Bug #69815 [NEW]: null ptr deref and seg fault in convert_to_long_base (zend_operators.c:303)

From: brian dot carpenter at gmail dot com Operating system: Debian 7 PHP version: 7.0Git-2015-06-12 (Git) Package: Reproducible crash Bug Type: Bug Bug description:null ptr deref and seg fault in convert_to_long_base (zend_operators.c:303) Description: ------------ While fuzzing PHP 7 built from git source with AFL (http://lcamtuf.coredump.cx/afl/), I discoved a script that causes a null ptr deref and a seg fault in convert_to_long_base (zend_operators.c:303). Test script: --------------- <?php class SplMinHeap0 extends SplMinHeap{public function&compare($b){return$t;}}$h=new SplMinHeap0;$h->insert(0);$h->insert(0)?> Expected result: ---------------- No crash. Supplied code runs w/o error with PHP 5.4.41-0+deb7u1. Actual result: -------------- Program received signal SIGSEGV, Segmentation fault. 0x00000000013ecb24 in convert_to_long_base () at /home/geeknik/php-src/Zend/zend_operators.c:303 303 ZVAL_LONG(op, zend_dval_to_lval(Z_DVAL_P(op))); (gdb) bt #0 0x00000000013ecb24 in convert_to_long_base () at /home/geeknik/php-src/Zend/zend_operators.c:303 #1 0x0000000000ed940a in spl_ptr_heap_zval_min_cmp () #2 0x0000000000ed374a in spl_ptr_heap_insert () #3 0x0000000000ed3b59 in zim_spl_SplHeap_insert () #4 0x00000000017e73f9 in ZEND_DO_FCALL_SPEC_HANDLER () #5 0x00000000015daa93 in execute_ex () #6 0x00000000018006a5 in zend_execute () #7 0x000000000141027c in zend_execute_scripts () #8 0x00000000011c2a20 in php_execute_script () #9 0x0000000001807d05 in do_cli () at /home/geeknik/php-src/sapi/cli/php_cli.c:967 #10 0x000000000043c021 in main () at /home/geeknik/php-src/sapi/cli/php_cli.c:1334 (gdb) i r rax 0x0 0 rbx 0x1 1 rcx 0x0 0 rdx 0x55 85 rsi 0xa 10 rdi 0x7fffffffa800 140737488332800 rbp 0x1fd4440 0x1fd4440 rsp 0x7fffffffa7b0 0x7fffffffa7b0 r8 0x7ffff6013110 140737320661264 r9 0x20 32 r10 0x7ffff6055500 140737320932608 r11 0x7fffffffa620 140737488332320 r12 0x7fffffffa800 140737488332800 r13 0x7ffff6013130 140737320661296 r14 0x0 0 r15 0x7ffff6001150 140737320587600 rip 0x13ecb24 0x13ecb24 <convert_to_long_base+1316> eflags 0x10202 [ IF RF ] cs 0x33 51 ss 0x2b 43 ds 0x0 0 es 0x0 0 fs 0x0 0 gs 0x0 0 -- Edit bug report at https://bugs.php.net/bug.php?id=69815&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=69815&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=69815&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=69815&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=69815&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=69815&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=69815&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=69815&r=needscript Try newer version: https://bugs.php.net/fix.php?id=69815&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=69815&r=support Expected behavior: https://bugs.php.net/fix.php?id=69815&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=69815&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=69815&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=69815&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=69815&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=69815&r=dst IIS Stability: https://bugs.php.net/fix.php?id=69815&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=69815&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=69815&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=69815&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=69815&r=mysqlcfg