JIT Integer overflow ext/opcache/jit/ir/ir_fold.h

[YuanchengJiang]

Description

The following code:

<?php
function test(){
for($i = PHP_INT_MIN; $i < 2; $i++){
$a = @[3][$i];
}
}

Resulted in this output:

ext/opcache/jit/ir/ir_fold.h:472:2: runtime error: signed integer overflow: -9223372036854775808 * 16 cannot be represented in type 'long'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ext/opcache/jit/ir/ir_fold.h:472:2

To reproduce:

-d "zend_extension=/home/phpfuzz/WorkSpace/flowfusion/php-src/modules/opcache.so" -d "opcache.enable_cli=1" -d "opcache.jit=1205"

PHP Version

nightly

Operating System

No response

[nielsdos]

This is caused by the folding of the index and zval size in the following codegen:

php-src/ext/opcache/jit/zend_jit_ir.c

Lines 12080 to 12081 in 11937b3

	// JIT: _ret = &_ht->arPacked[h];
	ref = ir_MUL_L(h, ir_CONST_LONG(sizeof(zval)));

However, this can't cause real problems because we check earlier that the index is in bounds.
If it were a constant instead of a zval, the JIT would know to not consider the packed case, avoiding the issue because this code path wouldn't be taken.

Anyway, the undefined behaviour needs to be fixed in the IR repository.
I'll take a look at how hard this would be.

[nielsdos]

This is now fixed in the IR repo and will soon make its way into PHP.