Skip to content

Fix #81429: SplFixedArray::setSize(0) called during offsetSet() #7486

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
wants to merge 1 commit into from
Closed

Fix #81429: SplFixedArray::setSize(0) called during offsetSet() #7486

wants to merge 1 commit into from

Conversation

huanghantao
Copy link
Contributor

No description provided.

@cmb69
Copy link
Member

cmb69 commented Sep 11, 2021

Thank you! @TysonAndre, what do you think?

TysonAndre
TysonAndre reviewed Sep 11, 2021
View reviewed changes
ext/spl/spl_fixedarray.c
@@ -415,6 +415,11 @@ static void spl_fixedarray_object_write_dimension_helper(spl_fixedarray_object *
return;
} else {
zval_ptr_dtor(&(intern->array.elements[index]));
// Elements may be released by the destructor
if (!intern->array.elements) {
Copy link
Contributor

@TysonAndre TysonAndre Sep 11, 2021 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This won't solve the general case. The array can be reallocated to a different pointer whether it's shrinking or expanding the size (e.g. if realloc can't extend the array)

<?php
class HasDestructor {
    public function __destruct() {
        $GLOBALS['values']->setSize(1);
    }
}
$values = new SplFixedArray(1000);
$values[999] = new HasDestructor();
$values->setSize(1);

