|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
[2018-12-14 00:21 UTC] security at paragonie dot com
Description: ------------ Reported to the libsodium-php repository too. Just wanted to make sure the PHP team is aware of the issue and hopefully can include the fix in 7.3.1. https://github.com/jedisct1/libsodium-php/issues/186 https://github.com/jedisct1/libsodium-php/pull/187 Test script: --------------- <?php function foo() { throw new SodiumException('test'); } foo(); Expected result: ---------------- PHP Fatal error: Uncaught SodiumException: test in /home/scott/sodium_compat/segfault.php:5 Stack trace: #0 /home/scott/sodium_compat/segfault.php(7): foo() #1 {main} thrown in /home/scott/sodium_compat/segfault.php on line 5 Actual result: -------------- Segmentation fault (core dumped) PatchesPull RequestsHistoryAllCommentsChangesGit/SVN commits
|
|||||||||||||||||||||||||||||||||||||
Copyright © 2001-2025 The PHP GroupAll rights reserved. |
Last updated: Thu Oct 30 22:00:01 2025 UTC |
It seems the problem is that zend_hash_clean() is called[1] on a hash table with refcount==2, which is not allowed: php: /mnt/c/Users/cmb/php-dev/php-src/Zend/zend_hash.c:1521: zend_hash_clean: Assertion `(zend_gc_refcount(&(ht)->gc) == 1) || ((ht)->u.flags & (1<<6))' failed. Aborted (core dumped) Also `Z_TYPE_P(frame) == IS_ARRAY` looks fishy; shouldn't that be `Z_TYPE_P(args) == IS_ARRAY`? [1] <https://github.com/php/php-src/blob/php-7.3.0/ext/sodium/libsodium.c#L390-L392>