Repository navigation
Setting opcache.interned_strings_buffer to a very high value leads to corruption of shm #9259
Description
Description
The following code:
<?php
class C {}
new C;sapi/cli/php -d zend_extension=$(pwd)/modules/opcache.so -d opcache.enable_cli=1 -d opcache.interned_strings_buffer=131072 test.php
Resulted in this output:
Floating point exception
But I expected this output instead:
opcache.interned_strings_buffer takes a number of megabytes, but it's easy to be mistaken and to accidentally set it to an unexpectedly high value, like 16m.
This leads to integer overflows in the shared mm allocator, and then to memory corruptions. In this case ZCSG(hash)->max_num_entries is set to zero, which causes an floating point exception here:
Program received signal SIGFPE, Arithmetic exception.
0x00007ffff78aaede in zend_accel_hash_find_ex (accel_hash=0x5555564000b0, key=0x7ffff79f6078 <accel_globals+408>, data=1) at ext/opcache/zend_accelerator_hash.c:151
151 index = hash_value % accel_hash->max_num_entries;
(gdb) list
146
147 hash_value = zend_string_hash_val(key);
148 #ifndef ZEND_WIN32
149 hash_value ^= ZCG(root_hash);
150 #endif
151 index = hash_value % accel_hash->max_num_entries;
152
153 entry = accel_hash->hash_table[index];
154 while (entry) {
155 if (entry->hash_value == hash_value
PHP Version
master
Operating System
No response
Activity
arnaud-lb commentedon Sep 3, 2022
Fixed in #9260