php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #81558 Extension with observer segfaults when attribute is instantiated
Submitted: 2021-10-27 11:42 UTC Modified: 2021-10-27 15:34 UTC
From: beberlei@php.net Assigned: bwoebi (profile)
Status: Duplicate Package: *General Issues
PHP Version: 8.0.12 OS: Linux
Private report: No CVE-ID: None
 [2021-10-27 11:42 UTC] beberlei@php.net
Description:
------------
An extension registering an observer will lead to a segfault in zend_observer_fcall_end for ReflectionAttribute::newInstance.

Stacktrace is:

Program received signal SIGSEGV, Segmentation fault.
0x0000555555d9dc07 in zend_observer_fcall_end (execute_data=0x7ffff46151a0, return_value=0x7fffffff8c80) at /home/benny/code/projects/php/php-src/Zend/zend_observer.c:232
232			          || !ZEND_OBSERVER_DATA(&ex->func->op_array)
(gdb) bt
#0  0x0000555555d9dc07 in zend_observer_fcall_end (execute_data=0x7ffff46151a0, return_value=0x7fffffff8c80) at /home/benny/code/projects/php/php-src/Zend/zend_observer.c:232
#1  0x0000555555d59c15 in execute_ex (ex=0x7ffff46151a0) at /home/benny/code/projects/php/php-src/Zend/zend_vm_execute.h:54537
#2  0x0000555555c9740c in zend_call_function (fci=0x7fffffff8cb0, fci_cache=0x7fffffff8c90) at /home/benny/code/projects/php/php-src/Zend/zend_execute_API.c:895
#3  0x0000555555c977ba in zend_call_known_function (fn=0x7ffff46041e8, object=0x7ffff46ce600, called_scope=0x7ffff4604018, retval_ptr=0x0, param_count=0, params=0x7ffff46662d0, 
    named_params=0x7ffff46ce360) at /home/benny/code/projects/php/php-src/Zend/zend_execute_API.c:985
#4  0x0000555555a3d965 in call_attribute_constructor (attr=0x7ffff469a7e0, ce=0x7ffff4604018, obj=0x7ffff46ce600, args=0x7ffff46662d0, argc=0, named_params=0x7ffff46ce360, filename=0x7ffff4603640)
    at /home/benny/code/projects/php/php-src/ext/reflection/php_reflection.c:6326
#5  0x0000555555a3e11e in zim_ReflectionAttribute_newInstance (execute_data=0x7ffff4615150, return_value=0x7ffff4615100) at /home/benny/code/projects/php/php-src/ext/reflection/php_reflection.c:6454
#6  0x0000555555ce2625 in execute_internal (execute_data=0x7ffff4615150, return_value=0x7ffff4615100) at /home/benny/code/projects/php/php-src/Zend/zend_execute.c:3414
#7  0x00007ffff4977a88 in tideways_execute_internal () from /home/benny/tideways/workspace/github.com/tideways/php-extension-next/modules/tideways.so
#8  0x0000555555ce9e33 in ZEND_DO_FCALL_SPEC_OBSERVER_HANDLER () at /home/benny/code/projects/php/php-src/Zend/zend_vm_execute.h:1973
#9  0x0000555555d59325 in execute_ex (ex=0x7ffff4615020) at /home/benny/code/projects/php/php-src/Zend/zend_vm_execute.h:54213
#10 0x0000555555d5ea5e in zend_execute (op_array=0x7ffff4660280, return_value=0x0) at /home/benny/code/projects/php/php-src/Zend/zend_vm_execute.h:58524
#11 0x0000555555caf3c5 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /home/benny/code/projects/php/php-src/Zend/zend.c:1680
#12 0x0000555555c10d34 in php_execute_script (primary_file=0x7fffffffb840) at /home/benny/code/projects/php/php-src/main/main.c:2539
#13 0x0000555555d9fb49 in do_cli (argc=96, argv=0x555556dc11c0) at /home/benny/code/projects/php/php-src/sapi/cli/php_cli.c:949
#14 0x0000555555da0b96 in main (argc=96, argv=0x555556dc11c0) at /home/benny/code/projects/php/php-src/sapi/cli/php_cli.c:1337

Could not reproduce this on the script with "zend_test", but it does for our own observer. Will put more work into getting a reproduce on zend_test.

More stacktraces from a larger app crashing: https://gist.github.com/beberlei/5bde1ea06f7dd4bfb42cf158c5779405

Test script:
---------------
<?php

#[Attribute]
class Entity
{
    public function __construct(
        private $table,
    ) {}
}

#[Entity(table: "product")]
class Product
{
}

$reflectionClass = new \ReflectionClass('Product');
$entity = $reflectionClass->getAttributes()[0]->newInstance();



Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2021-10-27 11:42 UTC] beberlei@php.net
-Assigned To: +Assigned To: bwoebi
 [2021-10-27 15:34 UTC] bwoebi@php.net
-Status: Assigned +Status: Duplicate
 [2021-10-27 15:34 UTC] bwoebi@php.net
Duplicate of #81430
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Fri Apr 19 03:01:27 2024 UTC