memory leak zend_language_scanner zend_language_parser

Description

The following code:

<?php
try {
function main() {
for ($i = 0; $i < 10000; $i++) {
$code .= '  return function() {' . PHP_EOL;
}
try {
eval($code);
} catch (ParseError $e) {
main();
}
}
main();
} catch (\Throwable $_ffl_e) {}

Resulted in this output:

=================================================================
==3757835==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 100007 byte(s) in 1 object(s) allocated from:
    #0 0x6807ad in malloc (/home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/sapi/cli/php+0x6807ad)
    #1 0x6301ff9 in zendparse /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/Zend/zend_language_parser.c:5488:11
    #2 0x6368092 in zend_compile /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/Zend/zend_language_scanner.l:602:7
    #3 0x637087d in compile_string /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/Zend/zend_language_scanner.l:829:13
    #4 0x606a21d in zend_include_or_eval /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/Zend/zend_execute.c:5379:20
    #5 0x5c8166c in ZEND_INCLUDE_OR_EVAL_SPEC_CV_HANDLER /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/Zend/zend_vm_execute.h:40195:17
    #6 0x59bbfcb in execute_ex /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/Zend/zend_vm_execute.h:110228:12
    #7 0x59be4f3 in zend_execute /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/Zend/zend_vm_execute.h:115646:2
    #8 0x66b1389 in zend_execute_script /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/Zend/zend.c:1972:3
    #9 0x4f0ce8a in php_execute_script_ex /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/main/main.c:2655:13
    #10 0x4f0e3c8 in php_execute_script /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/main/main.c:2695:9
    #11 0x66c5359 in do_cli /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/sapi/cli/php_cli.c:947:5
    #12 0x66bf82f in main /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/sapi/cli/php_cli.c:1370:18
    #13 0x7fa3138f7d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16

SUMMARY: AddressSanitizer: 100007 byte(s) leaked in 1 allocation(s).

To reproduce:

/home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/sapi/cli/php  ./test.php

Commit:

fd8eaaf153f958c66068e3bc71b950ee33cb56e8

Configurations:

CC="clang-12" CXX="clang++-12" CFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" CXXFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" ./configure --enable-debug --enable-address-sanitizer --enable-undefined-sanitizer --enable-re2c-cgoto --enable-fpm --enable-litespeed --enable-phpdbg-debug --enable-zts --enable-bcmath --enable-calendar --enable-dba --enable-dl-test --enable-exif --enable-ftp --enable-gd --enable-gd-jis-conv --enable-mbstring --enable-pcntl --enable-shmop --enable-soap --enable-sockets --enable-sysvmsg --enable-zend-test --with-zlib --with-bz2 --with-curl --with-enchant --with-gettext --with-gmp --with-mhash --with-ldap --with-libedit --with-readline --with-snmp --with-sodium --with-xsl --with-zip --with-mysqli --with-pdo-mysql --with-pdo-pgsql --with-pgsql --with-sqlite3 --with-pdo-sqlite --with-webp --with-jpeg --with-freetype --enable-sigchild --with-readline --with-pcre-jit --with-iconv

Operating System:

Ubuntu 20.04 Host, Docker 0599jiangyc/flowfusion:latest

This bug was found by fusion-fuzz

PHP Version

nightly

Operating System

No response

使用文档中说明的 sanitizer 配置运行提供的 test.php 复现程序，并确认泄漏。首先检查 Zend/zend_language_parser.c 中的 zendparse，然后跟踪 Zend/zend_language_scanner.l 中的 compile_string 路径。当复现程序在 LeakSanitizer 下不再报告分配泄漏时，即表示完成。