php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #76074 opcache corrupts variable in for-loop
Submitted: 2018-03-09 13:15 UTC Modified: 2018-03-10 08:23 UTC
Votes:1
Avg. Score:4.0 ± 0.0
Reproduced:1 of 1 (100.0%)
Same Version:0 (0.0%)
Same OS:0 (0.0%)
From: sjon at hortensius dot net Assigned: jhdxr (profile)
Status: Closed Package: opcache
PHP Version: 7.2.3 OS: archlinux
Private report: No CVE-ID: None
 [2018-03-09 13:15 UTC] sjon at hortensius dot net
Description:
------------
A for-loop that uses condition $i < $x + 1 prints very weird numbers.

This requires you to ENABLE the opcache and DISABLE xdebug.

Test script:
---------------
function test(int $nr) {
	for ($i = $nr; $i <= $nr + 1; $i++)
		var_dump($i);
}

test(1);

Expected result:
----------------
int(1)
int(2)

Actual result:
--------------
int(-9223372036854775808)
int(-9223372036854775808)

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2018-03-09 13:24 UTC] sjon at hortensius dot net
More specifically, opcache.optimization_level=0x000000F0 bugs and opcache.optimization_level=0x00000000 works

So it's an optimisation issue
 [2018-03-10 00:44 UTC] jhdxr@php.net
-Status: Open +Status: Verified
 [2018-03-10 08:23 UTC] jhdxr@php.net
-Status: Verified +Status: Analyzed -Assigned To: +Assigned To: jhdxr
 [2018-03-10 08:23 UTC] jhdxr@php.net
it seems we missed some overflow & underflow check when we do inferncing.

https://github.com/php/php-src/blob/master/ext/opcache/Optimizer/zend_inference.c#L905

I'm working on it.
 [2018-03-10 14:20 UTC] bwoebi@php.net
Automatic comment on behalf of bobwei9@hotmail.com
Revision: http://git.php.net/?p=php-src.git;a=commit;h=9c6df8a238c4492704d9f37d2a155cf85d704804
Log: Fix bug #76074 (opcache corrupts variable in for-loop)
 [2018-03-10 14:20 UTC] bwoebi@php.net
-Status: Analyzed +Status: Closed
 [2018-03-10 14:21 UTC] bwoebi@php.net
Automatic comment on behalf of bobwei9@hotmail.com
Revision: http://git.php.net/?p=php-src.git;a=commit;h=9c6df8a238c4492704d9f37d2a155cf85d704804
Log: Fix bug #76074 (opcache corrupts variable in for-loop)
 [2018-03-10 14:29 UTC] bwoebi@php.net
Automatic comment on behalf of bobwei9@hotmail.com
Revision: http://git.php.net/?p=php-src.git;a=commit;h=9c6df8a238c4492704d9f37d2a155cf85d704804
Log: Fix bug #76074 (opcache corrupts variable in for-loop)
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Sat Oct 05 15:01:27 2024 UTC