:1828
    #5 0x556f53714b86 in object_init_ex /run/media/niels/MoreData/php-src/Zend/zend_API.c:1851
    #6 0x556f5387e5bb in ZEND_NEW_SPEC_CONST_UNUSED_HANDLER /run/media/niels/MoreData/php-src/Zend/zend_vm_execute.h:11042
    #7 0x556f539a00f4 in execute_ex /run/media/niels/MoreData/php-src/Zend/zend_vm_execute.h:60061
    #8 0x556f539afa32 in zend_execute /run/media/niels/MoreData/php-src/Zend/zend_vm_execute.h:64385
    #9 0x556f53b158b9 in zend_execute_script /run/media/niels/MoreData/php-src/Zend/zend.c:1943
    #10 0x556f5354ffb0 in php_execute_script_ex /run/media/niels/MoreData/php-src/main/main.c:2594
    #11 0x556f535503b8 in php_execute_script /run/media/niels/MoreData/php-src/main/main.c:2634
    #12 0x556f53b1b5c8 in do_cli /run/media/niels/MoreData/php-src/sapi/cli/php_cli.c:952
    #13 0x556f53b1dc1a in main /run/media/niels/MoreData/php-src/sapi/cli/php_cli.c:1363
    #14 0x7f3c36b886b4  (/usr/lib/libc.so.6+0x276b4) (BuildId: 468e3585c794491a48ea75fceb9e4d6b1464fc35)
    #15 0x7f3c36b88768 in __libc_start_main (/usr/lib/libc.so.6+0x27768) (BuildId: 468e3585c794491a48ea75fceb9e4d6b1464fc35)
    #16 0x556f52a03fb4 in _start (/run/media/niels/MoreData/php-src/sapi/cli/php+0x603fb4) (BuildId: 2a1a4f16068276f3efa4ba67d81c1a989371a979)

But I expected this output instead:

no leak

PHP Version

8.4+

Operating System

No response

Activity

  1. ndossche
    added
    Bug
    Status: Needs Triage
    Category: Engine
    Status: Verified
    and removed
    Status: Needs Triage
    on Jun 22, 2025
  2. ndossche
    assigned
    iluuu1994
    on Jun 22, 2025

  3. YuanchengJiang commented on Jun 23, 2025

    @YuanchengJiang
    YuanchengJiang
    on Jun 23, 2025

    I have many leaks, any insight to filter interesting ones?

  4. iluuu1994 commented on Jun 23, 2025

    @iluuu1994
    iluuu1994
    on Jun 23, 2025
    Member

    @YuanchengJiang Can you show an example? Most leaks should be legitimate, given that we use the long jump mechanism on fatal error to perform a proper shutdown.

  5. YuanchengJiang commented on Jun 23, 2025

    @YuanchengJiang
    YuanchengJiang
    on Jun 23, 2025

    Sure.

    The following code:

    <?php
function &cb() {
}
$file = __DIR__ . '/gh18439.zip';
$zip = new ZipArchive;
$zip->open($file, ZIPARCHIVE::CREATE);
$zip->registerCancelCallback(cb(...));
$zip->addFromString('test', 'test');
$fusion = $zip;

    Resulted in this output:

    =================================================================
==785487==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 14 byte(s) in 1 object(s) allocated from:
    #0 0x66cd04 in strdup (/home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php+0x66cd04)
    #1 0x58e7089 in do_cli /home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php_cli.c:892:24
    #2 0x58e327f in main /home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php_cli.c:1363:18
    #3 0x752705395d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16

