View Issue Details

Jump to Notes
IDProjectCategoryView StatusDate SubmittedLast Update
0001875XdebugStep Debuggingpublic2020-11-02 02:362020-11-14 00:38
Reportertrowbot Assigned To 
PrioritynormalSeverityminorReproducibilityalways
Status closedResolutionfixed 
PlatformWindows (WSL)OSUbuntuOS Version20.04.1
Product Version3.0.0beta1 
Target Version3.0.0RC1Fixed in Version3.0.0RC1 
Summary0001875: Overflow with large amounts of elements for variadics
Description

Script crashes on the array_push() call, which results in the message "double free or corruption (!prev)". Script appears to run fine when removing "develop" from xdebug.mode.

Steps To Reproduce

Run the following command, substituting the xdebug location and test file location for your system:
php -dzend_extension=/usr/lib/php/20190902/xdebug.so -dxdebug.mode=debug,develop -dxdebug.start_with_request=yes testcase.php

Additional Information

php -dzend_extension=/usr/lib/php/20190902/xdebug.so -dxdebug.mode=debug,develop -dxdebug.start_with_request=yes testcase.php
double free or corruption (!prev)
Aborted

php -v
PHP 7.4.3 (cli) (built: Oct 6 2020 15:47:56) ( NTS )
Copyright (c) The PHP Group
Zend Engine v3.4.0, Copyright (c) Zend Technologies

TagsNo tags attached.
Operating System*
PHP Version7.4.0-7.4.4

Activities

trowbot

2020-11-02 03:18

reporter   ~0005489

GDB backtrace

derick

2020-11-02 08:33

administrator   ~0005490

I can reproduce this. Valgrind shows the following:



==1904314== Invalid write of size 8

==1904314==    at 0x8B4F918: collect_params_internal (base.c:429)

==1904314==    by 0x8B500F5: xdebug_add_stack_frame (base.c:653)

==1904314==    by 0x8B5092C: xdebug_execute_internal (base.c:860)

==1904314==    by 0x97E6EC: ZEND_DO_FCALL_SPEC_RETVAL_UNUSED_HANDLER (zend_vm_execute.h:1620)

==1904314==    by 0x9DF2B3: execute_ex (zend_vm_execute.h:53787)

==1904314==    by 0x8B50620: xdebug_execute_ex (base.c:783)

==1904314==    by 0x9E3350: zend_execute (zend_vm_execute.h:57883)

==1904314==    by 0x90FC84: zend_execute_scripts (zend.c:1677)

==1904314==    by 0x87A4C5: php_execute_script (main.c:2621)

==1904314==    by 0x9E5CD9: do_cli (php_cli.c:964)

==1904314==    by 0x9E6C71: main (php_cli.c:1359)

==1904314==  Address 0x8d7f738 is 8 bytes after a block of size 2,208 alloc'd

==1904314==    at 0x483877F: malloc (vg_replace_malloc.c:307)

==1904314==    by 0x8B4F72E: collect_params_internal (base.c:391)

==1904314==    by 0x8B500F5: xdebug_add_stack_frame (base.c:653)

==1904314==    by 0x8B5092C: xdebug_execute_internal (base.c:860)

==1904314==    by 0x97E6EC: ZEND_DO_FCALL_SPEC_RETVAL_UNUSED_HANDLER (zend_vm_execute.h:1620)

==1904314==    by 0x9DF2B3: execute_ex (zend_vm_execute.h:53787)

==1904314==    by 0x8B50620: xdebug_execute_ex (base.c:783)

==1904314==    by 0x9E3350: zend_execute (zend_vm_execute.h:57883)

==1904314==    by 0x90FC84: zend_execute_scripts (zend.c:1677)

==1904314==    by 0x87A4C5: php_execute_script (main.c:2621)

==1904314==    by 0x9E5CD9: do_cli (php_cli.c:964)

==1904314==    by 0x9E6C71: main (php_cli.c:1359)

==1904314==

==1904314== Invalid write of size 4

==1904314==    at 0x8B4F922: collect_params_internal (base.c:429)

==1904314==    by 0x8B500F5: xdebug_add_stack_frame (base.c:653)

==1904314==    by 0x8B5092C: xdebug_execute_internal (base.c:860)

==1904314==    by 0x97E6EC: ZEND_DO_FCALL_SPEC_RETVAL_UNUSED_HANDLER (zend_vm_execute.h:1620)

==1904314==    by 0x9DF2B3: execute_ex (zend_vm_execute.h:53787)

==1904314==    by 0x8B50620: xdebug_execute_ex (base.c:783)

==1904314==    by 0x9E3350: zend_execute (zend_vm_execute.h:57883)

==1904314==    by 0x90FC84: zend_execute_scripts (zend.c:1677)

==1904314==    by 0x87A4C5: php_execute_script (main.c:2621)

==1904314==    by 0x9E5CD9: do_cli (php_cli.c:964)

==1904314==    by 0x9E6C71: main (php_cli.c:1359)

==1904314==  Address 0x8d7f740 is 16 bytes after a block of size 2,208 alloc'd

==1904314==    at 0x483877F: malloc (vg_replace_malloc.c:307)

==1904314==    by 0x8B4F72E: collect_params_internal (base.c:391)

==1904314==    by 0x8B500F5: xdebug_add_stack_frame (base.c:653)

==1904314==    by 0x8B5092C: xdebug_execute_internal (base.c:860)

==1904314==    by 0x97E6EC: ZEND_DO_FCALL_SPEC_RETVAL_UNUSED_HANDLER (zend_vm_execute.h:1620)

==1904314==    by 0x9DF2B3: execute_ex (zend_vm_execute.h:53787)

==1904314==    by 0x8B50620: xdebug_execute_ex (base.c:783)

==1904314==    by 0x9E3350: zend_execute (zend_vm_execute.h:57883)

==1904314==    by 0x90FC84: zend_execute_scripts (zend.c:1677)

==1904314==    by 0x87A4C5: php_execute_script (main.c:2621)

==1904314==    by 0x9E5CD9: do_cli (php_cli.c:964)

==1904314==    by 0x9E6C71: main (php_cli.c:1359)

derick

2020-11-13 17:18

administrator   ~0005526

https://github.com/xdebug/xdebug/pull/686