segfault in `zend_mm_alloc_small` triggered by call to `unserialize`

Description

This is a large WordPress website running some commonly available community plugins. The site was working fine on PHP 7.4 but since upgrading to 8.2.6 and then subsequent 8.2.10 to see if the issue was resolved we are seeing segfaults on multiple servers in the cluster servicing this website.

Every single fault is during a call to unserialize, here is the zbacktrace:

[0x7fb2ac2138e0] unserialize("a:5:{s:3:"AUD";a:8:{s:4:"name";s:3:"AUD";s:4:"rate";d:1;s:6:"symbol";s:3:"AU$";s:8:"position";s:4:"left";s:
9:"is_etalon";i:1;s:10:"hide_cents";i:0;s:11:"description";s:17:"Australian Dollar";s:4:"flag";s:88:"https://www.xxxxxxx.com/wp-content/p
lugins/wooco...") [internal function]
[0x7fb2ac213860] maybe_unserialize("a:5:{s:3:"AUD";a:8:{s:4:"name";s:3:"AUD";s:4:"rate";d:1;s:6:"symbol";s:3:"AU$";s:8:"position";s:4:"le
ft";s:9:"is_etalon";i:1;s:10:"hide_cents";i:0;s:11:"description";s:17:"Australian Dollar";s:4:"flag";s:88:"https://www.xxxxxxx.com/wp-con
tent/plugins/wooco...") /home/xxxxxxx/public_html/wp-includes/functions.php:650 
[0x7fb2ac213650] get_option("woocs", array(2)[0x7fb2ac2136b0]) /home/xxxxxxx/public_html/wp-includes/option.php:253 
[0x7fb2ac2135d0] WOOCS->get_currencies() /home/xxxxxxx/public_html/wp-content/plugins/woocommerce-currency-switcher/index.php:972 
[0x7fb2ac213530] WOOCS->init_no_cents() /home/xxxxxxx/public_html/wp-content/plugins/woocommerce-currency-switcher/index.php:497 
[0x7fb2ac213470] WOOCS->__construct() /home/xxxxxxx/public_html/wp-content/plugins/woocommerce-currency-switcher/index.php:82 
[0x7fb2ac2133e0] (main) /home/xxxxxxx/public_html/wp-content/plugins/woocommerce-currency-switcher/index.php:2213 
[0x7fb2ac213220] (main) /home/xxxxxxx/public_html/wp-settings.php:462 
[0x7fb2ac2131a0] (main) /home/xxxxxxx/public_html/wp-config.php:72 
[0x7fb2ac213100] (main) /home/xxxxxxx/public_html/wp-load.php:50 
[0x7fb2ac213070] (main) /home/xxxxxxx/public_html/wp-blog-header.php:13 
[0x7fb2ac213020] (main) /home/xxxxxxx/public_html/index.php:17

