Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:101658
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain ca.ibm.com designates 148.163.156.1 as permitted sender)
MIME-Version: 1.0
To: "PHP internals" <internals@lists.php.net>
Date: Mon, 22 Jan 2018 13:11:01 -0500
Content-type: multipart/alternative; 
	Boundary="0__=8FBB088EDFF292FA8f9e8a93df938690918c8FBB088EDFF292FA"
Content-Disposition: inline
Message-ID: <OF3CAC706D.D092F0CF-ON0025821D.0061146A-8525821D.0063E308@notes.na.collabserv.com>
Subject: v7.2.1 test cases crash on s390x 
From: samding@ca.ibm.com ("Sam Ding")

--0__=8FBB088EDFF292FA8f9e8a93df938690918c8FBB088EDFF292FA
Content-Transfer-Encoding: quoted-printable
Content-type: text/plain; charset=US-ASCII


Hi,

When testing v7.2.1 on s390x two cases are found crash:

  1) ext/mbstring/tests/mb=5Fereg.phpt ;
  2) ext/mbstring/tests/mb=5Fereg=5Fvariation5.phpt] ;

It happens at /home/work/php/php/ext/mbstring/oniguruma/src/regexec.c:2481,
here is the code (replaced the macros):

2474        case OP=5FSTATE=5FCHECK=5FPUSH:  MOP=5FIN(OP=5FSTATE=5FCHECK=5F=
PUSH);
2475          GET=5FSTATE=5FCHECK=5FNUM=5FINC(mem, p);
2476    //      STATE=5FCHECK=5FVAL(scv, mem);
2477     do {
2478      if (state=5Fcheck=5Fbuff !=3D NULL) {
2479    //    int x =3D STATE=5FCHECK=5FPOS(s,mem);
2480        int x =3D (((s) - str) * num=5Fcomb=5Fexp=5Fcheck + ((mem) - 1)=
);
2481        (scv) =3D state=5Fcheck=5Fbuff[x/8] & (1<<(x%8));
2482      }
2483      else (scv) =3D 0;
2484    } while(0);
2485
(gdb) p x
$1 =3D 196680
(gdb) p x/8
$2 =3D 24585

However the array "state=5Fcheck=5Fbuff" index is 0--20311.
 "mem" is come from the  macro "GET=5FSTATE=5FCHECK=5FNUM=5FINC", which ref=
ers to
"StateCheckNumType",
Here is the definition of StateCheckNumType: in
ext/mbstring/oniguruma/src/regint.h
  ...
    530 typedef int MemNumType;
    531 typedef short int StateCheckNumType;
    532 typedef void* PointerType;
  ...

  Not understanding why StateCheckNumType is defined as short int, but
others are all int.

If change it as "int", two crashes are gone and  5 cases related to
"mb=5Fereg() " are passed.
Testing on x86=5F64  show 5 cases are alos passed (same as before).

Thanks,

Sam

--0__=8FBB088EDFF292FA8f9e8a93df938690918c8FBB088EDFF292FA--