Bug #69788 [NEW]: Malformed script causes Uncaught EngineException in php-cgi, valgrind SIGILL

From: brian dot carpenter at gmail dot com Operating system: Debian 7 PHP version: master-Git-2015-06-09 (Git) Package: Reproducible crash Bug Type: Bug Bug description:Malformed script causes Uncaught EngineException in php-cgi, valgrind SIGILL Description: ------------ While fuzzing the latest PHP built from git source with AFL (http://lcamtuf.coredump.cx/afl/), I came across this bug. geeknik@h9n1:~$ ~/php-src/sapi/cgi/php-cgi -v PHP 7.0.0-dev (cgi-fcgi) (built: Jun 8 2015 12:00:13) Copyright (c) 1997-2015 The PHP Group Zend Engine v3.0.0-dev, Copyright (c) 1998-2015 Zend Technologies Test script: --------------- <?0/array(t.array())(); https://www.dropbox.com/s/msw5h4k4qaq2icg/test00-min?dl=0 Expected result: ---------------- PHP v5.4.41-0+deb7u1 (cli) returns the following: PHP Parse error: syntax error, unexpected '(' in /home/geeknik/php-tmp/out/fuzzer01/crashes/test00-min on line 1 Actual result: -------------- Valgrind: vex amd64->IR: unhandled instruction bytes: 0xF3 0x4D 0xF 0xBC 0xE4 0x45 0x1 0xC4 ==18903== valgrind: Unrecognised instruction at address 0x1319a3a. ==18903== at 0x1319A3A: zend_mm_alloc_pages (zend_alloc.c:483) ==18903== by 0x131B81C: zend_mm_alloc_small_slow (zend_alloc.c:1190) ==18903== by 0x155F573: virtual_cwd_startup (zend_virtual_cwd.c:431) ==18903== by 0x1412DCC: zend_startup (zend.c:640) ==18903== by 0x11C6F98: php_module_startup (main.c:2066) ==18903== by 0x181CFCC: php_cgi_startup (cgi_main.c:915) ==18903== by 0x43B4AC: main (cgi_main.c:1894) ==18903== Your program just tried to execute an instruction that Valgrind ==18903== did not recognise. There are two possible reasons for this. ==18903== 1. Your program has a bug and erroneously jumped to a non-code ==18903== location. If you are running Memcheck and you just saw a ==18903== warning about a bad jump, it's probably your program's fault. ==18903== 2. The instruction is legitimate but Valgrind doesn't handle it, ==18903== i.e. it's Valgrind's fault. If you think this is the case or ==18903== you are not sure, please let us know and we'll try to fix it. ==18903== Either way, Valgrind will now raise a SIGILL signal which will ==18903== probably kill your program. ==18903== ==18903== Process terminating with default action of signal 4 (SIGILL) ==18903== Illegal opcode at address 0x1319A3A ==18903== at 0x1319A3A: zend_mm_alloc_pages (zend_alloc.c:483) ==18903== by 0x131B81C: zend_mm_alloc_small_slow (zend_alloc.c:1190) ==18903== by 0x155F573: virtual_cwd_startup (zend_virtual_cwd.c:431) ==18903== by 0x1412DCC: zend_startup (zend.c:640) ==18903== by 0x11C6F98: php_module_startup (main.c:2066) ==18903== by 0x181CFCC: php_cgi_startup (cgi_main.c:915) ==18903== by 0x43B4AC: main (cgi_main.c:1894) Illegal instruction GDB: Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". X-Powered-By: PHP/7.0.0-dev Content-type: text/html; charset=UTF-8 <br /> <b>Fatal error</b>: Uncaught EngineException: Function name must be a string in /home/geeknik/php-tmp/out/fuzzer01/crashes/test00-min:1 Stack trace: #0 {main} thrown in <b>/home/geeknik/php-tmp/out/fuzzer01/crashes/test00-min</b> on line <b>1</b><br /> [Inferior 1 (process 41744) exited with code 0377] -- Edit bug report at https://bugs.php.net/bug.php?id=69788&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=69788&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=69788&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=69788&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=69788&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=69788&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=69788&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=69788&r=needscript Try newer version: https://bugs.php.net/fix.php?id=69788&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=69788&r=support Expected behavior: https://bugs.php.net/fix.php?id=69788&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=69788&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=69788&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=69788&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=69788&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=69788&r=dst IIS Stability: https://bugs.php.net/fix.php?id=69788&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=69788&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=69788&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=69788&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=69788&r=mysqlcfg