Skip to content

Member access within misaligned address in zend_alloc.c #13998

Closed
@YuanchengJiang

Description

@YuanchengJiang

Description

The following code:

<?php
$db = new PdoSqlite('sqlite::memory:');
$db->query('CREATE TABLE test_pdo_sqlite_createaggregate_trampoline (a INTEGER, b INTEGER)');
$stmt = $db->query('INSERT INTO test_pdo_sqlite_createaggregate_trampoline VALUES (1, -1), (2, -2), (3, -3), (4, -4), (4, -4)');
class TrampolineTest {
    public function __call(string $name, array $arguments) {
        echo 'Trampoline for ', $name, PHP_EOL;
        $context = $GLOBALS[array_rand($GLOBALS)]; // $arguments[0];
        if ($name === 'finalize') {
            return implode(',', $context['values']);
        }
        if (empty($context)) {
            $context = $GLOBALS[array_rand($GLOBALS)]; // ['total' => 0, 'values' => []];
        }
        $context['total'] += (int) $arguments[2];
        $context['values'][] = $context['total'];
        return $context;
    }
}
var_dump($db->createAggregate('S', [new TrampolineTest(), 'step'], [new TrampolineTest(), 'finalize'], 1));
foreach ($db->query('SELECT S(a), S(b) FROM test_pdo_sqlite_createaggregate_trampoline') as $row) {
}
?>

Resulted in this output:

/php-src/Zend/zend_alloc.c:1314:33: runtime error: member access within misaligned address 0x7fc3ad6015fc for type 'zend_mm_free_slot' (aka 'struct _zend_mm_free_slot'), which requires 8 byte alignment
0x7fc3ad6015fc: note: pointer points here
  b0 00 00 00 00 00 00 00  fb 14 60 ad c3 7f 00 00  00 00 00 00 00 00 00 00  01 00 00 00 00 00 00 00
              ^ 
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /php-src/Zend/zend_alloc.c:1314:33 in

PHP Version

PHP 8.4.0-dev

Operating System

ubuntu 22.04

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions