Sec Bug->Bug #66990 [Fbk]: PHP crashes without warning after running a specific array through json_encode.

Edit report at https://bugs.php.net/bug.php?id=66990&edit=1 ID: 66990 Updated by: stas@php.net Reported by: agamemnus at flyingsoft dot phatcode dot net Summary: PHP crashes without warning after running a specific array through json_encode. Status: Feedback -Type: Security +Type: Bug Package: Reproducible crash Operating System: CentOS (Apache/2.4.7) PHP Version: 5.5.10 Block user comment: N Private report: Y Previous Comments: ------------------------------------------------------------------------ [2014-03-31 19:27:36] rasmus@php.net Clean memcheck run here on 5.5.8 and 5.5.10 as well Could this be in a distro-replacement json implementation, perhaps? Are you using PHP from php.net or a packaged version from somewhere else? ------------------------------------------------------------------------ [2014-03-31 19:14:00] tony2001@php.net The scripts works fine here and Valgrind doesn't show any warnings. Please generate a backtrace using the instructions described here: https://bugs.php.net/bugs-generating-backtrace.php and add the result to the report. ------------------------------------------------------------------------ [2014-03-31 17:50:22] agamemnus at flyingsoft dot phatcode dot net Description: ------------ Run this program through PHP: http://pastebin.com/iAPmD5hJ (this will expire in 1 month; please do not make copies) It will crash PHP. Potential security risk here as parsing JSON code is not expected to crash PHP. Test script: --------------- http://pastebin.com/iAPmD5hJ Expected result: ---------------- Expect not to crash. Actual result: -------------- Crashes. ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=66990&edit=1