Bug #68396 [NEW]: iconv null pointer write with zend_mm

From: mattficken Operating system: Windows PHP version: 5.5.18 Package: CGI/CLI related Bug Type: Bug Bug description:iconv null pointer write with zend_mm Description: ------------ Actually PHP Version: 5.5.13 <could be any more recent version> Event: NULL_CLASS_PTR_WRITE 0xc0000005 in php5.dll SAPI: php-cgi.exe OS: Windows 7.0, 8.0, mostly French and Chinese LCIDs The fact it happens in 5 different threads suggests it may not be fault of iconv ext, instead could be some other threading/mm issue in core providing iconv an invalid pointer which it uses at the the right/wrong time to cause crash. Stack traces of user-mode application crashes on Windows can (with user consent) be reported to Microsoft (see Windows Error Reporting and Watson). This bug is based on one of those reports. Note: can request additional information including memory dumps to help investigate this issue further. Watson #73491156297 Actual result: -------------- NOTE: aaaaaaaa indicates NULL, indicates either stack corruption or some frames missing due to dump -> minidump conversion Thread 0 01bd84ac aaaaaaaa php5!_zend_mm_free_int+0x2ae [c:\php-sdk\php55\vc11\x86\php-5.5.13\zend\zend_alloc.c @ 2110] 01bd84b0 01000000 0xaaaaaaaa 01bd84b4 aaaaaaaa iconv+0x20000 01bd84b8 aaaaaaaa 0xaaaaaaaa 01bd84bc 00000000 0xaaaaaaaa Thread 1 01bd84ac aaaaaaaa php5!_zend_mm_free_int+0x2ae [c:\php-sdk\php55\vc11\x86\php-5.5.13\zend\zend_alloc.c @ 2110] 01bd84b0 01000000 0xaaaaaaaa 01bd84b4 aaaaaaaa iconv+0x20000 01bd84b8 aaaaaaaa 0xaaaaaaaa 01bd84bc 00000000 0xaaaaaaaa Thread 2 01bd84ac aaaaaaaa php5!_zend_mm_free_int+0x2ae [c:\php-sdk\php55\vc11\x86\php-5.5.13\zend\zend_alloc.c @ 2110] 01bd84b0 01000000 0xaaaaaaaa 01bd84b4 aaaaaaaa iconv+0x20000 01bd84b8 aaaaaaaa 0xaaaaaaaa 01bd84bc 00000000 0xaaaaaaaa Thread 3 01bd84ac aaaaaaaa php5!_zend_mm_free_int+0x2ae [c:\php-sdk\php55\vc11\x86\php-5.5.13\zend\zend_alloc.c @ 2110] 01bd84b0 01000000 0xaaaaaaaa 01bd84b4 aaaaaaaa iconv+0x20000 01bd84b8 aaaaaaaa 0xaaaaaaaa 01bd84bc 00000000 0xaaaaaaaa Thread 4 01bd84ac aaaaaaaa php5!_zend_mm_free_int+0x2ae [c:\php-sdk\php55\vc11\x86\php-5.5.13\zend\zend_alloc.c @ 2110] 01bd84b0 01000000 0xaaaaaaaa 01bd84b4 aaaaaaaa iconv+0x20000 01bd84b8 aaaaaaaa 0xaaaaaaaa 01bd84bc 00000000 0xaaaaaaaa Thread 5 01bd84ac aaaaaaaa php5!_zend_mm_free_int+0x2ae [c:\php-sdk\php55\vc11\x86\php-5.5.13\zend\zend_alloc.c @ 2110] 01bd84b0 01000000 0xaaaaaaaa 01bd84b4 aaaaaaaa iconv+0x20000 01bd84b8 aaaaaaaa 0xaaaaaaaa 01bd84bc 00000000 0xaaaaaaaa -- Edit bug report at https://bugs.php.net/bug.php?id=68396&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=68396&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=68396&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=68396&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=68396&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=68396&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=68396&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=68396&r=needscript Try newer version: https://bugs.php.net/fix.php?id=68396&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=68396&r=support Expected behavior: https://bugs.php.net/fix.php?id=68396&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=68396&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=68396&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=68396&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=68396&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=68396&r=dst IIS Stability: https://bugs.php.net/fix.php?id=68396&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=68396&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=68396&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=68396&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=68396&r=mysqlcfg