php / php/php-src

Segmentation fault in Zend/zend_execute.c:4624

Open
#16,321 2 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Bug Category: Streams Status: Verified
Dominant language
C
Stars
40.4k
Forks
8.1k
Avg merge
2d 13h
Merged PRs (30d)
96

Description

Description

The following code:

<?php
require 'filter_errors.inc';
class test_filter4 extends php_user_filter {
function filter($in, $out, &$consumed, $closing): int {
if (!$fusion) {
$bucket = stream_bucket_new($this->stream, "42");
}
return PSFS_ERR_FATAL;
}
}
for($i = 0; $i < 5; ++$i) {
var_dump(stream_filter_register("test_filter$i", "test_filter$i"));
filter_errors_test("test_filter$i", "42");
}

Resulted in this output:

/php-src/Zend/zend_execute.c:4624:8: runtime error: member access within misaligned address 0x000000000004 for type 'zend_execute_data' (aka 'struct _zend_execute_data'), which requires 8 byte alignment
0x000000000004: note: pointer points here
<memory cannot be printed>
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /php-src/Zend/zend_execute.c:4624:8

To reproduce:

-d "opcache.jit_hot_func=1" -d "opcache.jit_hot_return=1" -d "zend_extension=/php-src/modules/opcache.so" -d "opcache.enable_cli=1" -d "opcache.jit=0151"
PHP Version

PHP 8.4.0-dev

Operating System

ubuntu 22.04

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by running the provided PHP reproducer on PHP 8.4.0-dev with the listed opcache JIT settings and UBSan output. Inspect Zend/zend_execute.c around line 4624 and the interaction with php_user_filter and stream_bucket_new; done means the reproducer no longer reports the misaligned zend_execute_data access.

Written by the indexing model from the issue text.

Assessment

Tech stack
c, php
Domain
backend, compilers
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.