php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #68151 VLD may crash when parsing break/continue statment
Submitted: 2014-10-04 11:05 UTC Modified: 2016-08-08 16:21 UTC
From: mfmans at gmail dot com Assigned: cmb (profile)
Status: Closed Package: vld (PECL)
PHP Version: 5.4.33 OS: Windows 8.1
Private report: No CVE-ID: None
View Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
If you reported this bug, you can edit this bug over here.
Block user comment
Status: Assign to:
Package:
Bug Type:
Summary:
From: mfmans at gmail dot com
New email:
PHP Version: OS:

 

 [2014-10-04 11:05 UTC] mfmans at gmail dot com
Description:
------------
VLD 0.12.0 may crash when parsing break/continue statement on PHP 5.4

I found out vld_find_brk_cont() causes this problem (memory access violation).

I fixed it by this way:
srm_oparray.c, line 664, "op.op2.constant" -> "op.op2.zv->value.lval"


It works. But I do not ensure this is the right way.

Test script:
---------------
while(1) {
    break;
}

Expected result:
----------------
3   0  > > JMPZ         1, ->3
4   1  > > BRK          1, ->3
5   2*     JMP             ->0
6   3  > > RETURN       1

Actual result:
--------------
3   0  > > JMPZ         1, ->3
4   1  > > BRK          1, [[[ a random value ]]]
5   2*     JMP             ->0
6   3  > > RETURN       1


or crash directly

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2016-08-08 16:21 UTC] cmb@php.net
-Status: Open +Status: Closed -Assigned To: +Assigned To: cmb
 [2016-08-08 16:21 UTC] cmb@php.net
This issue has been fixed in vld-0.13.0.tgz, see
<https://github.com/derickr/vld/commit/efbcfa7>.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Thu Oct 03 10:01:27 2024 UTC