Direct leak of 8 byte(s) in 1 object(s) allocated from:
    #0 0x68106d in malloc (/home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php+0x68106d)
    #1 0x7527055c26f9 in zip_close (/lib/x86_64-linux-gnu/libzip.so.4+0xd6f9)
    #2 0x57670b1 in zend_objects_store_del /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_objects_API.c:196:4
    #3 0x5879597 in rc_dtor_func /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_variables.c:57:2
    #4 0x587981e in i_zval_ptr_dtor /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_variables.h:45:4
    #5 0x58795d4 in zval_ptr_dtor /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_variables.c:84:2
    #6 0x53a4e01 in _zend_hash_del_el_ex /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_hash.c:1486:3
    #7 0x53a257d in _zend_hash_del_el /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_hash.c:1513:2
    #8 0x53b7916 in zend_hash_graceful_reverse_destroy /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_hash.c:2038:4
    #9 0x4aca9d2 in zend_shutdown_executor_values /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_execute_API.c:285:3
    #10 0x4ad70be in shutdown_executor /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_execute_API.c:449:2
    #11 0x58c2b1b in zend_deactivate /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend.c:1350:2
    #12 0x40b4495 in php_request_shutdown /home/phpfuzz/WorkSpace/flowfusion/php-src/main/main.c:1969:2
    #13 0x58ee2a1 in do_cli /home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php_cli.c:1159:3
    #14 0x58e327f in main /home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php_cli.c:1363:18
    #15 0x752705395d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16

Indirect leak of 2048 byte(s) in 1 object(s) allocated from:
    #0 0x6811e2 in calloc (/home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php+0x6811e2)
    #1 0x7527055bc8d0  (/lib/x86_64-linux-gnu/libzip.so.4+0x78d0)

Indirect leak of 512 byte(s) in 1 object(s) allocated from:
    #0 0x681389 in realloc (/home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php+0x681389)
    #1 0x7527055bd68d  (/lib/x86_64-linux-gnu/libzip.so.4+0x868d)

Indirect leak of 200 byte(s) in 1 object(s) allocated from:
    #0 0x68106d in malloc (/home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php+0x68106d)
    #1 0x7527055c87d1  (/lib/x86_64-linux-gnu/libzip.so.4+0x137d1)

Indirect leak of 160 byte(s) in 2 object(s) allocated from:
    #0 0x68106d in malloc (/home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php+0x68106d)
    #1 0x7527055c8477  (/lib/x86_64-linux-gnu/libzip.so.4+0x13477)

Indirect leak of 128 byte(s) in 1 object(s) allocated from:
    #0 0x68106d in malloc (/home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php+0x68106d)
    #1 0x7527055bb64b  (/lib/x86_64-linux-gnu/libzip.so.4+0x664b)

Indirect leak of 120 byte(s) in 1 object(s) allocated from:
    #0 0x68106d in malloc (/home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php+0x68106d)
    #1 0x7527055ba52d  (/lib/x86_64-linux-gnu/libzip.so.4+0x552d)

Indirect leak of 88 byte(s) in 1 object(s) allocated from:
    #0 0x68106d in malloc (/home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php+0x68106d)
    #1 0x7527055bdad9 in zip_register_cancel_callback_with_state (/lib/x86_64-linux-gnu/libzip.so.4+0x8ad9)

Indirect leak of 80 byte(s) in 1 object(s) allocated from:
    #0 0x68106d in malloc (/home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php+0x68106d)
    #1 0x7527055bb7dc  (/lib/x86_64-linux-gnu/libzip.so.4+0x67dc)

Indirect leak of 64 byte(s) in 1 object(s) allocated from:
    #0 0x68106d in malloc (/home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php+0x68106d)
    #1 0x7527055c509b  (/lib/x86_64-linux-gnu/libzip.so.4+0x1009b)
    #2 0x4e1a01b in ZEND_DO_FCALL_SPEC_RETVAL_UNUSED_HANDLER /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_vm_execute.h:1992:4
    #3 0x4b5cc73 in execute_ex /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_vm_execute.h:58696:12
    #4 0x4b5f1fc in zend_execute /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_vm_execute.h:64385:2
    #5 0x58d3f89 in zend_execute_script /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend.c:1943:3
    #6 0x40c77ba in php_execute_script_ex /home/phpfuzz/WorkSpace/flowfusion/php-src/main/main.c:2594:13
    #7 0x40c88f8 in php_execute_script /home/phpfuzz/WorkSpace/flowfusion/php-src/main/main.c:2634:9
    #8 0x58e8e9a in do_cli /home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php_cli.c:952:5
    #9 0x58e327f in main /home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php_cli.c:1363:18
    #10 0x752705395d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16