USE_ZEND_ALLOC=0 valgrind sapi/cli/php test.php

==3393== Memcheck, a memory error detector
==3393== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==3393== Using Valgrind-3.15.0 and LibVEX; rerun with -h for copyright info
==3393== Command: sapi/cli/php test.php
==3393==
==3393== Invalid read of size 4
==3393==    at 0x7BA60D: zend_gc_delref (zend_types.h:1183)
==3393==    by 0x7BAC3D: zend_objects_store_del (zend_objects_API.c:185)
==3393==    by 0x6CC5AF: rc_dtor_func (zend_variables.c:57)
==3393==    by 0x6CC52E: i_zval_ptr_dtor (zend_variables.h:44)
==3393==    by 0x6CC752: zval_ptr_dtor (zend_variables.c:84)
==3393==    by 0x50765C: spl_fixedarray_dtor_range (spl_fixedarray.c:151)
==3393==    by 0x5077C2: spl_fixedarray_resize (spl_fixedarray.c:188)
==3393==    by 0x509219: zim_SplFixedArray_setSize (spl_fixedarray.c:681)
==3393==    by 0x70D80D: ZEND_DO_FCALL_SPEC_RETVAL_UNUSED_HANDLER (zend_vm_execute.h:1761)
==3393==    by 0x77F3F6: execute_ex (zend_vm_execute.h:54620)
==3393==    by 0x784B96: zend_execute (zend_vm_execute.h:58951)
==3393==    by 0x6D0C66: zend_execute_scripts (zend.c:1761)
==3393==  Address 0x5258090 is 0 bytes inside a block of size 40 free'd
==3393==    at 0x483CA3F: free (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
==3393==    by 0x692357: _efree_custom (zend_alloc.c:2428)
==3393==    by 0x6924AE: _efree (zend_alloc.c:2548)
==3393==    by 0x7BAD9C: zend_objects_store_del (zend_objects_API.c:204)
==3393==    by 0x7B2FC1: zend_object_release (zend_objects_API.h:75)
==3393==    by 0x7B375D: zend_objects_destroy_object (zend_objects.c:180)
==3393==    by 0x7BAC31: zend_objects_store_del (zend_objects_API.c:184)
==3393==    by 0x6CC5AF: rc_dtor_func (zend_variables.c:57)
==3393==    by 0x6CC52E: i_zval_ptr_dtor (zend_variables.h:44)
==3393==    by 0x6CC752: zval_ptr_dtor (zend_variables.c:84)
==3393==    by 0x50765C: spl_fixedarray_dtor_range (spl_fixedarray.c:151)
==3393==    by 0x5077C2: spl_fixedarray_resize (spl_fixedarray.c:188)
==3393==  Block was alloc'd at
==3393==    at 0x483B7F3: malloc (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
==3393==    by 0x693676: __zend_malloc (zend_alloc.c:3043)
==3393==    by 0x6922E6: _malloc_custom (zend_alloc.c:2419)
==3393==    by 0x692430: _emalloc (zend_alloc.c:2538)
==3393==    by 0x7B379E: zend_objects_new (zend_objects.c:186)
==3393==    by 0x6D819D: _object_and_properties_init (zend_API.c:1642)
==3393==    by 0x6D8282: object_init_ex (zend_API.c:1665)
==3393==    by 0x7211C3: ZEND_NEW_SPEC_CONST_UNUSED_HANDLER (zend_vm_execute.h:10148)
==3393==    by 0x7807B1: execute_ex (zend_vm_execute.h:55495)
==3393==    by 0x784B96: zend_execute (zend_vm_execute.h:58951)
==3393==    by 0x6D0C66: zend_execute_scripts (zend.c:1761)
==3393==    by 0x62E486: php_execute_script (main.c:2519)
==3393==
==3393== Invalid read of size 4
==3393==    at 0x7BA636: zend_gc_delref (zend_types.h:1185)
==3393==    by 0x7BAC3D: zend_objects_store_del (zend_objects_API.c:185)
==3393==    by 0x6CC5AF: rc_dtor_func (zend_variables.c:57)
==3393==    by 0x6CC52E: i_zval_ptr_dtor (zend_variables.h:44)
==3393==    by 0x6CC752: zval_ptr_dtor (zend_variables.c:84)
==3393==    by 0x50765C: spl_fixedarray_dtor_range (spl_fixedarray.c:151)
==3393==    by 0x5077C2: spl_fixedarray_resize (spl_fixedarray.c:188)
==3393==    by 0x509219: zim_SplFixedArray_setSize (spl_fixedarray.c:681)
==3393==    by 0x70D80D: ZEND_DO_FCALL_SPEC_RETVAL_UNUSED_HANDLER (zend_vm_execute.h:1761)
==3393==    by 0x77F3F6: execute_ex (zend_vm_execute.h:54620)
==3393==    by 0x784B96: zend_execute (zend_vm_execute.h:58951)
==3393==    by 0x6D0C66: zend_execute_scripts (zend.c:1761)
==3393==  Address 0x5258090 is 0 bytes inside a block of size 40 free'd
==3393==    at 0x483CA3F: free (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
==3393==    by 0x692357: _efree_custom (zend_alloc.c:2428)
==3393==    by 0x6924AE: _efree (zend_alloc.c:2548)
==3393==    by 0x7BAD9C: zend_objects_store_del (zend_objects_API.c:204)
==3393==    by 0x7B2FC1: zend_object_release (zend_objects_API.h:75)
==3393==    by 0x7B375D: zend_objects_destroy_object (zend_objects.c:180)
==3393==    by 0x7BAC31: zend_objects_store_del (zend_objects_API.c:184)
==3393==    by 0x6CC5AF: rc_dtor_func (zend_variables.c:57)
==3393==    by 0x6CC52E: i_zval_ptr_dtor (zend_variables.h:44)
