[php-src] Issue #20664: segv in ir_gcm.c:67:29
[email protected] (chongwick)
| Newsgroups | php.bugs |
|---|---|
| Message-ID | <[email protected]> |
Issue: https://github.com/php/php-src/issues/20664
Author: chongwick
### Description
The following code:
```php
<?php
$v_14747 = '*** Testing dechex() : usage variations ***\n';
$v_14749 = 0;
$v_14750 = 1;
$v_14751 = 12345;
$v_8882 = $v_8882;
$v_14759 = TRUE;
$v_14765 = 1;
$v_14766 = $v_14759 * $v_14765;
$v_14755 = 1.8446744073709552e+19;
$v_14756 = 123456789000;
$v_14757 = True;
$v_14758 = False;
$v_14754 = 1.8446744073709552e+19;
$v_14772 = var_dump($v_14754,);
$v_14760 = FALSE;
$v_14761 = '';
$v_14762 = '';
$v_14748 = array(0 => $v_14749,1 => $v_14750,2 => $v_14751,3 => $v_8882,4 => $v_14766,5 => $v_14755,6 => $v_14756,7 => $v_14757,8 => $v_14758,9 => $v_14772,10 => $v_14760,11 => $v_14761,12 => $v_14762,);
foreach ($v_14748 as $input){
$v_14764 = $input;
$v_14767 = "\n-- Iteration $v_14766 --\n";
try{
$v_14771 = dechex($v_14765,);
}
catch (TypeError $exception){
$v_14768 = $exception->getMessage();
$v_14769 = '\n';
$v_14770 = $v_14768 and $v_14769;
}
$v_12081 = SampleFilter::class;
$v_12082 = class_exists($v_12081,);
$v_12083 = !($v_12082);
if($v_12083){
$v_12084 = 'sample.filter';
$v_12085 = SampleFilter::class;
$v_12086 = stream_filter_register($v_12084,$v_12085,);
$v_12087 = 'php://filter/read=sample.filter/resource=';
$v_12088 = __FILE__;
$v_12089 = $v_12087 . $v_12088;
}
}
$v_14763 = $input;
```
Resulted in this output:
```
float(1.8446744073709552E+19)
AddressSanitizer:DEADLYSIGNAL
=================================================================
==1828730==ERROR: AddressSanitizer: SEGV on unknown address 0x6206bec69338 (pc 0x0000028a4ae1 bp 0x7ffcead70970 sp 0x7ffcead70750 T0)
==1828730==The signal is caused by a READ memory access.
#0 0x28a4ae1 in ir_gcm_find_lca /home/w023dtc/nightly_php/php-src/ext/opcache/jit/ir/ir_gcm.c:67:29
#1 0x2878e33 in ir_gcm_schedule_late /home/w023dtc/nightly_php/php-src/ext/opcache/jit/ir/ir_gcm.c:525:23
#2 0x2873a08 in ir_gcm /home/w023dtc/nightly_php/php-src/ext/opcache/jit/ir/ir_gcm.c:715:4
#3 0x316c79d in zend_jit_ir_compile /home/w023dtc/nightly_php/php-src/ext/opcache/jit/zend_jit_ir.c:2893:2
#4 0x3007f24 in zend_jit_finish /home/w023dtc/nightly_php/php-src/ext/opcache/jit/zend_jit_ir.c:16744:10
#5 0x2e40d27 in zend_jit_trace /home/w023dtc/nightly_php/php-src/ext/opcache/jit/zend_jit_trace.c:7317:12
#6 0x2c018a9 in zend_jit_compile_root_trace /home/w023dtc/nightly_php/php-src/ext/opcache/jit/zend_jit_trace.c:7532:14
#7 0x2bf3b70 in zend_jit_trace_hot_root /home/w023dtc/nightly_php/php-src/ext/opcache/jit/zend_jit_trace.c:8226:10
#8 0x2bb9833 in zend_jit_trace_counter_helper /home/w023dtc/nightly_php/php-src/ext/opcache/jit/zend_jit_vm_helpers.c:472:7
#9 0x2bb90ca in zend_jit_func_trace_helper /home/w023dtc/nightly_php/php-src/ext/opcache/jit/zend_jit_vm_helpers.c:508:2
#10 0x5c304db in execute_ex /home/w023dtc/nightly_php/php-src/Zend/zend_vm_execute.h:116212:12
#11 0x5c32a6c in zend_execute /home/w023dtc/nightly_php/php-src/Zend/zend_vm_execute.h:121924:2
#12 0x69c39c9 in zend_execute_script /home/w023dtc/nightly_php/php-src/Zend/zend.c:1975:3
#13 0x51907aa in php_execute_script_ex /home/w023dtc/nightly_php/php-src/main/main.c:2645:13
#14 0x51918e8 in php_execute_script /home/w023dtc/nightly_php/php-src/main/main.c:2685:9
#15 0x69d88da in do_cli /home/w023dtc/nightly_php/php-src/sapi/cli/php_cli.c:951:5
#16 0x69d2cbf in main /home/w023dtc/nightly_php/php-src/sapi/cli/php_cli.c:1362:18
#17 0x153a22d95d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#18 0x153a22d95e3f in __libc_start_main csu/../csu/libc-start.c:392:3
#19 0x607b04 in _start (/home/w023dtc/nightly_php/php-src/sapi/cli/php+0x607b04)
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/w023dtc/nightly_php/php-src/ext/opcache/jit/ir/ir_gcm.c:67:29 in ir_gcm_find_lca
==1828730==ABORTING
```
```
USE_ZEND_ALLOC=0 php -d "memory_limit = -1" -d "zend.assertions = 1" -d "display_errors = On" -d "display_startup_errors = On" -d "opcache.memory_consumption=4096M" -d "opcache.enable=1" -d "opcache.enable_cli=1" -d "opcache.jit=tracing" -d "opcache.validate_timestamps=0" -d "opcache.jit_buffer_size=128M" -d "opcache.file_update_protection=0" -d "opcache.max_accelerated_files=1000000" -d "opcache.interned_strings_buffer=64" -d "opcache.jit_prof_threshold=0.000000001" -d "opcache.jit_max_root_traces= 100000" -d "opcache.jit_max_side_traces= 100000" -d "opcache.jit_max_exit_counters=100000" -d "opcache.jit_hot_loop=1" -d "opcache.jit_hot_func=1" -d "opcache.jit_hot_return=1" -d "opcache.jit_hot_side_exit=1" -d "opcache.jit_blacklist_root_trace=255" -d "opcache.jit_blacklist_side_trace=255" -d "opcache.protect_memory=1" script.php
```
### PHP Version
```plain
nightly
```
### Operating System
ubuntu 22.04