Setting opcache.interned_strings_buffer to a very high value leads to corruption of shm

[arnaud-lb]

Description

The following code:

<?php

class C {}

new C;

sapi/cli/php -d zend_extension=$(pwd)/modules/opcache.so -d opcache.enable_cli=1 -d opcache.interned_strings_buffer=131072 test.php

Resulted in this output:

Floating point exception

But I expected this output instead:

opcache.interned_strings_buffer takes a number of megabytes, but it's easy to be mistaken and to accidentally set it to an unexpectedly high value, like 16m.

This leads to integer overflows in the shared mm allocator, and then to memory corruptions. In this case ZCSG(hash)->max_num_entries is set to zero, which causes an floating point exception here:

Program received signal SIGFPE, Arithmetic exception.
0x00007ffff78aaede in zend_accel_hash_find_ex (accel_hash=0x5555564000b0, key=0x7ffff79f6078 <accel_globals+408>, data=1) at ext/opcache/zend_accelerator_hash.c:151
151		index = hash_value % accel_hash->max_num_entries;
(gdb) list
146	
147		hash_value = zend_string_hash_val(key);
148	#ifndef ZEND_WIN32
149		hash_value ^= ZCG(root_hash);
150	#endif
151		index = hash_value % accel_hash->max_num_entries;
152	
153		entry = accel_hash->hash_table[index];
154		while (entry) {
155			if (entry->hash_value == hash_value

PHP Version

master

Operating System

No response

[arnaud-lb]

Fixed in #9260