|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
PatchesPull RequestsHistoryAllCommentsChangesGit/SVN commits
[2019-10-21 07:58 UTC] nikic@php.net
-Status: Open
+Status: Duplicate
[2019-10-21 07:58 UTC] nikic@php.net
[2019-10-21 07:59 UTC] nikic@php.net
|
|||||||||||||||||||||||||||
Copyright © 2001-2025 The PHP GroupAll rights reserved. |
Last updated: Sun Oct 26 17:00:01 2025 UTC |
Description: ------------ #php test.php crash. Test script: --------------- test.php <?php spl_autoload_register(function ($name) { echo "IN: autoload($name)\n"; static $i = 0; if ($i++ > 10) { echo "-> Recursion detected - as expected.\n"; ; } class_exists('UndefinedClass' . $i); echo "OUT: autoload($name)\n"; }); var_dump(class_exists('UndefinedClass0')); ?> Expected result: ---------------- no crash. Actual result: -------------- Program received signal SIGSEGV, Segmentation fault. [----------------------------------registers-----------------------------------] RAX: 0x7ffff7fd4878 --> 0x555557804650 --> 0x55555799f6c0 --> 0x5555578046a0 --> 0x0 RBX: 0x0 RCX: 0x555557808600 --> 0x0 RDX: 0x55555799f6c0 --> 0x5555578046a0 --> 0x0 RSI: 0x555557804650 --> 0x55555799f6c0 --> 0x5555578046a0 --> 0x0 RDI: 0x7fffff7ff180 --> 0x38 ('8') RBP: 0x7fffff7ff180 --> 0x38 ('8') RSP: 0x7fffff7fefc8 RIP: 0x555556dc9e7c (<zend_call_function+172>: mov QWORD PTR [rsp],rdx) R8 : 0x55555785a7b0 --> 0x10000000001 R9 : 0x48 ('H') R10: 0x555557808600 --> 0x0 R11: 0x555557808600 --> 0x0 R12: 0x7fffff7ff160 --> 0x55555785a7b0 --> 0x10000000001 R13: 0x5555577f02c8 --> 0x9 ('\t') R14: 0x7fffff7ff1c0 --> 0x7ffff1d23000 --> 0x600000002 R15: 0x5555577f02c8 --> 0x9 ('\t') EFLAGS: 0x10202 (carry parity adjust zero sign trap INTERRUPT direction overflow) [-------------------------------------code-------------------------------------] 0x555556dc9e67 <zend_call_function+151>: cmp BYTE PTR [rcx+0x3e0],0x0 0x555556dc9e6e <zend_call_function+158>: je 0x555556dca92c <zend_call_function+2908> 0x555556dc9e74 <zend_call_function+164>: lea rsp,[rsp-0x98] => 0x555556dc9e7c <zend_call_function+172>: mov QWORD PTR [rsp],rdx 0x555556dc9e80 <zend_call_function+176>: mov QWORD PTR [rsp+0x8],rcx 0x555556dc9e85 <zend_call_function+181>: mov QWORD PTR [rsp+0x10],rax 0x555556dc9e8a <zend_call_function+186>: mov rcx,0xd8ba 0x555556dc9e91 <zend_call_function+193>: call 0x555556dd77b8 <__afl_maybe_log> [------------------------------------stack-------------------------------------] Invalid $SP address: 0x7fffff7fefc8 [------------------------------------------------------------------------------] Legend: code, data, rodata, value Stopped reason: SIGSEGV 0x0000555556dc9e7c in zend_call_function (fci=0x7fffff7ff180, fci_cache=0x7fffff7ff160) at /home/fuzz/Desktop/fuzz_php/php-7.3.10/Zend/zend_execute_API.c:611 611 if (!EG(active)) { gdb-peda$