PHP7 Zend Heap validation

For Windows, when it is USE_ZEND_ALLOC=0 , I tried to see overflows rather than leaks, with MS Application verifier and
with MS CRT debug flags ( particularly _CRTDBG_CHECK_ALWAYS_DF ) , however I am not getting any meaningful output
so that is why I wanted to ask for the Zend heap verifier here.

From: Xinchen Hui [mailto:laruence@php.net]
Sent: 26 December 2015 05:30
To: Ocal, Akin
Cc: PHP Internals
Subject: Re: [PHP-DEV] PHP7 Zend Heap validation

Hey:

Hi everyone,

I am working on porting a pre-PHP7 database driver extension to PHP7 for Windows platforms.
( I am using PHP 7.0.1 master branch code and targeting non-ZTS 32 bit PHP7 on Windows Server 2012 R2 )
And currently as I did mechanical bits of porting ( compilation issues, getting functionality working
mostly followed https://wiki.php.net/phpng-upgradinghttps://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.php.net_phpng-2Dupgrading&d=AwMFaQ&c=4ZIZThykDLcoWk-GVjSLm9hvvvzvGv0FLoWSRuCSs5Q&r=WNZrBw1Z15H_TIydi6wrAnQBZ6J3iZSKUpRWgdkYc54&m=QjlP5AZH0vV9At-8UrG5qfuPXdX_iG_9e9areeOSaPQ&s=-9f-gkPhSSb87ZS7fwXBnOvB3fx2ZilJV-5DuVrzOCg&e= ) , my extension is only crash-free if I run it with
USE_ZEND_ALLOC=0.

However with USE_ZEND_ALLOC=1 , I am getting crashes inside zend_mm_alloc_small. As checked with Windbg :
...
if (EXPECTED(heap->free_slot[bin_num] != NULL) )
{
zend_mm_free_slot *p = heap->free_slot[bin_num];
if ( p->next_free_slot != NULL )

Above , p->next_free_slot is not readable. I believe , currently I am getting the Zend heap corrupt.
I am running a test script and I tried disabling many things ,and enabling one by one to have an idea, from the looks of it , I am getting this issue
around a zend_register_resource call but to me that one looks legitimate so I can`t easily pinpoint where the Zend heap gets corrupt.

Diffrently from pre-PHP7 where we had full_mem_check , now I can see ZEND_MM_CHECK is placed in memory manager functions.

I wanted to ask if there is any chance if we can have a heap integrity checker function , or what would you advise
regarding to track down the places in our code corrupting the Zend MM ?
I am not familar with windows, but if it can be run in linux

you could try with "USE_ZEND_ALLOC=0 valgrind --tool=memcheck "

not sure if there is similar tool on windows

thanks

Regards,
Akin Ocal

This e-mail is for the sole use of the intended recipient and contains information that may be privileged and/or confidential. If you are not an intended recipient, please notify the sender by return e-mail and delete this e-mail and any attachments. Certain required legal entity disclosures can be accessed on our website.http://site.thomsonreuters.com/site/disclosures/

--
Xinchen Hui
@Laruence
http://www.laruence.com/<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.laruence.com_&d=AwMFaQ&c=4ZIZThykDLcoWk-GVjSLm9hvvvzvGv0FLoWSRuCSs5Q&r=WNZrBw1Z15H_TIydi6wrAnQBZ6J3iZSKUpRWgdkYc54&m=QjlP5AZH0vV9At-8UrG5qfuPXdX_iG_9e9areeOSaPQ&s=YtC5iMTbmT8kJpWVrEpHAlxeKNPrM0-bKQJkjar9ICs&e=

Hey:

Hi everyone,

I am working on porting a pre-PHP7 database driver extension to PHP7 for
Windows platforms.
( I am using PHP 7.0.1 master branch code and targeting non-ZTS 32 bit
PHP7 on Windows Server 2012 R2 )
And currently as I did mechanical bits of porting ( compilation issues,
getting functionality working
mostly followed https://wiki.php.net/phpng-upgrading ) , my extension is
only crash-free if I run it with
USE_ZEND_ALLOC=0.

However with USE_ZEND_ALLOC=1 , I am getting crashes inside
zend_mm_alloc_small. As checked with Windbg :
...
if (EXPECTED(heap->free_slot[bin_num] != NULL) )
{
zend_mm_free_slot *p =
heap->free_slot[bin_num];
if ( p->next_free_slot != NULL )

Above , p->next_free_slot is not readable. I believe , currently I am
getting the Zend heap corrupt.
I am running a test script and I tried disabling many things ,and
enabling one by one to have an idea, from the looks of it , I am getting
this issue
around a zend_register_resource call but to me that one looks legitimate
so I can`t easily pinpoint where the Zend heap gets corrupt.

Diffrently from pre-PHP7 where we had full_mem_check , now I can see
ZEND_MM_CHECK is placed in memory manager functions.

I wanted to ask if there is any chance if we can have a heap integrity
checker function , or what would you advise
regarding to track down the places in our code corrupting the Zend MM ?

I am not familar with windows, but if it can be run in linux

you could try with "USE_ZEND_ALLOC=0 valgrind --tool=memcheck "

not sure if there is similar tool on windows

thanks

On windows you can use a couple of tools to try to find them:

• http://www.softwareverify.com/ (commercial)
• the debugger tools (the standalone tools) contain some limited valgrind
  like features
• not directly related but adding --with-static-analyzer=vs is quite useful
  too. Latest version is Very effective

Cheers,