memory leak when `-d assert.callback=f1 -d opcache.enable_cli=1 -d opcache.preload=nonexist.inc`

Description

The following code:

Resulted in this output:

=================================================================
==3696739==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 3 byte(s) in 1 object(s) allocated from:
    #0 0x6807ad in malloc (/home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/sapi/cli/php+0x6807ad)
    #1 0x55a9743 in __zend_malloc /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/Zend/zend_alloc.c:3543:14
    #2 0x3f19ba4 in OnChangeCallback /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/ext/standard/assert.c:67:18
    #3 0x62da745 in zend_register_ini_entries_ex /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/Zend/zend_ini.c:254:25
    #4 0x3f0b8b4 in zm_startup_assert /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/ext/standard/assert.c:139:2
    #5 0x3f3cb0b in zm_startup_basic /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/ext/standard/basic_functions.c:332:2
    #6 0x560091a in zend_startup_module_ex /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/Zend/zend_API.c:2437:7
    #7 0x5605d5e in zend_startup_module_zval /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/Zend/zend_API.c:2450:10
    #8 0x6191053 in zend_hash_apply /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/Zend/zend_hash.c:2100:13
    #9 0x5604f8b in zend_startup_modules /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/Zend/zend_API.c:2573:2
    #10 0x4efd957 in php_module_startup /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/main/main.c:2367:2
    #11 0x66cb038 in php_cli_startup /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/sapi/cli/php_cli.c:393:9
    #12 0x66bf049 in main /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/sapi/cli/php_cli.c:1337:6
    #13 0x7f5ba04cad8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16

SUMMARY: AddressSanitizer: 3 byte(s) leaked in 1 allocation(s).

To reproduce:

/home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/sapi/cli/php -d assert.callback=f1 -d opcache.enable_cli=1 -d opcache.preload=nonexist.inc ./test.php

Commit:

fd8eaaf153f958c66068e3bc71b950ee33cb56e8

Configurations:

CC="clang-12" CXX="clang++-12" CFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" CXXFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" ./configure --enable-debug --enable-address-sanitizer --enable-undefined-sanitizer --enable-re2c-cgoto --enable-fpm --enable-litespeed --enable-phpdbg-debug --enable-zts --enable-bcmath --enable-calendar --enable-dba --enable-dl-test --enable-exif --enable-ftp --enable-gd --enable-gd-jis-conv --enable-mbstring --enable-pcntl --enable-shmop --enable-soap --enable-sockets --enable-sysvmsg --enable-zend-test --with-zlib --with-bz2 --with-curl --with-enchant --with-gettext --with-gmp --with-mhash --with-ldap --with-libedit --with-readline --with-snmp --with-sodium --with-xsl --with-zip --with-mysqli --with-pdo-mysql --with-pdo-pgsql --with-pgsql --with-sqlite3 --with-pdo-sqlite --with-webp --with-jpeg --with-freetype --enable-sigchild --with-readline --with-pcre-jit --with-iconv

Operating System:

Ubuntu 20.04 Host, Docker 0599jiangyc/flowfusion:latest

This bug was found by fusion-fuzz

PHP Version

nightly

Operating System

No response

Esegui il comando CLI fornito sotto AddressSanitizer, quindi esamina OnChangeCallback in ext/standard/assert.c e il percorso di registrazione in Zend/zend_ini.c. Traccia l’allocazione di assert.callback durante l’avvio con opcache preload abilitato; il lavoro è completato quando il reproducer termina senza il leak segnalato.