php / php/php-src

PHPDBG ASAN failures under tracked alloc without zend alloc

Open
#11,053 9 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Bug SAPI: phpdbg
Dominant language
C
Stars
40.4k
Forks
8.1k
Avg merge
2d 13h
Merged PRs (30d)
96

Description

Description

The following tests fail with USE_TRACKED_ALLOC=1 and USE_ZEND_ALLOC=0 under ASAN:

Bug #73927 (phpdbg fails with windows error prompt at "watch array") [sapi/phpdbg/tests/bug73927.phpt]
Test simple recursive watchpoint [sapi/phpdbg/tests/watch_001.phpt]
Test simple array watchpoint with replace [sapi/phpdbg/tests/watch_002.phpt]
Test simple watchpoint with replace [sapi/phpdbg/tests/watch_003.phpt]
Test detection of inline string manipulations on zval watch [sapi/phpdbg/tests/watch_004.phpt]
Test proper watch comparisons when having multiple levels of indirection from a zval to its value [sapi/phpdbg/tests/watch_005.phpt]
Test multiple watch elements pointing to the same watchpoint [sapi/phpdbg/tests/watch_006.phpt]

Some fail with:

Zend/zend_alloc.c:2806: tracked_get_size_zv: Assertion size_zv && "Trying to free pointer not allocated through ZendMM"' failed.`

and some fail with a use-after-free message

PHP Version

current master, stable versions not tested

Operating System

Linux 6.2.10

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the failures with USE_TRACKED_ALLOC=1 and USE_ZEND_ALLOC=0 under ASAN, starting with the listed sapi/phpdbg/tests/*.phpt cases. Read Zend/zend_alloc.c around the tracked_get_size_zv assertion and compare the assertion failures with the reported use-after-free messages. Done means all listed phpdbg watchpoint tests pass under this configuration.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
devtools, testing-qa
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.