And the PHP backtrace

#0  zend_mm_alloc_small (bin_num=11, heap=0x7fb2ac200040) at ./Zend/zend_alloc.c:1313
#1  zend_mm_alloc_heap (size=<optimized out>, heap=0x7fb2ac200040) at ./Zend/zend_alloc.c:1384
#2  _emalloc (size=<optimized out>) at ./Zend/zend_alloc.c:2601
#3  0x0000556923c3962a in zend_string_alloc (persistent=false, len=88) at ./Zend/zend_string.h:152
#4  zend_string_init (persistent=false, len=88, 
    str=0x7fb2a6e89a92 "https://www.xxxxxxx.com/wp-content/plugins/woocommerce-currency-switcher/img/no_flag.png\";}s:3:\"NZD\";a:8:{s:4:\"name\";s:3:\"NZD\";s:4:\"rate\";d:1.07660000000000000142108547152020037174224853515625;s:6:\"symbol\";s:3:\"NZ$\";s:8:\"position\";s:4:\"left\";s:9:\"is_etalon\";i:0;s:10:\"hide_cents\";i:0;s:11:\"description\";s:18:\"New Zealand Dollar\";s:4:\"flag\";s:88:\"https://www.xxxxxxx.com/wp-content/plugins/woocommerce-currency-switcher/img/no_flag.png\";}s:3:\"GBP\";a:8:{s:4:\"name\";s:3:\"GBP\";s:4:\"rate\";d:0.502499999999999946709294817992486059665679931640625;s:6:\"symbol\";s:7:\"&pound;\";s:8:\"position\";s:4:\"left\";s:9:\"is_etalon\";i:0;s:10:\"hide_cents\";i:0;s:11:\"description\";s:13:\"British Pound\";s:4:\"flag\";s:88:\"https://www.xxxxxxx.com/wp-content/plugins/woocommerce-currency-switcher/img/no_flag.png\";}}") at ./Zend/zend_string.h:174
#5  zend_string_init_fast (len=88, 
    str=0x7fb2a6e89a92 "https://www.xxxxxxx.com/wp-content/plugins/woocommerce-currency-switcher/img/no_flag.png\";}s:3:\"NZD\";a:8:{s:4:\"name\";s:3:\"NZD\";s:4:\"rate\";d:1.07660000000000000142108547152020037174224853515625;s:6:\"symbol\";s:3:\"NZ$\";s:8:\"position\";s:4:\"left\";s:9:\"is_etalon\";i:0;s:10:\"hide_cents\";i:0;s:11:\"description\";s:18:\"New Zealand Dollar\";s:4:\"flag\";s:88:\"https://www.xxxxxxx.com/wp-content/plugins/woocommerce-currency-switcher/img/no_flag.png\";}s:3:\"GBP\";a:8:{s:4:\"name\";s:3:\"GBP\";s:4:\"rate\";d:0.502499999999999946709294817992486059665679931640625;s:6:\"symbol\";s:7:\"&pound;\";s:8:\"position\";s:4:\"left\";s:9:\"is_etalon\";i:0;s:10:\"hide_cents\";i:0;s:11:\"description\";s:13:\"British Pound\";s:4:\"flag\";s:88:\"https://www.xxxxxxx.com/wp-content/plugins/woocommerce-currency-switcher/img/no_flag.png\";}}") at ./Zend/zend_string.h:184
#6  php_var_unserialize_internal (rval=0x7fb2a6e45fa0, p=0x7fff469fb468, max=<optimized out>, var_hash=0x7fff469fb470)
    at ./ext/standard/var_unserializer.c:1798
#7  0x0000556923c39110 in process_nested_array_data (elements=0, ht=0x7fb2a6f0bb28, var_hash=0x7fff469fb470, max=0x7fb2a6e89da2 "", 
    p=0x7fff469fb468, rval=0x7fff469fb2a0) at ./ext/standard/var_unserializer.c:511
#8  php_var_unserialize_internal (rval=0x7fff469fb2a0, p=0x7fff469fb468, max=0x7fb2a6e89da2 "", var_hash=0x7fff469fb470)
    at ./ext/standard/var_unserializer.c:1742
#9  0x0000556923c39110 in process_nested_array_data (elements=2, ht=0x7fb2a6f0ba80, var_hash=0x7fff469fb470, max=0x7fb2a6e89da2 "", 
    p=0x7fff469fb468, rval=0x7fff469fb390) at ./ext/standard/var_unserializer.c:511
#10 php_var_unserialize_internal (rval=0x7fff469fb390, p=0x7fff469fb468, max=0x7fb2a6e89da2 "", var_hash=0x7fff469fb470)
    at ./ext/standard/var_unserializer.c:1742
#11 0x0000556923c3ac47 in php_var_unserialize (rval=<optimized out>, p=<optimized out>, max=<optimized out>, var_hash=<optimized out>)
    at ./ext/standard/var_unserializer.c:853
#12 0x0000556923c29fb4 in php_unserialize_with_options (function_name=0x556923db086e "unserialize", options=<optimized out>, 
    buf_len=1674, 
    buf=0x7fb2a6e89718 "a:5:{s:3:\"AUD\";a:8:{s:4:\"name\";s:3:\"AUD\";s:4:\"rate\";d:1;s:6:\"symbol\";s:3:\"AU$\";s:8:\"position\";s:4:\"left\";s:9:\"is_etalon\";i:1;s:10:\"hide_cents\";i:0;s:11:\"description\";s:17:\"Australian Dollar\";s:4:\"flag\";s:88:\"https://www.xxxxxxx.com/wp-content/plugins/woocommerce-currency-switcher/img/no_flag.png\";}s:3:\"USD\";a:8:{s:4:\"name\";s:3:\"USD\";s:4:\"rate\";d:0.71679999999999999271693695845897309482097625732421875;s:6:\"symbol\";s:3:\"US$\";s:8:\"position\";s:4:\"left\";s:9:\"is_etalon\";i:0;s:10:\"hide_cents\";i:0;s:11:\"description\";s:9:\"US Dollar\";s:4:\"flag\";s:88:\"https://www.xxxxxxx.com/wp-content/plugins/woocommerce-currency-switcher/img/no_flag.png\";}s:3:\"EUR\";a:8:{s:4:\"name\";s:3:\"EUR\";s:4:\"rate\";d:0.6449000000000000287769807982840575277805328369140625;s:6:\"symbol\";s:6:\"&euro;\";s:8:\"position\";s:10:\"left_space\";s:9:\"is_etalon\";i:0;s:10:\"hide_cents\";i:0;s:11:\"description\";s:4:\"Euro\";s:4:\"flag\";s:88:\"https://www.xxxxxxx.com/wp-content/plugins/woocommerce-currency-switcher/img/no_flag.png\";}s:3:\"NZD\";a:8:{s:4:\"name\";s:3:\"NZD\";s:4:\"rate\";d:1.07660000000000000142108547152020037174224853515625;s:6:\"symbol\";s:3:\"NZ$\";s:8:\"position\";s:4:\"left\";s:9:\"is_etalon\";i:0;s:10:\"hide_cents\";i:0;s:11:\"description\";s:18:\"New Zealand Dollar\";s:4:\"flag\";s:88:\"https://www.xxxxxxx.com/wp-content/plugins/woocommerce-currency-switcher/img/no_flag.png\";}s:3:\"GBP\";a:8:{s:4:\"name\";s:3:\"GBP\";s:4:\"rate\";d:0.502499999999999946709294817992486059665679931640625;s:6:\"symbol\";s:7:\"&pound;\";s:8:\"position\";s:4:\"left\";s:9:\"is_etalon\";i:0;s:10:\"hide_cents\";i:0;s:11:\"description\";s:13:\"British Pound\";s:4:\"flag\";s:88:\"https://www.xxxxxxx.com/wp-content/plugins/woocommerce-currency-switcher/img/no_flag.png\";}}", return_value=0x7fb2ac2138c0) at ./ext/standard/var.c:1406
#13 php_unserialize_with_options (return_value=0x7fb2ac2138c0, 
    buf=0x7fb2a6e89718 "a:5:{s:3:\"AUD\";a:8:{s:4:\"name\";s:3:\"AUD\";s:4:\"rate\";d:1;s:6:\"symbol\";s:3:\"AU$\";s:8:\"position\";s:4:\"left\";s:9:\"is_etalon\";i:1;s:10:\"hide_cents\";i:0;s:11:\"description\";s:17:\"Australian Dollar\";s:4:\"flag\";s:88:\"https://www.xxxxxxx.com/wp-content/plugins/woocommerce-currency-switcher/img/no_flag.png\";}s:3:\"USD\";a:8:{s:4:\"name\";s:3:\"USD\";s:4:\"rate\";d:0.71679999999999999271693695845897309482097625732421875;s:6:\"symbol\";s:3:\"US$\";s:8:\"position\";s:4:\"left\";s:9:\"is_etalon\";i:0;s:10:\"hide_cents\";i:0;s:11:\"description\";s:9:\"US Dollar\";s:4:\"flag\";s:88:\"https://www.xxxxxxx.com/wp-content/plugins/woocommerce-currency-switcher/img/no_flag.png\";}s:3:\"EUR\";a:8:{s:4:\"name\";s:3:\"EUR\";s:4:\"rate\";d:0.6449000000000000287769807982840575277805328369140625;s:6:\"symbol\";s:6:\"&euro;\";s:8:\"position\";s:10:\"left_space\";s:9:\"is_etalon\";i:0;s:10:\"hide_cents\";i:0;s:11:\"description\";s:4:\"Euro\";s:4:\"flag\";s:88:\"https://www.xxxxxxx.com/wp-content/plugins/woocommerce-currency-switcher/img/no_flag.png\";}s:3:\"NZD\";a:8:{s:4:\"name\";s:3:\"NZD\";s:4:\"rate\";d:1.07660000000000000142108547152020037174224853515625;s:6:\"symbol\";s:3:\"NZ$\";s:8:\"position\";s:4:\"left\";s:9:\"is_etalon\";i:0;s:10:\"hide_cents\";i:0;s:11:\"description\";s:18:\"New Zealand Dollar\";s:4:\"flag\";s:88:\"https://www.xxxxxxx.com/wp-content/plugins/woocommerce-currency-switcher/img/no_flag.png\";}s:3:\"GBP\";a:8:{s:4:\"name\";s:3:\"GBP\";s:4:\"rate\";d:0.502499999999999946709294817992486059665679931640625;s:6:\"symbol\";s:7:\"&pound;\";s:8:\"position\";s:4:\"left\";s:9:\"is_etalon\";i:0;s:10:\"hide_cents\";i:0;s:11:\"description\";s:13:\"British Pound\";s:4:\"flag\";s:88:\"https://www.xxxxxxx.com/wp-content/plugins/woocommerce-currency-switcher/img/no_flag.png\";}}", buf_len=1674, options=<optimized out>, function_name=0x556923db086e "unserialize")
    at ./ext/standard/var.c:1334
#14 0x0000556930e24644 in ?? ()
#15 0x0000000000000001 in ?? ()
#16 0x0000000000000003 in ?? ()
#17 0x00000004ac200040 in ?? ()
#18 0x00007fff469fb4f0 in ?? ()
#19 0x0000000000000001 in ?? ()
#20 0x0000000000000001 in ?? ()
#21 0x00007fb2a6e45480 in ?? ()
#22 0x0000556900000003 in ?? ()
#23 0x0000000000000002 in ?? ()
#24 0x0000000000000001 in ?? ()
#25 0x0000556925ed44c0 in ?? ()
#26 0x0000000000000001 in ?? ()
#27 0x0000556925ed44c0 in ?? ()
#28 0x3743e960f3c58a00 in ?? ()
#29 0x00007fff469fb870 in ?? ()
#30 0x00007fb2ac277000 in ?? ()
#31 0x00007fb2ac213020 in ?? ()
#32 0x0000556923f3f500 in ?? ()
#33 0x0000000000000000 in ?? ()

And the PHP modules loaded

[PHP Modules]
calendar
cgi-fcgi
Core
ctype
curl
date
dom
exif
FFI
fileinfo
filter
ftp
gd
gettext
gmp
hash
iconv
igbinary
json
libxml
mbstring
memcache
memcached
msgpack
mysqli
mysqlnd
openssl
pcre
PDO
pdo_mysql
pdo_sqlite
Phar
posix
random
readline
Reflection
session
shmop
SimpleXML
sockets
sodium
SPL
sqlite3
standard
sysvmsg
sysvsem
sysvshm
tidy
tokenizer
xml
xmlreader
xmlrpc
xmlwriter
xsl
Zend OPcache
zip
zlib

[Zend Modules]
Zend OPcache

Setting USE_ZEND_ALLOC=0 does not change this behaviour at all. I had set the environment variable improperly, re-testing to see if this prevents the fault.

Edit: USE_ZEND_ALLOC=0 completely eliminates the issue.

PHP Version

8.2.10

Operating System

Debian 11.7

从报告的、经过 ext/standard/var_unserializer.c 和 Zend/zend_alloc.c 的调用路径开始，使用提供的 unserialize 输入和回溯信息。确定崩溃是否可以独立于 WordPress 插件复现，以及 USE_ZEND_ALLOC 是否会改变结果；完成这项工作需要一个最小复现程序，以及已确认的修复方案或根本原因。