Skip to content

[Bug] Memory Corruption after unserializing BackedEnum #183

@cracksalad

Description

@cracksalad

At first I did not know where this comes from, so I created an issue at php-src.

When unserializing a BackedEnum value I get values that have nothing in common with this enum like an instance of some class. To find the root cause I disabled extensions, recompiled memcached (I use msgpack mostly through that) and ran my PHP script using valgrind. The stack trace outputted by valgrind looks like this:

==9995== 1 errors in context 1 of 12458:
==9995== Invalid read of size 8
==9995==    at 0x4472F83: zend_enum_get_case (in /usr/bin/php)
==9995==    by 0xC478FFB: msgpack_unserialize_map_item (msgpack_unpack.c:695)
==9995==    by 0xC474265: msgpack_unserialize_execute.constprop.0 (unpack_template.h:405)
==9995==    by 0xC474D53: php_msgpack_unserialize (msgpack.c:252)
==9995==    by 0xC490058: s_unserialize_value (php_memcached.c:3845)
==9995==    by 0xC490058: s_memcached_result_to_zval (php_memcached.c:3918)
==9995==    by 0xC490058: php_memc_result_apply (php_memcached.c:707)
==9995==    by 0xC490355: php_memc_mget_apply.part.0.constprop.0 (php_memcached.c:793)
==9995==    by 0xC49135C: php_memc_mget_apply (php_memcached.c:198)
==9995==    by 0xC49135C: php_memc_get_impl (php_memcached.c:1576)
==9995==    by 0x44D4663: execute_ex (in /usr/bin/php)
==9995==    by 0x44C9834: zend_execute (in /usr/bin/php)
==9995==    by 0x4531D43: zend_execute_script (in /usr/bin/php)
==9995==    by 0x43C8DA7: php_execute_script_ex (in /usr/bin/php)
==9995==    by 0x4533C2F: ??? (in /usr/bin/php)
==9995==  Address 0x0 is not stack'd, malloc'd or (recently) free'd

Any ideas were exactly this comes from? From my experience it is definitely and only related to enums.
Might also be related to #181

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions