Segmentation fault in Zend/zend_execute.c:4624

Description

The following code:

<?php
require 'filter_errors.inc';
class test_filter4 extends php_user_filter {
function filter($in, $out, &$consumed, $closing): int {
if (!$fusion) {
$bucket = stream_bucket_new($this->stream, "42");
}
return PSFS_ERR_FATAL;
}
}
for($i = 0; $i < 5; ++$i) {
var_dump(stream_filter_register("test_filter$i", "test_filter$i"));
filter_errors_test("test_filter$i", "42");
}

Resulted in this output:

/php-src/Zend/zend_execute.c:4624:8: runtime error: member access within misaligned address 0x000000000004 for type 'zend_execute_data' (aka 'struct _zend_execute_data'), which requires 8 byte alignment
0x000000000004: note: pointer points here
<memory cannot be printed>
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /php-src/Zend/zend_execute.c:4624:8

To reproduce:

-d "opcache.jit_hot_func=1" -d "opcache.jit_hot_return=1" -d "zend_extension=/php-src/modules/opcache.so" -d "opcache.enable_cli=1" -d "opcache.jit=0151"

PHP Version

PHP 8.4.0-dev

Operating System

ubuntu 22.04

Inizia eseguendo il reproducer PHP fornito su PHP 8.4.0-dev con le impostazioni opcache JIT e l’output UBSan elencati. Ispeziona Zend/zend_execute.c intorno alla riga 4624 e l’interazione con php_user_filter e stream_bucket_new; il lavoro è concluso quando il reproducer non segnala più l’accesso non allineato a zend_execute_data.