|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
PatchesPull RequestsHistoryAllCommentsChangesGit/SVN commits
[2017-07-19 16:30 UTC] pollita@php.net
-Status: Open
+Status: Verified
-Assigned To:
+Assigned To: pollita
[2017-07-19 16:30 UTC] pollita@php.net
[2017-07-19 18:06 UTC] pollita@php.net
-Status: Verified
+Status: Closed
[2017-07-19 18:06 UTC] pollita@php.net
|
|||||||||||||||||||||||||||
Copyright © 2001-2025 The PHP GroupAll rights reserved. |
Last updated: Mon Nov 03 11:00:02 2025 UTC |
Description: ------------ After some fuzz testing I found a crashing test case. PHP 7.1.6 compiled from source with ASAN. To reproduce: /php-7.1.6/sapi/cli/php php_null_ptr_add_property_resource_ex.php ASAN report: ==21705==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000018 (pc 0x0000017f43a9 bp 0x7ffff9782530 sp 0x7ffff9782460 T0) ==21705==The signal is caused by a READ memory access. ==21705==Hint: address points to the zero page. #0 0x17f43a8 in add_property_resource_ex XYZ/php-7.1.6/Zend/zend_API.c:1722:2 #1 0x16167d7 in user_stream_create_object XYZ/php-7.1.6/main/streams/userspace.c:290:3 #2 0x1611afd in user_wrapper_opener XYZ/php-7.1.6/main/streams/userspace.c:357:2 #3 0x15f2121 in _php_stream_open_wrapper_ex XYZ/php-7.1.6/main/streams/streams.c:2055:13 #4 0x1391f60 in php_if_fopen XYZ/php-7.1.6/ext/standard/file.c:870:11 #5 0x10db629 in phar_fopen XYZ/php-7.1.6/ext/phar/func_interceptors.c:427:2 #6 0x1b0c5e2 in ZEND_DO_ICALL_SPEC_RETVAL_USED_HANDLER XYZ/php-7.1.6/Zend/zend_vm_execute.h:675:2 #7 0x19752fd in execute_ex XYZ/php-7.1.6/Zend/zend_vm_execute.h:432:7 #8 0x19762db in zend_execute XYZ/php-7.1.6/Zend/zend_vm_execute.h:474:2 #9 0x17d7f09 in zend_execute_scripts XYZ/php-7.1.6/Zend/zend.c:1476:4 #10 0x1570102 in php_execute_script XYZ/php-7.1.6/main/main.c:2537:14 #11 0x1c4b05d in do_cli XYZ/php-7.1.6/sapi/cli/php_cli.c:993:5 #12 0x1c478d5 in main XYZ/php-7.1.6/sapi/cli/php_cli.c:1381:18 #13 0x7f85bd76c82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) #14 0x43abf8 in _start (XYZ/php-7.1.6/sapi/cli/php+0x43abf8) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV XYZ/php-7.1.6/Zend/zend_API.c:1722:2 in add_property_resource_ex ==21705==ABORTING Test script: --------------- <?php trait Stream00ploiter{public function s(){}public function n($_){}}var_dump();stream_wrapper_register('e0ploit','Stream00ploiter');$s=fopen('e0ploit://',0);