segmentation faul in zend_types.h

[chongwick]

Description

The following code:

<?php
$v_83266 = var_dump($v_83265,);
$v_83273 = 'https://�~_~P~X.com/�~_~P~X?�~_~P~X=�~_~P~X';
$v_83295 = PHP_EOL;
$v_83272 = var_dump($v_83295,);
$v_83267 = array();
$v_83270 = Uri\WhatWg\Url::parse($v_83273,$v_83272,$v_83267,);

Resulted in this output:

Warning: Undefined variable $v_83265 in /home/w023dtc/treebugs/72cb53f7e166f2e0fe87.php.er on line 2
NULL
string(1) "
"
AddressSanitizer:DEADLYSIGNAL
=================================================================
==2389692==ERROR: AddressSanitizer: SEGV on unknown address 0x0000082d3c60 (pc 0x0000069860ea bp 0x7fffbab8c1e0 sp 0x7fffbab8c1b0 T0)
==2389692==The signal is caused by a WRITE memory access.
    #0 0x69860ea in zend_gc_delref /home/w023dtc/nightly_php/php-src/Zend/zend_types.h:1385:9
    #1 0x6985bdc in i_zval_ptr_dtor /home/w023dtc/nightly_php/php-src/Zend/zend_variables.h:44:8
    #2 0x698983f in zend_reference_destroy /home/w023dtc/nightly_php/php-src/Zend/zend_variables.c:74:2
    #3 0x6985967 in rc_dtor_func /home/w023dtc/nightly_php/php-src/Zend/zend_variables.c:57:2
    #4 0x6985bee in i_zval_ptr_dtor /home/w023dtc/nightly_php/php-src/Zend/zend_variables.h:45:4
    #5 0x69859a4 in zval_ptr_dtor /home/w023dtc/nightly_php/php-src/Zend/zend_variables.c:84:2
    #6 0x64a6e81 in _zend_hash_del_el_ex /home/w023dtc/nightly_php/php-src/Zend/zend_hash.c:1493:3
    #7 0x64a45fd in _zend_hash_del_el /home/w023dtc/nightly_php/php-src/Zend/zend_hash.c:1520:2
    #8 0x64b9996 in zend_hash_graceful_reverse_destroy /home/w023dtc/nightly_php/php-src/Zend/zend_hash.c:2045:4
    #9 0x5bca1b2 in zend_shutdown_executor_values /home/w023dtc/nightly_php/php-src/Zend/zend_execute_API.c:285:3
    #10 0x5bd689e in shutdown_executor /home/w023dtc/nightly_php/php-src/Zend/zend_execute_API.c:455:2
    #11 0x69ce69b in zend_deactivate /home/w023dtc/nightly_php/php-src/Zend/zend.c:1351:2
    #12 0x51ae0a5 in php_request_shutdown /home/w023dtc/nightly_php/php-src/main/main.c:2018:2
    #13 0x69fb4a1 in do_cli /home/w023dtc/nightly_php/php-src/sapi/cli/php_cli.c:1158:3
    #14 0x69f047f in main /home/w023dtc/nightly_php/php-src/sapi/cli/php_cli.c:1362:18
    #15 0x14a76e1f6d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #16 0x14a76e1f6e3f in __libc_start_main csu/../csu/libc-start.c:392:3
    #17 0x607ae4 in _start (/home/w023dtc/nightly_php/php-src/sapi/cli/php+0x607ae4)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/w023dtc/nightly_php/php-src/Zend/zend_types.h:1385:9 in zend_gc_delref
==2389692==ABORTING

PHP Version

nightly

Operating System

ubuntu 22.04

[iluuu1994]

Simpler reproducer:

Uri\WhatWg\Url::parse('https://example.com', errors: $errors);
var_dump($errors);

ZEND_TRY_ASSIGN_REF_ARR() does not work with immutable arrays (the empty array in this case). An easy fix:

diff --git a/ext/uri/php_uri.c b/ext/uri/php_uri.c
index 9967833ebaa..504e6353b3e 100644
--- a/ext/uri/php_uri.c
+++ b/ext/uri/php_uri.c
@@ -308,6 +308,10 @@ static zend_result pass_errors_by_ref_and_free(zval *errors_zv, zval *errors)
 		return SUCCESS;
 	}
 
+	if (GC_FLAGS(Z_ARRVAL_P(errors)) & GC_IMMUTABLE) {
+		Z_ARRVAL_P(errors) = zend_array_dup(Z_ARRVAL_P(errors));
+	}
+
 	ZEND_TRY_ASSIGN_REF_ARR(errors_zv, Z_ARRVAL_P(errors));
 	if (EG(exception)) {
 		return FAILURE;

Or:

diff --git a/ext/uri/uri_parser_whatwg.c b/ext/uri/uri_parser_whatwg.c
index 99adaabc5b3..3afddca00b1 100644
--- a/ext/uri/uri_parser_whatwg.c
+++ b/ext/uri/uri_parser_whatwg.c
@@ -63,7 +63,7 @@ static zend_always_inline void zval_long_or_null_to_lexbor_str(zval *value, lexb
 static const char *fill_errors(zval *errors)
 {
 	if (lexbor_parser.log == NULL || lexbor_plog_length(lexbor_parser.log) == 0) {
-		ZVAL_EMPTY_ARRAY(errors);
+		ZVAL_ARR(errors, zend_new_array(0));
 		return NULL;
 	}

[nielsdos]

Or better yet: use the empty array but reset the type flags/info (I always have to double check which one of the two)

[devnexen]

the array copy sounds safer to me in another hand but yes otherwise.

[iluuu1994]

Or better yet: use the empty array but reset the type flags/info (I always have to double check which one of the two)

I think this may break when the reference has has type sources, because zend_try_assign_typed_ref_ex() does some refcounting operations. It's called by zend_try_assign_typed_ref_arr() with a temporary zval initialized with ZVAL_ARR(), i.e. with the wrong zval type flags. It could be adjusted in zend_try_assign_typed_ref_arr() but it's called from quite a few other places where this check isn't necessary.

That said, honestly I'd prefer just moving this check to ZVAL_ARR() by default as we do for ZVAL_STR() and then use more specialized macros where appropriate, given this is easy to miss.