Invalid access or leak of startup data for ext/date after early usage (php_log_err in minit+rinit)

Start by reading php_date_parse_tzfile() in ext/date/php_date.c and the startup logging paths in main/main.c, especially php_log_err_with_severity() and php_request_startup(). Reproduce with the command in the issue under ASAN or Valgrind, then trace how timezone data is allocated and accessed across module and request startup. Done means the reproduction no longer reports leaks or invalid reads.

Description

The following invocation:

php -n -d allow_url_include=1 -d log_errors=1 -d error_log=/tmp/tzlog -d output_handler=inexistent -d date.timezone=Europe/Berlin -r ''

Resulted in this output under ASAN ZTS:

Deprecated: Directive 'allow_url_include' is deprecated in Unknown on line 0

Warning: PHP Request Startup: function "inexistent" not found or invalid function name in Unknown on line 0

=================================================================
==27445==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 56 byte(s) in 1 object(s) allocated from:
    #0 0xfffff7533580 in malloc (/usr/lib/llvm-21/lib/clang/21/lib/linux/libclang_rt.asan-aarch64.so+0x113580) (BuildId: 4151a86fb9ab0c416ad23c64d352890b177673cc)
    #1 0xaaaaae165684 in __zend_malloc /usr/local/src/php/Zend/zend_alloc.c:3543:14
    #2 0xaaaaae164a60 in _emalloc /usr/local/src/php/Zend/zend_alloc.c:2780:10
    #3 0xaaaaac228ffc in php_date_parse_tzfile /usr/local/src/php/ext/date/php_date.c:503:3
    #4 0xaaaaac228dc8 in get_timezone_info /usr/local/src/php/ext/date/php_date.c:574:8
    #5 0xaaaaac22c728 in php_format_date /usr/local/src/php/ext/date/php_date.c:891:9
    #6 0xaaaaadedd4e4 in php_log_err_with_severity /usr/local/src/php/main/main.c:961:22
    #7 0xaaaaadee8544 in php_error_cb /usr/local/src/php/main/main.c:1462:4
    #8 0xaaaaad688430 in soap_error_handler /usr/local/src/php/ext/soap/soap.c:1972:3
    #9 0xaaaaaea76a90 in zend_error_zstr_at /usr/local/src/php/Zend/zend.c:1534:3
    #10 0xaaaaaea7aa68 in zend_error_zstr /usr/local/src/php/Zend/zend.c:1774:2
    #11 0xaaaaadedf478 in php_verror /usr/local/src/php/main/main.c:1225:2
    #12 0xaaaaadedf8d0 in php_error_docref /usr/local/src/php/main/main.c:1241:2
    #13 0xaaaaadf03468 in php_output_handler_create_user /usr/local/src/php/main/output.c:495:5
    #14 0xaaaaadf02d98 in php_output_start_user /usr/local/src/php/main/output.c:437:13
    #15 0xaaaaadee29d8 in php_request_startup /usr/local/src/php/main/main.c:1931:4
    #16 0xaaaaaea85b44 in do_cli /usr/local/src/php/sapi/cli/php_cli.c:919:7
    #17 0xaaaaaea83cdc in main /usr/local/src/php/sapi/cli/php_cli.c:1374:18
    #18 0xfffff3ce7740 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #19 0xfffff3ce7814 in __libc_start_main csu/../csu/libc-start.c:360:3
    #20 0xaaaaac22376c in _start (/opt/php/debug-zts-asan/bin/php+0x182376c) (BuildId: f1d261fe334b51607723cfb16183a41513d0eac6)

... and a bunch more indirect leaks

And under NTS valgrind (USE_TRACKED_ALLOC=1 USE_ZEND_ALLOC=0):

==27531== Command: php -n -d allow_url_include=1 -d log_errors=1 -d error_log=/tmp/tzlog -d output_handler=inexistent -d date.timezone=Europe/Berlin -r 
==27531== 

Deprecated: Directive 'allow_url_include' is deprecated in Unknown on line 0
==27531== Invalid read of size 4
==27531==    at 0x56C235C: zend_hash_str_find_bucket (/usr/local/src/php/Zend/zend_hash.c:788)
==27531==    by 0x56C235C: zend_hash_str_find (???:2706)
==27531==    by 0x4FD125B: zend_hash_str_find_ptr (zend_hash.h:908)
==27531==    by 0x4FD125B: php_date_parse_tzfile (???:507)
==27531==    by 0x4FD11C7: get_timezone_info (/usr/local/src/php/ext/date/php_date.c:574)
==27531==    by 0x4FD1DCB: php_format_date (/usr/local/src/php/ext/date/php_date.c:891)
==27531==    by 0x553CF53: php_log_err_with_severity (/usr/local/src/php/main/main.c:966)
==27531==    by 0x553F1F3: php_error_cb (/usr/local/src/php/main/main.c:1462)
==27531==    by 0x570C24B: zend_error_zstr_at (/usr/local/src/php/Zend/zend.c:0)
==27531==    by 0x553D45B: php_verror (/usr/local/src/php/main/main.c:1225)
==27531==    by 0x553D773: php_error_docref (/usr/local/src/php/main/main.c:1241)
==27531==    by 0x5543BB7: php_output_handler_create_user (/usr/local/src/php/main/output.c:495)
==27531==    by 0x5543A4F: php_output_start_user (/usr/local/src/php/main/output.c:437)
==27531==    by 0x553DD1B: php_request_startup (/usr/local/src/php/main/main.c:1931)
==27531==  Address 0xb1eddec is 12 bytes inside a block of size 56 free'd
==27531==    at 0x62BB554: free (m_replacemalloc/vg_replace_malloc.c:989)
==27531==    by 0x559ECA3: tracked_free_all (/usr/local/src/php/Zend/zend_alloc.c:3078)
==27531==    by 0x559ECA3: zend_mm_shutdown (???:2443)
==27531==    by 0x553EDE3: php_module_startup (/usr/local/src/php/main/main.c:2465)
==27531==    by 0x570E4E7: main (/usr/local/src/php/sapi/cli/php_cli.c:1341)
==27531==  Block was alloc'd at
==27531==    at 0x62B85D4: malloc (m_replacemalloc/vg_replace_malloc.c:446)
==27531==    by 0x559F0E7: tracked_malloc (/usr/local/src/php/Zend/zend_alloc.c:3018)
==27531==    by 0x4FD1227: php_date_parse_tzfile (/usr/local/src/php/ext/date/php_date.c:503)
==27531==    by 0x4FD11C7: get_timezone_info (/usr/local/src/php/ext/date/php_date.c:574)
==27531==    by 0x4FD1DCB: php_format_date (/usr/local/src/php/ext/date/php_date.c:891)
==27531==    by 0x553CF53: php_log_err_with_severity (/usr/local/src/php/main/main.c:966)
==27531==    by 0x553F1F3: php_error_cb (/usr/local/src/php/main/main.c:1462)
==27531==    by 0x570C24B: zend_error_zstr_at (/usr/local/src/php/Zend/zend.c:0)
==27531==    by 0x570C88F: zend_error_va_list (/usr/local/src/php/Zend/zend.c:1636)
==27531==    by 0x570C88F: zend_error (???:1706)
==27531==    by 0x553ED5B: php_module_startup (/usr/local/src/php/main/main.c:2447)
==27531==    by 0x570E4E7: main (/usr/local/src/php/sapi/cli/php_cli.c:1341)

Triggering an error log write at request startup after a prior error log write to error log during module startup results in leaks or invalid access.

PHP Version

PHP 8.5.10