Memory out of bound error

[ZafarKamal123]

The following memory access error occurs on the official playground of WordPress WASM when trying to publish a page with a lot of content (not really a lot):

Steps to Reproduce

1. Navigate to the wasm playground demo.
2. Add a lot of content in the gutenberg editor
3. Try to publish the code

Expected Behaviour

It should publish the page successfully.

[adamziel]

Thank you for reporting! This is a legitimate bug. The message talks about memory, but luckily it’s unrelated to actual memory consumption. You’re not running out of memory. Rather, PHP is trying to read something from the wrong memory region. It should be a relatively easy fix, I'll look into that.

[ZafarKamal123]

Thanks @adamziel for the quick response. Looking forward for the fix as i'm willing to use it into my project.

[adamziel]

Update: Here's an unminified stacktrace:

Uncaught (in promise) RuntimeError: memory access out of bounds
    at zend_activate_auto_globals (01b77c16)
    at php_hash_environment (01b77c16)
    at invoke_i (php_8_0.js:7636:36)
    at php_request_startup (01b77c16)
    at wasm_sapi_request_init (01b77c16)
    at invoke_i (php_8_0.js:7636:36)
    at wasm_sapi_handle_request (01b77c16)
    at php_8_0.js:914:22
    at Object.ccall (php_8_0.js:6999:22)
    at #handleRequest (php.ts:697:34)

[adamziel]

Something's wrong with the way POST body is read. Presumably memcpy writes to/from a region it's not supposed to:

#if PHP_MAJOR_VERSION == 5
static int wasm_sapi_read_post_body(char *buffer, uint count_bytes)
#else
static size_t wasm_sapi_read_post_body(char *buffer, size_t count_bytes)
#endif
{
	if (wasm_server_context == NULL || wasm_server_context->request_body == NULL)
	{
		return 0;
	}

	count_bytes = MIN(count_bytes, SG(request_info).content_length - SG(read_post_bytes));
	if(count_bytes > 0) {
		memcpy(buffer + SG(read_post_bytes), wasm_server_context->request_body + SG(read_post_bytes), count_bytes);
	}
	return count_bytes;
}

[adamziel]

Note to myself: compare that logic to php-fpm SAPI https://github.com/php/php-src/blob/master/sapi/fpm/fpm/fpm_main.c

[adamziel]

Php-fcgi has interesting safeguards in place:

static size_t sapi_fcgi_read_post(char *buffer, size_t count_bytes)
{
	size_t read_bytes = 0;
	int tmp_read_bytes;
	fcgi_request *request = (fcgi_request*) SG(server_context);
	size_t remaining = SG(request_info).content_length - SG(read_post_bytes);

	if (remaining < count_bytes) {
		count_bytes = remaining;
	}
	while (read_bytes < count_bytes) {
		size_t diff = count_bytes - read_bytes;
		int to_read = (diff > INT_MAX) ? INT_MAX : (int)diff;

		tmp_read_bytes = fcgi_read(request, buffer + read_bytes, to_read);
		if (tmp_read_bytes <= 0) {
			break;
		}
		read_bytes += tmp_read_bytes;
	}
	return read_bytes;
}

[adamziel]

Hypothesis: if POST body exceeds SAPI_POST_BLOCK_SIZE, or about 16k bytes, the POST-reading loop runs for the second time - which is what trigger the error. If so, this is probably the buffer is of the SAPI_POST_BLOCK_SIZE size and is reset every time. However, the post reader assumes it must memcpy to buffer + SG(read_post_bytes) which not only leaves the buffer empty but also corrupts the memory region after if. I’ll verify this when I have a moment.

[adamziel]

That was it! I'm rebuilding PHP and will ship a fix shortly.

[adamziel]

Fix shipped in 2e950a2

I still need to deploy the updated version to wasm.wordpress.net, but this issue may be closed. @ZafarKamal123 can you confirm this worked? If not, I'm happy to reopen.

[ZafarKamal123]

Thanks for the quick support man! I'll check this and get back to you.

[adamziel]

It’s now deployed to wasm.wordpress.net! The editor is still experiencing a few issues due to #174, but not this one.