Applying zero offset to null pointer in Zend/zend_opcode.c

[YuanchengJiang]

Description

The following testfile(phpt):

--TEST--
Applying zero offset to null pointer in Zend/zend_opcode.c
--FILE--
<?php
function foo () {
    try {
        break;
    } finally {
    }
}
foo();
?>
--PHPDBG--
ev 1 + 3 # ev 2 ** 3#q
--EXPECTF--
prompt> 4
8
Fatal error: 'break' not in the 'loop' or 'switch' context in %stry_finally_011.php on line %d

Resulted in this output:

prompt> /php-src/Zend/zend_opcode.c:1094:30: runtime error: applying zero offset to null pointer
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /php-src/Zend/zend_opcode.c:1094:30

PHP Version

PHP 8.4.0-dev

Operating System

ubuntu 22.04

[nielsdos]

Because of the bailout during compilation, CG(loop_var_stack) has a stale entry.
When you then evaluate the expression 1 + 3 afterwards, the stale values are used by the compiler to emit a bogus FAST_CALL opcode. This later causes crashes in the pass 2.
We can't call zend_init_compiler_data_structures because that API isn't public.
So this doesn't work:

diff --git a/sapi/phpdbg/phpdbg_list.c b/sapi/phpdbg/phpdbg_list.c
index 00ef995d89..a8fca26677 100644
--- a/sapi/phpdbg/phpdbg_list.c
+++ b/sapi/phpdbg/phpdbg_list.c
@@ -247,7 +247,13 @@ zend_op_array *phpdbg_compile_file(zend_file_handle *file, int type) {
 	data.buf = estrndup(bufptr, len);
 	data.len = len;
 
-	ret = PHPDBG_G(compile_file)(file, type);
+	zend_try {
+		ret = PHPDBG_G(compile_file)(file, type);
+	} zend_catch {
+		ret = NULL;
+		extern void zend_init_compiler_data_structures();
+		zend_init_compiler_data_structures();
+	} zend_end_try();
 	if (ret == NULL) {
 		efree(data.buf);
 		return ret;

Furthermore, this doesn't reset all the state, e.g. creating a file called x.php (with contents below) and changing ev 1 + 3 to r x.php would still break

x.php:

<?php
function bar() { return 1; }

[nielsdos]

I don't know how to proceed here, maybe @bwoebi can give some insights

[bwoebi]

Isolated reproducer without phpdbg is:

<?php

register_shutdown_function(function() {
	var_dump(eval("return 1+3;"));
});

eval(<<<EVAL
function foo () {
    try {
        break;
    } finally {
    }
}
foo();
EVAL);

@nielsdos I suppose we'll have to clean the compiler up a tiny bit in _zend_bailout itself.

[nielsdos]

@bwoebi thanks, that makes sense. I'll give it a shot a bit later.