[php-src] Issue #20664: segv in ir_gcm.c:67:29

[email protected] (chongwick)
Newsgroups php.bugs
Message-ID <[email protected]>
Issue: https://github.com/php/php-src/issues/20664
Author: chongwick

### Description

The following code:

```php
<?php
$v_14747 = '*** Testing dechex() : usage variations ***\n';
$v_14749 = 0;
$v_14750 = 1;
$v_14751 = 12345;
$v_8882 = $v_8882;
$v_14759 = TRUE;
$v_14765 = 1;
$v_14766 = $v_14759 * $v_14765;
$v_14755 = 1.8446744073709552e+19;
$v_14756 = 123456789000;
$v_14757 = True;
$v_14758 = False;
$v_14754 = 1.8446744073709552e+19;
$v_14772 = var_dump($v_14754,);
$v_14760 = FALSE;
$v_14761 = '';
$v_14762 = '';
$v_14748 = array(0 => $v_14749,1 => $v_14750,2 => $v_14751,3 => $v_8882,4 => $v_14766,5 => $v_14755,6 => $v_14756,7 => $v_14757,8 => $v_14758,9 => $v_14772,10 => $v_14760,11 => $v_14761,12 => $v_14762,);

foreach ($v_14748 as $input){
$v_14764 = $input;
$v_14767 = "\n-- Iteration $v_14766 --\n";
try{
$v_14771 = dechex($v_14765,);
}
catch (TypeError $exception){
$v_14768 = $exception->getMessage();
$v_14769 = '\n';
$v_14770 = $v_14768 and $v_14769;
}
$v_12081 = SampleFilter::class;
$v_12082 = class_exists($v_12081,);
$v_12083 = !($v_12082);
if($v_12083){
$v_12084 = 'sample.filter';
$v_12085 = SampleFilter::class;
$v_12086 = stream_filter_register($v_12084,$v_12085,);
$v_12087 = 'php://filter/read=sample.filter/resource=';
$v_12088 = __FILE__;
$v_12089 = $v_12087 . $v_12088;
}
}
$v_14763 = $input;
```

Resulted in this output:
```
float(1.8446744073709552E+19)
AddressSanitizer:DEADLYSIGNAL
=================================================================
==1828730==ERROR: AddressSanitizer: SEGV on unknown address 0x6206bec69338 (pc 0x0000028a4ae1 bp 0x7ffcead70970 sp 0x7ffcead70750 T0)
==1828730==The signal is caused by a READ memory access.
    #0 0x28a4ae1 in ir_gcm_find_lca /home/w023dtc/nightly_php/php-src/ext/opcache/jit/ir/ir_gcm.c:67:29
    #1 0x2878e33 in ir_gcm_schedule_late /home/w023dtc/nightly_php/php-src/ext/opcache/jit/ir/ir_gcm.c:525:23
    #2 0x2873a08 in ir_gcm /home/w023dtc/nightly_php/php-src/ext/opcache/jit/ir/ir_gcm.c:715:4
    #3 0x316c79d in zend_jit_ir_compile /home/w023dtc/nightly_php/php-src/ext/opcache/jit/zend_jit_ir.c:2893:2
    #4 0x3007f24 in zend_jit_finish /home/w023dtc/nightly_php/php-src/ext/opcache/jit/zend_jit_ir.c:16744:10
    #5 0x2e40d27 in zend_jit_trace /home/w023dtc/nightly_php/php-src/ext/opcache/jit/zend_jit_trace.c:7317:12
    #6 0x2c018a9 in zend_jit_compile_root_trace /home/w023dtc/nightly_php/php-src/ext/opcache/jit/zend_jit_trace.c:7532:14
    #7 0x2bf3b70 in zend_jit_trace_hot_root /home/w023dtc/nightly_php/php-src/ext/opcache/jit/zend_jit_trace.c:8226:10
    #8 0x2bb9833 in zend_jit_trace_counter_helper /home/w023dtc/nightly_php/php-src/ext/opcache/jit/zend_jit_vm_helpers.c:472:7
    #9 0x2bb90ca in zend_jit_func_trace_helper /home/w023dtc/nightly_php/php-src/ext/opcache/jit/zend_jit_vm_helpers.c:508:2
    #10 0x5c304db in execute_ex /home/w023dtc/nightly_php/php-src/Zend/zend_vm_execute.h:116212:12
    #11 0x5c32a6c in zend_execute /home/w023dtc/nightly_php/php-src/Zend/zend_vm_execute.h:121924:2
    #12 0x69c39c9 in zend_execute_script /home/w023dtc/nightly_php/php-src/Zend/zend.c:1975:3
    #13 0x51907aa in php_execute_script_ex /home/w023dtc/nightly_php/php-src/main/main.c:2645:13
    #14 0x51918e8 in php_execute_script /home/w023dtc/nightly_php/php-src/main/main.c:2685:9
    #15 0x69d88da in do_cli /home/w023dtc/nightly_php/php-src/sapi/cli/php_cli.c:951:5
    #16 0x69d2cbf in main /home/w023dtc/nightly_php/php-src/sapi/cli/php_cli.c:1362:18
    #17 0x153a22d95d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #18 0x153a22d95e3f in __libc_start_main csu/../csu/libc-start.c:392:3
    #19 0x607b04 in _start (/home/w023dtc/nightly_php/php-src/sapi/cli/php+0x607b04)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/w023dtc/nightly_php/php-src/ext/opcache/jit/ir/ir_gcm.c:67:29 in ir_gcm_find_lca
==1828730==ABORTING
```


```
USE_ZEND_ALLOC=0 php -d "memory_limit = -1" -d "zend.assertions = 1" -d "display_errors = On" -d "display_startup_errors = On" -d "opcache.memory_consumption=4096M" -d "opcache.enable=1" -d "opcache.enable_cli=1" -d "opcache.jit=tracing" -d "opcache.validate_timestamps=0" -d "opcache.jit_buffer_size=128M" -d "opcache.file_update_protection=0" -d "opcache.max_accelerated_files=1000000" -d "opcache.interned_strings_buffer=64" -d "opcache.jit_prof_threshold=0.000000001" -d "opcache.jit_max_root_traces=  100000" -d "opcache.jit_max_side_traces=  100000" -d "opcache.jit_max_exit_counters=100000" -d "opcache.jit_hot_loop=1" -d "opcache.jit_hot_func=1" -d "opcache.jit_hot_return=1" -d "opcache.jit_hot_side_exit=1" -d "opcache.jit_blacklist_root_trace=255" -d "opcache.jit_blacklist_side_trace=255" -d "opcache.protect_memory=1" script.php
```


### PHP Version

```plain
nightly
```

### Operating System

ubuntu 22.04
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.