SEGV when `record_warning=1`

[YuanchengJiang]

Description

The following code:

<?php
$pid = pcntl_fork();
require __DIR__ . '/warning_replay.inc';

Resulted in this output:

/home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_string.h:209:7: runtime error: member access within null pointer of type 'zend_string' (aka 'struct _zend_string')
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_string.h:209:7 in 

To reproduce:

./php-src/sapi/cli/php  -d "opcache.record_warnings=1" -d "opcache.enable_cli=1" ./test.php

Commit:

ee2da6d9e9745ec83b02b1e5c5a07e8dbd5f9f98

Configurations:

CC="clang-12" CXX="clang++-12" CFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" CXXFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" ./configure --enable-debug --enable-address-sanitizer --enable-undefined-sanitizer --enable-re2c-cgoto --enable-fpm --enable-litespeed --enable-phpdbg-debug --enable-zts --enable-bcmath --enable-calendar --enable-dba --enable-dl-test --enable-exif --enable-ftp --enable-gd --enable-gd-jis-conv --enable-mbstring --enable-pcntl --enable-shmop --enable-soap --enable-sockets --enable-sysvmsg --enable-zend-test --with-zlib --with-bz2 --with-curl --with-enchant --with-gettext --with-gmp --with-mhash --with-ldap --with-libedit --with-readline --with-snmp --with-sodium --with-xsl --with-zip --with-mysqli --with-pdo-mysql --with-pdo-pgsql --with-pgsql --with-sqlite3 --with-pdo-sqlite --with-webp --with-jpeg --with-freetype --enable-sigchild --with-readline --with-pcre-jit --with-iconv

Operating System:

Ubuntu 20.04 Host, Docker 0599jiangyc/flowfusion:latest

This report is automatically generated by FlowFusion

PHP Version

nightly

Operating System

No response

[devnexen]

Cannot reproduce, what UBSAN_OPTIONS="print_stacktrace=1" ./php-src/sapi/cli/php -d "opcache.record_warnings=1" -d "opcache.enable_cli=1" ./test.php output gives ?

[YuanchengJiang]

Warning: Unsupported declare 'unknown' in /tmp/warning_replay.inc on line 3
/home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_string.h:209:7: runtime error: member access within null pointer of type 'zend_string' (aka 'struct _zend_string')
phpfuzz@1ef1f1eacc98:~/WorkSpace/flowfusion$     
    #0 0x50ab3e2 in zend_string_copy /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_string.h:209:7
    #1 0x509a61a in php_error_cb /home/phpfuzz/WorkSpace/flowfusion/php-src/main/main.c:1399:28
    #2 0x3ba7944 in soap_error_handler /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/soap/soap.c:1962:3
    #3 0x68be5b9 in zend_error_zstr_at /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend.c:1533:3
    #4 0x68c4604 in zend_emit_recorded_errors_ex /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend.c:1788:3
    #5 0x68bb36b in zend_error_zstr_at /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend.c:1471:3
    #6 0x68c4604 in zend_emit_recorded_errors_ex /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend.c:1788:3
    #7 0x68c7205 in zend_emit_recorded_errors /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend.c:1795:2
    #8 0x23f6a2c in persistent_compile_file /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/opcache/ZendAccelerator.c:2212:3
    #9 0x6585e09 in compile_filename /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_language_scanner.l:717:11
    #10 0x627da54 in zend_include_or_eval /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_execute.c:5349:19
    #11 0x5e66d55 in ZEND_INCLUDE_OR_EVAL_SPEC_CONST_HANDLER /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_vm_execute.h:5370:17
    #12 0x5b44f7b in execute_ex /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_vm_execute.h:115722:12
    #13 0x5b4750c in zend_execute /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_vm_execute.h:121434:2
    #14 0x68cb7a9 in zend_execute_script /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend.c:1977:3
    #15 0x50a616a in php_execute_script_ex /home/phpfuzz/WorkSpace/flowfusion/php-src/main/main.c:2640:13
    #16 0x50a72a8 in php_execute_script /home/phpfuzz/WorkSpace/flowfusion/php-src/main/main.c:2680:9
    #17 0x68e06ba in do_cli /home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php_cli.c:951:5
    #18 0x68daa9f in main /home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php_cli.c:1362:18
    #19 0x766c086a8d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #20 0x766c086a8e3f in __libc_start_main csu/../csu/libc-start.c:392:3
    #21 0x6061f4 in _start (/home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php+0x6061f4)

SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_string.h:209:7 in 

[arnaud-lb]

It could possibly be related to #18541, however I can't reproduce either.

[iluuu1994]

I can reproduce this. It happens when both processes race to compile warning_replay.inc. Whichever is first will get to persist the script. The loser will enter this branch:

php-src/ext/opcache/ZendAccelerator.c

Line 1605 in 8982351

free_persistent_script(new_persistent_script, 1);

Here, the script that is already persisted is used instead, and the script that was just compiled is freed. However, EG(errors) and persistent_script->warnings still refer to the same allocation, and EG(errors) becomes a dangling pointer. To solve this, we can simply set EG(errors) and EG(num_errors) to NULL and 0, respectively.

Furthermore, we need to adjust some calls to zend_emit_recorded_errors() that would previously use EG(errors), even when persistent_script has been swapped out.

@arnaud-lb Does this approach look correct to you? If so, I'll create a PR. Edit: I created it anyway. #19995 And also removed the diff, so check in the PR as there were some changes.