Bug #69054 [NEW]: Null dereference in readline_(read|write)_history() without parameters

From: dx at dxzone dot com dot ar Operating system: Arch linux and debian jessie PHP version: 5.6.5 Package: Reproducible crash Bug Type: Bug Bug description:Null dereference in readline_(read|write)_history() without parameters Description: ------------ Calling readline_read_history() or readline_write_history() without parameters results in a null pointer dereference in php_check_open_basedir_ex() when it calls strlen(path). "open_basedir" in php.ini needs to have a value set for this to crash. If it's unset, it doesn't crash. I reproduced this in both my arch linux desktop (with 5.6.5 PKGBUILD modified to have --enable-debug) and a stock unmodified PHP 5.6.4 from the debian jessie repos. The issue itself in a real world situation has been reported here https://github.com/bobthecow/psysh/issues/99 (although quickly dismissed since commenting open_basedir is a workaround) and the relevant function call is here https://github.com/bobthecow/psysh/blob/master/src/Psy/Readline/GNUReadline.php#L86 Attached a patch against today's git master that fixes the issue for me by adding a null check to php_check_open_basedir_ex(). Test script: --------------- <?php readline_read_history(); Actual result: -------------- Program received signal SIGSEGV, Segmentation fault. strlen () at ../sysdeps/x86_64/strlen.S:106 106 movdqu (%rax), %xmm12 (gdb) bt #0 strlen () at ../sysdeps/x86_64/strlen.S:106 #1 0x00000000006f0629 in php_check_open_basedir_ex (path=0x0, warn=1) at /.../php/src/php-5.6.5/main/fopen_wrappers.c:303 #2 0x00000000006f05e2 in php_check_open_basedir (path=0x0) at /.../php/src/php-5.6.5/main/fopen_wrappers.c:288 #3 0x000000000055f97e in zif_readline_read_history (ht=0, return_value=0x7ffff7ff1f50, return_value_ptr=0x7ffff7fb81e8, this_ptr=0x0, return_value_used=0) at /.../php/src/php-5.6.5/ext/readline/readline.c:403 #4 0x00000000007c35af in zend_do_fcall_common_helper_SPEC (execute_data=0x7ffff7fb8200) at /.../php/src/php-5.6.5/Zend/zend_vm_execute.h:558 #5 0x00000000007c8e5c in ZEND_DO_FCALL_SPEC_CONST_HANDLER (execute_data=0x7ffff7fb8200) at /.../php/src/php-5.6.5/Zend/zend_vm_execute.h:2595 #6 0x00000000007c2c18 in execute_ex (execute_data=0x7ffff7fb8200) at /.../php/src/php-5.6.5/Zend/zend_vm_execute.h:363 #7 0x00000000007c2ca1 in zend_execute (op_array=0x7ffff7ff2d98) at /.../php/src/php-5.6.5/Zend/zend_vm_execute.h:388 #8 0x000000000077f4b6 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /.../php/src/php-5.6.5/Zend/zend.c:1341 #9 0x00000000006eac04 in php_execute_script (primary_file=0x7fffffffdf10) at /.../php/src/php-5.6.5/main/main.c:2584 #10 0x0000000000830a3c in do_cli (argc=2, argv=0x11d82e0) at /.../php/src/php-5.6.5/sapi/cli/php_cli.c:994 #11 0x0000000000831b49 in main (argc=2, argv=0x11d82e0) at /.../php/src/php-5.6.5/sapi/cli/php_cli.c:1378 -- Edit bug report at https://bugs.php.net/bug.php?id=69054&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=69054&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=69054&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=69054&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=69054&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=69054&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=69054&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=69054&r=needscript Try newer version: https://bugs.php.net/fix.php?id=69054&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=69054&r=support Expected behavior: https://bugs.php.net/fix.php?id=69054&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=69054&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=69054&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=69054&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=69054&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=69054&r=dst IIS Stability: https://bugs.php.net/fix.php?id=69054&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=69054&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=69054&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=69054&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=69054&r=mysqlcfg