==3393==    by 0x6CC752: zval_ptr_dtor (zend_variables.c:84)
==3393==    by 0x50765C: spl_fixedarray_dtor_range (spl_fixedarray.c:151)
==3393==    by 0x5077C2: spl_fixedarray_resize (spl_fixedarray.c:188)
==3393==  Block was alloc'd at
==3393==    at 0x483B7F3: malloc (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
==3393==    by 0x693676: __zend_malloc (zend_alloc.c:3043)
==3393==    by 0x6922E6: _malloc_custom (zend_alloc.c:2419)
==3393==    by 0x692430: _emalloc (zend_alloc.c:2538)
==3393==    by 0x7B379E: zend_objects_new (zend_objects.c:186)
==3393==    by 0x6D819D: _object_and_properties_init (zend_API.c:1642)
==3393==    by 0x6D8282: object_init_ex (zend_API.c:1665)
==3393==    by 0x7211C3: ZEND_NEW_SPEC_CONST_UNUSED_HANDLER (zend_vm_execute.h:10148)
==3393==    by 0x7807B1: execute_ex (zend_vm_execute.h:55495)
==3393==    by 0x784B96: zend_execute (zend_vm_execute.h:58951)
==3393==    by 0x6D0C66: zend_execute_scripts (zend.c:1761)
==3393==    by 0x62E486: php_execute_script (main.c:2519)
==3393==
==3393== Invalid write of size 4
==3393==    at 0x7BA63F: zend_gc_delref (zend_types.h:1185)
==3393==    by 0x7BAC3D: zend_objects_store_del (zend_objects_API.c:185)
==3393==    by 0x6CC5AF: rc_dtor_func (zend_variables.c:57)
==3393==    by 0x6CC52E: i_zval_ptr_dtor (zend_variables.h:44)
==3393==    by 0x6CC752: zval_ptr_dtor (zend_variables.c:84)
==3393==    by 0x50765C: spl_fixedarray_dtor_range (spl_fixedarray.c:151)
==3393==    by 0x5077C2: spl_fixedarray_resize (spl_fixedarray.c:188)
==3393==    by 0x509219: zim_SplFixedArray_setSize (spl_fixedarray.c:681)
==3393==    by 0x70D80D: ZEND_DO_FCALL_SPEC_RETVAL_UNUSED_HANDLER (zend_vm_execute.h:1761)
==3393==    by 0x77F3F6: execute_ex (zend_vm_execute.h:54620)
==3393==    by 0x784B96: zend_execute (zend_vm_execute.h:58951)
==3393==    by 0x6D0C66: zend_execute_scripts (zend.c:1761)
==3393==  Address 0x5258090 is 0 bytes inside a block of size 40 free'd
==3393==    at 0x483CA3F: free (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
==3393==    by 0x692357: _efree_custom (zend_alloc.c:2428)
==3393==    by 0x6924AE: _efree (zend_alloc.c:2548)
==3393==    by 0x7BAD9C: zend_objects_store_del (zend_objects_API.c:204)
==3393==    by 0x7B2FC1: zend_object_release (zend_objects_API.h:75)
==3393==    by 0x7B375D: zend_objects_destroy_object (zend_objects.c:180)
==3393==    by 0x7BAC31: zend_objects_store_del (zend_objects_API.c:184)
==3393==    by 0x6CC5AF: rc_dtor_func (zend_variables.c:57)
==3393==    by 0x6CC52E: i_zval_ptr_dtor (zend_variables.h:44)
==3393==    by 0x6CC752: zval_ptr_dtor (zend_variables.c:84)
==3393==    by 0x50765C: spl_fixedarray_dtor_range (spl_fixedarray.c:151)
==3393==    by 0x5077C2: spl_fixedarray_resize (spl_fixedarray.c:188)
==3393==  Block was alloc'd at
==3393==    at 0x483B7F3: malloc (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
==3393==    by 0x693676: __zend_malloc (zend_alloc.c:3043)
==3393==    by 0x6922E6: _malloc_custom (zend_alloc.c:2419)
==3393==    by 0x692430: _emalloc (zend_alloc.c:2538)
==3393==    by 0x7B379E: zend_objects_new (zend_objects.c:186)
==3393==    by 0x6D819D: _object_and_properties_init (zend_API.c:1642)
==3393==    by 0x6D8282: object_init_ex (zend_API.c:1665)
==3393==    by 0x7211C3: ZEND_NEW_SPEC_CONST_UNUSED_HANDLER (zend_vm_execute.h:10148)
==3393==    by 0x7807B1: execute_ex (zend_vm_execute.h:55495)
==3393==    by 0x784B96: zend_execute (zend_vm_execute.h:58951)
==3393==    by 0x6D0C66: zend_execute_scripts (zend.c:1761)
==3393==    by 0x62E486: php_execute_script (main.c:2519)
==3393==
==3393== Invalid read of size 4
==3393==    at 0x7BA645: zend_gc_delref (zend_types.h:1185)
==3393==    by 0x7BAC3D: zend_objects_store_del (zend_objects_API.c:185)
==3393==    by 0x6CC5AF: rc_dtor_func (zend_variables.c:57)
==3393==    by 0x6CC52E: i_zval_ptr_dtor (zend_variables.h:44)
==3393==    by 0x6CC752: zval_ptr_dtor (zend_variables.c:84)
==3393==    by 0x50765C: spl_fixedarray_dtor_range (spl_fixedarray.c:151)
==3393==    by 0x5077C2: spl_fixedarray_resize (spl_fixedarray.c:188)
==3393==    by 0x509219: zim_SplFixedArray_setSize (spl_fixedarray.c:681)
==3393==    by 0x70D80D: ZEND_DO_FCALL_SPEC_RETVAL_UNUSED_HANDLER (zend_vm_execute.h:1761)
==3393==    by 0x77F3F6: execute_ex (zend_vm_execute.h:54620)
==3393==    by 0x784B96: zend_execute (zend_vm_execute.h:58951)
==3393==    by 0x6D0C66: zend_execute_scripts (zend.c:1761)
==3393==  Address 0x5258090 is 0 bytes inside a block of size 40 free'd
==3393==    at 0x483CA3F: free (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
==3393==    by 0x692357: _efree_custom (zend_alloc.c:2428)
==3393==    by 0x6924AE: _efree (zend_alloc.c:2548)
==3393==    by 0x7BAD9C: zend_objects_store_del (zend_objects_API.c:204)
==3393==    by 0x7B2FC1: zend_object_release (zend_objects_API.h:75)
==3393==    by 0x7B375D: zend_objects_destroy_object (zend_objects.c:180)
==3393==    by 0x7BAC31: zend_objects_store_del (zend_objects_API.c:184)
==3393==    by 0x6CC5AF: rc_dtor_func (zend_variables.c:57)
==3393==    by 0x6CC52E: i_zval_ptr_dtor (zend_variables.h:44)
==3393==    by 0x6CC752: zval_ptr_dtor (zend_variables.c:84)
==3393==    by 0x50765C: spl_fixedarray_dtor_range (spl_fixedarray.c:151)
==3393==    by 0x5077C2: spl_fixedarray_resize (spl_fixedarray.c:188)
==3393==  Block was alloc'd at
==3393==    at 0x483B7F3: malloc (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
==3393==    by 0x693676: __zend_malloc (zend_alloc.c:3043)
==3393==    by 0x6922E6: _malloc_custom (zend_alloc.c:2419)
==3393==    by 0x692430: _emalloc (zend_alloc.c:2538)
==3393==    by 0x7B379E: zend_objects_new (zend_objects.c:186)
==3393==    by 0x6D819D: _object_and_properties_init (zend_API.c:1642)
==3393==    by 0x6D8282: object_init_ex (zend_API.c:1665)
==3393==    by 0x7211C3: ZEND_NEW_SPEC_CONST_UNUSED_HANDLER (zend_vm_execute.h:10148)
==3393==    by 0x7807B1: execute_ex (zend_vm_execute.h:55495)
==3393==    by 0x784B96: zend_execute (zend_vm_execute.h:58951)
==3393==    by 0x6D0C66: zend_execute_scripts (zend.c:1761)
==3393==    by 0x62E486: php_execute_script (main.c:2519)
==3393==
==3393== Invalid read of size 4
==3393==    at 0x7BA5BE: zend_gc_refcount (zend_types.h:1155)
==3393==    by 0x7BAC4E: zend_objects_store_del (zend_objects_API.c:190)
==3393==    by 0x6CC5AF: rc_dtor_func (zend_variables.c:57)
==3393==    by 0x6CC52E: i_zval_ptr_dtor (zend_variables.h:44)
==3393==    by 0x6CC752: zval_ptr_dtor (zend_variables.c:84)
==3393==    by 0x50765C: spl_fixedarray_dtor_range (spl_fixedarray.c:151)
==3393==    by 0x5077C2: spl_fixedarray_resize (spl_fixedarray.c:188)
==3393==    by 0x509219: zim_SplFixedArray_setSize (spl_fixedarray.c:681)
==3393==    by 0x70D80D: ZEND_DO_FCALL_SPEC_RETVAL_UNUSED_HANDLER (zend_vm_execute.h:1761)
==3393==    by 0x77F3F6: execute_ex (zend_vm_execute.h:54620)
==3393==    by 0x784B96: zend_execute (zend_vm_execute.h:58951)
==3393==    by 0x6D0C66: zend_execute_scripts (zend.c:1761)
==3393==  Address 0x5258090 is 0 bytes inside a block of size 40 free'd
==3393==    at 0x483CA3F: free (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
==3393==    by 0x692357: _efree_custom (zend_alloc.c:2428)
==3393==    by 0x6924AE: _efree (zend_alloc.c:2548)
==3393==    by 0x7BAD9C: zend_objects_store_del (zend_objects_API.c:204)
==3393==    by 0x7B2FC1: zend_object_release (zend_objects_API.h:75)
==3393==    by 0x7B375D: zend_objects_destroy_object (zend_objects.c:180)
==3393==    by 0x7BAC31: zend_objects_store_del (zend_objects_API.c:184)
==3393==    by 0x6CC5AF: rc_dtor_func (zend_variables.c:57)
==3393==    by 0x6CC52E: i_zval_ptr_dtor (zend_variables.h:44)
==3393==    by 0x6CC752: zval_ptr_dtor (zend_variables.c:84)
==3393==    by 0x50765C: spl_fixedarray_dtor_range (spl_fixedarray.c:151)
==3393==    by 0x5077C2: spl_fixedarray_resize (spl_fixedarray.c:188)
==3393==  Block was alloc'd at
==3393==    at 0x483B7F3: malloc (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
==3393==    by 0x693676: __zend_malloc (zend_alloc.c:3043)
==3393==    by 0x6922E6: _malloc_custom (zend_alloc.c:2419)
==3393==    by 0x692430: _emalloc (zend_alloc.c:2538)
==3393==    by 0x7B379E: zend_objects_new (zend_objects.c:186)
==3393==    by 0x6D819D: _object_and_properties_init (zend_API.c:1642)
==3393==    by 0x6D8282: object_init_ex (zend_API.c:1665)
==3393==    by 0x7211C3: ZEND_NEW_SPEC_CONST_UNUSED_HANDLER (zend_vm_execute.h:10148)
==3393==    by 0x7807B1: execute_ex (zend_vm_execute.h:55495)
==3393==    by 0x784B96: zend_execute (zend_vm_execute.h:58951)
==3393==    by 0x6D0C66: zend_execute_scripts (zend.c:1761)
==3393==    by 0x62E486: php_execute_script (main.c:2519)
==3393==
==3393== Invalid read of size 4
==3393==    at 0x7BAC5B: zend_objects_store_del (zend_objects_API.c:191)
==3393==    by 0x6CC5AF: rc_dtor_func (zend_variables.c:57)
==3393==    by 0x6CC52E: i_zval_ptr_dtor (zend_variables.h:44)
==3393==    by 0x6CC752: zval_ptr_dtor (zend_variables.c:84)
==3393==    by 0x50765C: spl_fixedarray_dtor_range (spl_fixedarray.c:151)
==3393==    by 0x5077C2: spl_fixedarray_resize (spl_fixedarray.c:188)
==3393==    by 0x509219: zim_SplFixedArray_setSize (spl_fixedarray.c:681)
==3393==    by 0x70D80D: ZEND_DO_FCALL_SPEC_RETVAL_UNUSED_HANDLER (zend_vm_execute.h:1761)
==3393==    by 0x77F3F6: execute_ex (zend_vm_execute.h:54620)
==3393==    by 0x784B96: zend_execute (zend_vm_execute.h:58951)
==3393==    by 0x6D0C66: zend_execute_scripts (zend.c:1761)
==3393==    by 0x62E486: php_execute_script (main.c:2519)
==3393==  Address 0x5258098 is 8 bytes inside a block of size 40 free'd
==3393==    at 0x483CA3F: free (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
==3393==    by 0x692357: _efree_custom (zend_alloc.c:2428)
==3393==    by 0x6924AE: _efree (zend_alloc.c:2548)
==3393==    by 0x7BAD9C: zend_objects_store_del (zend_objects_API.c:204)
==3393==    by 0x7B2FC1: zend_object_release (zend_objects_API.h:75)
==3393==    by 0x7B375D: zend_objects_destroy_object (zend_objects.c:180)
==3393==    by 0x7BAC31: zend_objects_store_del (zend_objects_API.c:184)
==3393==    by 0x6CC5AF: rc_dtor_func (zend_variables.c:57)
==3393==    by 0x6CC52E: i_zval_ptr_dtor (zend_variables.h:44)
==3393==    by 0x6CC752: zval_ptr_dtor (zend_variables.c:84)
==3393==    by 0x50765C: spl_fixedarray_dtor_range (spl_fixedarray.c:151)
==3393==    by 0x5077C2: spl_fixedarray_resize (spl_fixedarray.c:188)
==3393==  Block was alloc'd at
==3393==    at 0x483B7F3: malloc (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
==3393==    by 0x693676: __zend_malloc (zend_alloc.c:3043)
==3393==    by 0x6922E6: _malloc_custom (zend_alloc.c:2419)
==3393==    by 0x692430: _emalloc (zend_alloc.c:2538)
==3393==    by 0x7B379E: zend_objects_new (zend_objects.c:186)
==3393==    by 0x6D819D: _object_and_properties_init (zend_API.c:1642)
==3393==    by 0x6D8282: object_init_ex (zend_API.c:1665)
==3393==    by 0x7211C3: ZEND_NEW_SPEC_CONST_UNUSED_HANDLER (zend_vm_execute.h:10148)
==3393==    by 0x7807B1: execute_ex (zend_vm_execute.h:55495)
==3393==    by 0x784B96: zend_execute (zend_vm_execute.h:58951)
==3393==    by 0x6D0C66: zend_execute_scripts (zend.c:1761)
==3393==    by 0x62E486: php_execute_script (main.c:2519)
==3393==
php: /path/to/php-src/Zend/zend_objects_API.c:195: zend_objects_store_del: Assertion `(!(((zend_uintptr_t)((executor_globals.objects_store).object_buckets[handle])) & (1<<0)))' failed.
==3393==
==3393== Process terminating with default action of signal 6 (SIGABRT)
==3393==    at 0x4AC718B: raise (raise.c:51)
==3393==    by 0x4AA6858: abort (abort.c:79)
==3393==    by 0x4AA6728: __assert_fail_base.cold (assert.c:92)
==3393==    by 0x4AB7F35: __assert_fail (assert.c:101)
==3393==    by 0x7BACC6: zend_objects_store_del (zend_objects_API.c:195)
==3393==    by 0x6CC5AF: rc_dtor_func (zend_variables.c:57)
==3393==    by 0x6CC52E: i_zval_ptr_dtor (zend_variables.h:44)
==3393==    by 0x6CC752: zval_ptr_dtor (zend_variables.c:84)
==3393==    by 0x50765C: spl_fixedarray_dtor_range (spl_fixedarray.c:151)
==3393==    by 0x5077C2: spl_fixedarray_resize (spl_fixedarray.c:188)
==3393==    by 0x509219: zim_SplFixedArray_setSize (spl_fixedarray.c:681)
==3393==    by 0x70D80D: ZEND_DO_FCALL_SPEC_RETVAL_UNUSED_HANDLER (zend_vm_execute.h:1761)
==3393==
==3393== HEAP SUMMARY:
==3393==     in use at exit: 1,763,642 bytes in 10,331 blocks
==3393==   total heap usage: 11,050 allocs, 719 frees, 2,092,132 bytes allocated
==3393==
==3393== LEAK SUMMARY:
==3393==    definitely lost: 20,288 bytes in 634 blocks
==3393==    indirectly lost: 40 bytes in 1 blocks
==3393==      possibly lost: 1,113,002 bytes in 8,484 blocks
==3393==    still reachable: 630,312 bytes in 1,212 blocks
==3393==         suppressed: 0 bytes in 0 blocks
==3393== Rerun with --leak-check=full to see details of leaked memory
==3393==
==3393== For lists of detected and suppressed errors, rerun with: -s
==3393== ERROR SUMMARY: 6 errors from 6 contexts (suppressed: 0 from 0)

@TysonAndre
Copy link
Contributor

There's also the problem of setOffset -> destructor -> setOffset reading memory that was already being destroyed (e.g. array of objects with destructors). The large category of bugs with calling destructors before updating the value is why I'd recommended copying the original value in the original ticket

This can be fixed by ZVAL_COPY_VALUE to copy the old value to a temporary location, then overwriting the old address, then destructing the copy of the old value.

(I used this approach in a PECL I wrote when considering proposing data structures such as Vector in core in the future - https://github.com/TysonAndre/pecl-teds/blob/0.1.0a1/teds_vector.c#L809-L820 )

TysonAndre added a commit to TysonAndre/php-src that referenced this pull request Sep 11, 2021
@TysonAndre
Fix #81429: Handle resizing in SplFixedArray::offsetSet
bec9f7c 
offsetSet did not account for the fact that the array may no longer exist after
the field is overwritten. This fixes that.

Add test of resizing both to the empty array and a smaller array - there should
be no valgrind warnings with a proper fix.

Alternate approach to php#7486 (described in https://bugs.php.net/bug.php?id=81429)
@TysonAndre TysonAndre mentioned this pull request Sep 11, 2021
Merged
@krakjoe krakjoe added the Bug label Sep 13, 2021
@krakjoe
Copy link
Member

krakjoe commented Sep 13, 2021

Closing in favour of #7487 which looks (at a glance), more promising ...

@krakjoe krakjoe closed this Sep 13, 2021
TysonAndre added a commit that referenced this pull request Sep 14, 2021
@TysonAndre
Fix #81429: Handle resizing in SplFixedArray::offsetSet (#7487)
b053192 
offsetSet did not account for the fact that the array may no longer exist after
the field is overwritten. This fixes that.

Add test of resizing both to the empty array and a smaller array - there should
be no valgrind warnings with a proper fix.

Alternate approach to #7486 (described in https://bugs.php.net/bug.php?id=81429)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@TysonAndre TysonAndre TysonAndre left review comments

Assignees
No one assigned
Labels
Bug
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@huanghantao @cmb69 @TysonAndre @krakjoe