fix(prof): crash in ZEND_INIT_ARRAY #3255
Conversation
The engine currently does not save the opline in ZEND_INIT_ARRAY, so under rare situations, that opline will be dangling, which can cause crashes. The fix works because by having a user opcode handler the engine will save the opline before it calls the user opcode handler. I do not have a reproducer for this one yet, but we've hit this issue before so I'm fairly confident this needs to be done until there is an upstream fix in PHP, then we can do version-specific mitigation.
Benchmarks [ profiler ]Benchmark execution time: 2025-05-16 20:55:21 Comparing candidate commit f17cb34 in PR branch Found 0 performance improvements and 0 performance regressions! Performance is the same for 30 metrics, 6 unstable metrics. |
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## master #3255 +/- ##
============================================
+ Coverage 76.34% 79.28% +2.93%
Complexity 2948 2948
============================================
Files 145 118 -27
Lines 16082 11633 -4449
Branches 1110 0 -1110
============================================
- Hits 12278 9223 -3055
+ Misses 3227 2410 -817
+ Partials 577 0 -577
Flags with carried forward coverage won't be shown. Click here to find out more. see 28 files with indirect coverage changes Continue to review full report in Codecov by Sentry.
🚀 New features to boost your workflow:
|
3 participants
PROF-11814
Description
A PHP application may crash happen if:
The engine currently does not save the opline in ZEND_INIT_ARRAY. Usually if it's out-dated and the line-number is a bit stale, it's not a big deal. But in some cases the opline will be dangling, and in those cases we read invalid memory. This is a bug in the PHP VM that needs to also be fixed upstream: php/php-src#18578. Since PHP 8.1 and 8.2 are in security fixes only, this will go into PHP 8.3 and 8.4, and we'll have to mitigate it on <8.3.
The fix works because by having a user opcode handler the engine will save the opline before it calls the user opcode handler. This has a small performance penalty for this specific opcode.
I do not have a reproducer for this one yet, but we've hit this issue before in other opcodes. I'm fairly confident this needs to be done until there is an upstream fix in PHP, then we can restrict this mitigation to version-specific ranges.
Reviewer checklist