Indirect leak of 40 byte(s) in 1 object(s) allocated from:
    #0 0x68106d in malloc (/home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php+0x68106d)
    #1 0x7527055bcad1  (/lib/x86_64-linux-gnu/libzip.so.4+0x7ad1)

Indirect leak of 32 byte(s) in 1 object(s) allocated from:
    #0 0x68106d in malloc (/home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php+0x68106d)
    #1 0x7527055c719e  (/lib/x86_64-linux-gnu/libzip.so.4+0x1219e)

Indirect leak of 24 byte(s) in 1 object(s) allocated from:
    #0 0x68106d in malloc (/home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php+0x68106d)
    #1 0x7527055bb661  (/lib/x86_64-linux-gnu/libzip.so.4+0x6661)

Indirect leak of 24 byte(s) in 1 object(s) allocated from:
    #0 0x68106d in malloc (/home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php+0x68106d)
    #1 0x7527055c74df  (/lib/x86_64-linux-gnu/libzip.so.4+0x124df)

Indirect leak of 17 byte(s) in 1 object(s) allocated from:
    #0 0x66cd04 in strdup (/home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php+0x66cd04)
    #1 0x7527055c880f  (/lib/x86_64-linux-gnu/libzip.so.4+0x1380f)

Indirect leak of 16 byte(s) in 1 object(s) allocated from:
    #0 0x681389 in realloc (/home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php+0x681389)
    #1 0x7527055bb791  (/lib/x86_64-linux-gnu/libzip.so.4+0x6791)

Indirect leak of 16 byte(s) in 1 object(s) allocated from:
    #0 0x681389 in realloc (/home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php+0x681389)
    #1 0x7527055bb778  (/lib/x86_64-linux-gnu/libzip.so.4+0x6778)

Indirect leak of 5 byte(s) in 1 object(s) allocated from:
    #0 0x68106d in malloc (/home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php+0x68106d)
    #1 0x7527055c71b7  (/lib/x86_64-linux-gnu/libzip.so.4+0x121b7)

SUMMARY: AddressSanitizer: 3596 byte(s) leaked in 20 allocation(s).

    To reproduce:

    ./php-src/sapi/cli/php  ./test.php

    Commit:

    e9310171f767d95c34df90eebfbec7d61ad22bbc

    Configurations:

    CC="clang-12" CXX="clang++-12" CFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" CXXFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" ./configure --enable-debug --enable-address-sanitizer --enable-undefined-sanitizer --enable-re2c-cgoto --enable-fpm --enable-litespeed --enable-phpdbg-debug --enable-zts --enable-bcmath --enable-calendar --enable-dba --enable-dl-test --enable-exif --enable-ftp --enable-gd --enable-gd-jis-conv --enable-mbstring --enable-pcntl --enable-shmop --enable-soap --enable-sockets --enable-sysvmsg --enable-zend-test --with-zlib --with-bz2 --with-curl --with-enchant --with-gettext --with-gmp --with-mhash --with-ldap --with-libedit --with-readline --with-snmp --with-sodium --with-xsl --with-zip --with-mysqli --with-pdo-mysql --with-pdo-pgsql --with-pgsql --with-sqlite3 --with-pdo-sqlite --with-webp --with-jpeg --with-freetype --enable-sigchild --with-readline --with-pcre-jit --with-iconv

    Operating System:

    Ubuntu 20.04 Host, Docker 0599jiangyc/flowfusion:latest

    This report is automatically generated by FlowFusion

    Any magic I can do to find legitimate leaks?

  6. iluuu1994
    added a commit that references this issue on Jun 23, 2025

    Fix leak when creating cycle in hook

    fe504d3
  7. iluuu1994
    closed this as completedin fe504d3on Jun 23, 2025

  8. iluuu1994 commented on Jun 24, 2025

    @iluuu1994
    iluuu1994
    on Jun 24, 2025
    Member

    @YuanchengJiang This looks legitimate. $fusion prevents the ZipArchive destructor from being called. When it is finally called the executor is already stopped, thus crashing the process.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

BugCategory: EngineStatus: Verified

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions