Description:
------------
Running the test script with asan built, we found that it crashed with 2 errors:
1. AddressSanitizer: memcpy-param-overlap
2. AddressSanitizer: attempting free on address which was not malloc()-ed

We believe the root cause is the same.

The php version is PHP 8.0.0-dev (cli) (built: Jan 31 2020 21:52:09) ( NTS ), master branch of git.

The script is run by "php -f poc.php". The script is reduced by C-reduced so that it might look a little messy.

Here's the stack dump of memcpy overlap:
===
=================================================================
==4309==ERROR: AddressSanitizer: memcpy-param-overlap: memory ranges [0x7f1a2165cf40,0x7f1a2165cfc0) and [0x7f1a2165cf08, 0x7f1a2165cf88) overlap
    #0 0x7f1a27c8f662 in __asan_memcpy (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x8c662)
    #1 0xe7eb9e in zend_hash_packed_to_hash (/home/rxz226/php-src/bld_asan/sapi/cli/php+0xe7eb9e)
    #2 0xe85621 in zend_hash_add_new (/home/rxz226/php-src/bld_asan/sapi/cli/php+0xe85621)
    #3 0xfb7822 in zend_fetch_dimension_address_inner_W (/home/rxz226/php-src/bld_asan/sapi/cli/php+0xfb7822)
    #4 0x114224b in ZEND_ASSIGN_DIM_SPEC_VAR_CV_OP_DATA_CV_HANDLER (/home/rxz226/php-src/bld_asan/sapi/cli/php+0x114224b)
    #5 0x12659c7 in execute_ex (/home/rxz226/php-src/bld_asan/sapi/cli/php+0x12659c7)
    #6 0xdf5a2f in zend_call_function (/home/rxz226/php-src/bld_asan/sapi/cli/php+0xdf5a2f)
    #7 0xdf3145 in _call_user_function_ex (/home/rxz226/php-src/bld_asan/sapi/cli/php+0xdf3145)
    #8 0xe418a0 in zend_error_va_list (/home/rxz226/php-src/bld_asan/sapi/cli/php+0xe418a0)
    #9 0xe427b5 in zend_error (/home/rxz226/php-src/bld_asan/sapi/cli/php+0xe427b5)
    #10 0xfa32f3 in zval_undefined_cv (/home/rxz226/php-src/bld_asan/sapi/cli/php+0xfa32f3)
    #11 0xfa33ce in _zval_undefined_op2 (/home/rxz226/php-src/bld_asan/sapi/cli/php+0xfa33ce)
    #12 0xfe9238 in zend_is_smaller_or_equal_helper_SPEC (/home/rxz226/php-src/bld_asan/sapi/cli/php+0xfe9238)
    #13 0x105a4a3 in ZEND_IS_SMALLER_OR_EQUAL_SPEC_TMPVARCV_TMPVARCV_HANDLER (/home/rxz226/php-src/bld_asan/sapi/cli/php+0x105a4a3)
    #14 0x12552a2 in execute_ex (/home/rxz226/php-src/bld_asan/sapi/cli/php+0x12552a2)
    #15 0xdf5a2f in zend_call_function (/home/rxz226/php-src/bld_asan/sapi/cli/php+0xdf5a2f)
    #16 0xe6de12 in zend_fcall_info_call (/home/rxz226/php-src/bld_asan/sapi/cli/php+0xe6de12)
    #17 0xce8f9b in php_output_handler_op (/home/rxz226/php-src/bld_asan/sapi/cli/php+0xce8f9b)
    #18 0xcea7df in php_output_stack_pop (/home/rxz226/php-src/bld_asan/sapi/cli/php+0xcea7df)
    #19 0xce426e in php_output_end_all (/home/rxz226/php-src/bld_asan/sapi/cli/php+0xce426e)
    #20 0xca8df5 in php_request_shutdown (/home/rxz226/php-src/bld_asan/sapi/cli/php+0xca8df5)
    #21 0x1281d33 in do_cli (/home/rxz226/php-src/bld_asan/sapi/cli/php+0x1281d33)
    #22 0x1282acb in main (/home/rxz226/php-src/bld_asan/sapi/cli/php+0x1282acb)
    #23 0x7f1a26aa182f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #24 0x428a78 in _start (/home/rxz226/php-src/bld_asan/sapi/cli/php+0x428a78)
===

Test script:
---------------
<?@ unlink ( $GLOBALS  & in_array ( in_array ( print_r ( 2 , )    , array () , ( [] <= $a [ $i = strtoupper ( $$a [ $i = ( $a   <= define ( $f2 , ( [] <= ob_start ( function () {
            if ( [] . $obj = new stdClass < in_array (  [ var_dump ( var_dump ( $a [ $i = strtoupper ( $a   <= strtoupper ( ( ( set_error_handler ( function () {
           func_get_args ( func_get_arg ( 1 ) , var_dump ( $a   <= ( $a   <= $a   )   ) > strtoupper ( $$a [ $i = strtoupper ( $a   <= ( strtoupper ( strtoupper ( set_error_handler ( function () {
  }
          ) <= $a   )    <= $a   )   <= $a  [ $b [ $i = strtoupper ( $a [ $i = ( ( strtoupper ( $a   <= ( $a [ $i = ( $a   <= ( ( ( set_error_handler ( function () {
         unset ( $GLOBALS ) ;
         ( ( $$a   ) [ $GLOBALS  [ strtoupper ( [] <= $a   ) [ $value ] =  array ( array ( $$b [ 3 ] = 2 => set_error_handler ( $k ) , ) , )  ] = 1 ]   ) ;
         }
          , ) <= $a   )   <= $a [ ++ fopen ( $f2 , ( [] <= ob_start ( $GLOBALS [ ( $filename ) ] = $b , )   )  , $i = include_once 0 )  [] ]  )   <= a   )    ) ]  )  ) == print_r  ) ) ]  <= strtoupper     ) ] ] )    ) ]     ) ) ;
           }
            , ) <= $a   )    <= a   )   <= a   )    ) ]  ++ ) ) ]  ,  ) ) ;
             }
              )   )  , $i = 0 )    ) ] ) ]  ) ) ,  ) ) ;