php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #68151 VLD may crash when parsing break/continue statment
Submitted: 2014-10-04 11:05 UTC Modified: 2016-08-08 16:21 UTC
From: mfmans at gmail dot com Assigned: cmb (profile)
Status: Closed Package: vld (PECL)
PHP Version: 5.4.33 OS: Windows 8.1
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: mfmans at gmail dot com
New email:
PHP Version: OS:

 

 [2014-10-04 11:05 UTC] mfmans at gmail dot com
Description:
------------
VLD 0.12.0 may crash when parsing break/continue statement on PHP 5.4

I found out vld_find_brk_cont() causes this problem (memory access violation).

I fixed it by this way:
srm_oparray.c, line 664, "op.op2.constant" -> "op.op2.zv->value.lval"


It works. But I do not ensure this is the right way.

Test script:
---------------
while(1) {
    break;
}

Expected result:
----------------
3   0  > > JMPZ         1, ->3
4   1  > > BRK          1, ->3
5   2*     JMP             ->0
6   3  > > RETURN       1

Actual result:
--------------
3   0  > > JMPZ         1, ->3
4   1  > > BRK          1, [[[ a random value ]]]
5   2*     JMP             ->0
6   3  > > RETURN       1


or crash directly

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2016-08-08 16:21 UTC] cmb@php.net
-Status: Open +Status: Closed -Assigned To: +Assigned To: cmb
 [2016-08-08 16:21 UTC] cmb@php.net
This issue has been fixed in vld-0.13.0.tgz, see
<https://github.com/derickr/vld/commit/efbcfa7>.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Mon Dec 30 17:01:29 2024 UTC