Skip to content

Fix double free - #17

Open
remicollet wants to merge 1 commit into
codemasher:mainfrom
remicollet:issue-php86beta3
Open

remicollet wants to merge 1 commit into
codemasher:mainfrom
remicollet:issue-php86beta3

Conversation

@remicollet

Copy link
Copy Markdown

GDB backtrace using PHP 8.6.0beta3

(gdb) bt
#0  0x00007ffff6c81a2c in __pthread_kill_implementation () from /lib64/libc.so.6
#1  0x00007ffff6c27bde in raise () from /lib64/libc.so.6
#2  0x00007ffff6c0f6d0 in abort () from /lib64/libc.so.6
#3  0x0000555555432a18 in zend_mm_panic (message=message@entry=0x555555a9adf0 "zend_mm_heap corrupted (double free)")
    at /usr/src/debug/php86-php-8.6.0~beta3-1.fc43.remi.x86_64/Zend/zend_alloc.c:392
#4  0x000055555543320a in zend_mm_free_small (heap=<optimized out>, ptr=<optimized out>, bin_num=<optimized out>)
    at /usr/src/debug/php86-php-8.6.0~beta3-1.fc43.remi.x86_64/Zend/zend_alloc.c:1502
#5  zend_mm_free_heap (heap=<optimized out>, ptr=<optimized out>) at /usr/src/debug/php86-php-8.6.0~beta3-1.fc43.remi.x86_64/Zend/zend_alloc.c:1601
#6  _efree (ptr=<optimized out>) at /usr/src/debug/php86-php-8.6.0~beta3-1.fc43.remi.x86_64/Zend/zend_alloc.c:2892
#7  0x00007ffff7faeeea in php_xziop_close (stream=<optimized out>, close_handle=1) at /work/GIT/pecl-and-ext/xz-codemasher/xz_fopen_wrapper.c:321
#8  0x00005555557a1661 in php_stream_free (stream=<optimized out>, close_options=3) at /usr/src/debug/php86-php-8.6.0~beta3-1.fc43.remi.x86_64/main/streams/streams.c:367
#9  0x00007ffff7faf21a in php_stream_xzopen (wrapper=wrapper@entry=0x0, path=<optimized out>, mode_pass=mode_pass@entry=0x7ffff6a01af0 "a:5", options=options@entry=0, 
    opened_path=opened_path@entry=0x0, context=context@entry=0x0) at /work/GIT/pecl-and-ext/xz-codemasher/xz_fopen_wrapper.c:440
#10 0x00007ffff7faf4f3 in zif_xzopen (execute_data=<optimized out>, return_value=0x7ffff6a15070) at /work/GIT/pecl-and-ext/xz-codemasher/xz.c:111
#11 0x00005555558992f6 in ZEND_DO_ICALL_SPEC_RETVAL_USED_HANDLER () at /usr/src/debug/php86-php-8.6.0~beta3-1.fc43.remi.x86_64/Zend/zend_vm_execute.h:1393
#12 execute_ex (ex=0x12c494) at /usr/src/debug/php86-php-8.6.0~beta3-1.fc43.remi.x86_64/Zend/zend_vm_execute.h:110775
#13 0x00005555558947ae in zend_execute (op_array=0x7ffff6a94400, return_value=<optimized out>) at /usr/src/debug/php86-php-8.6.0~beta3-1.fc43.remi.x86_64/Zend/zend_vm_execute.h:115989
#14 0x0000555555908dc6 in zend_execute_script (type=type@entry=8, retval=0x7ffff6a15020, retval@entry=0x0, file_handle=file_handle@entry=0x7fffffffb960)
    at /usr/src/debug/php86-php-8.6.0~beta3-1.fc43.remi.x86_64/Zend/zend.c:1977
#15 0x000055555577ffb8 in php_execute_script_ex (primary_file=<optimized out>, retval=retval@entry=0x0) at /usr/src/debug/php86-php-8.6.0~beta3-1.fc43.remi.x86_64/main/main.c:2589
#16 0x000055555578026b in php_execute_script (primary_file=<optimized out>) at /usr/src/debug/php86-php-8.6.0~beta3-1.fc43.remi.x86_64/main/main.c:2629
#17 0x000055555590b0bf in do_cli (argc=argc@entry=94, argv=argv@entry=0x555555e283c0) at /usr/src/debug/php86-php-8.6.0~beta3-1.fc43.remi.x86_64/sapi/cli/php_cli.c:933
#18 0x000055555590b86a in do_php_cli (argc=94, argv=0x555555e283c0) at /usr/src/debug/php86-php-8.6.0~beta3-1.fc43.remi.x86_64/sapi/cli/php_cli.c:1346
#19 0x00007ffff6c115b5 in __libc_start_call_main () from /lib64/libc.so.6
#20 0x00007ffff6c11668 in __libc_start_main_impl () from /lib64/libc.so.6
#21 0x000055555545e965 in _start ()

  • self is freed in php_xziop_close
  • buffers are allocated only if php_xz_init_encoder/php_xz_init_decoder is called

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant