Bug #69905 [NEW]: null ptr deref and segfault in ZEND_FETCH_DIM_RW_SPEC_VAR_UNUSED_HANDLER

From: brian dot carpenter at gmail dot com Operating system: Debian 7 PHP version: 7.0Git-2015-06-23 (Git) Package: Reproducible crash Bug Type: Bug Bug description:null ptr deref and segfault in ZEND_FETCH_DIM_RW_SPEC_VAR_UNUSED_HANDLER Description: ------------ While fuzzing PHP 7 built from git source with AFL (http://lcamtuf.coredump.cx/afl/), I discoved a script that causes a null ptr deref and a seg fault at ZEND_FETCH_DIM_RW_SPEC_VAR_UNUSED_HANDLER (zend_vm_execute.h:19170). Test script: --------------- <?md5(0)[]--; Expected result: ---------------- No crash. PHP 5.4.41-0+deb7u1 (cli) (built: May 22 2015 12:49:18) fails with the following: PHP Warning: md5() expects at least 1 parameter, 0 given in /home/geeknik/tmp/test.php on line 1 Actual result: -------------- Program received signal SIGSEGV, Segmentation fault. 0x000000000187175b in ZEND_FETCH_DIM_RW_SPEC_VAR_UNUSED_HANDLER ( execute_data=0x7ffff6013030) at /home/geeknik/php-src/Zend/zend_vm_execute.h:19170 19170 EXTRACT_ZVAL_PTR(EX_VAR(opline->result.var)); (gdb) bt #0 0x000000000187175b in ZEND_FETCH_DIM_RW_SPEC_VAR_UNUSED_HANDLER ( execute_data=0x7ffff6013030) at /home/geeknik/php-src/Zend/zend_vm_execute.h:19170 #1 0x0000000001703548 in execute_ex (ex=<optimized out>) at /home/geeknik/php-src/Zend/zend_vm_execute.h:406 #2 0x00000000018d3c0b in zend_execute ( op_array=op_array@entry=0x7ffff607f000, return_value=return_value@entry=0x0) at /home/geeknik/php-src/Zend/zend_vm_execute.h:447 #3 0x000000000154068d in zend_execute_scripts (type=type@entry=8, retval=retval@entry=0x0, file_count=file_count@entry=3) at /home/geeknik/php-src/Zend/zend.c:1389 #4 0x00000000012efaf8 in php_execute_script ( primary_file=primary_file@entry=0x7fffffffd270) at /home/geeknik/php-src/main/main.c:2475 #5 0x00000000018daa85 in do_cli (argc=2, argv=0x20509f0) at /home/geeknik/php-src/sapi/cli/php_cli.c:967 #6 0x0000000000458c15 in main (argc=2, argv=0x20509f0) at /home/geeknik/php-src/sapi/cli/php_cli.c:1334 (gdb) i r rax 0x0 0 rbx 0x7ffff6013030 140737320661040 rcx 0xc 12 rdx 0x1d19a40 30513728 rsi 0x14 20 rdi 0x7ffff60130a0 140737320661152 rbp 0x7ffff6013090 0x7ffff6013090 rsp 0x7fffffffacc0 0x7fffffffacc0 r8 0x0 0 r9 0x7ffff6070140 140737321042240 r10 0x7ffff606a040 140737321017408 r11 0x1 1 r12 0x7ffff6073480 140737321055360 r13 0x0 0 r14 0x0 0 r15 0x7ffff607f000 140737321103360 rip 0x187175b 0x187175b <ZEND_FETCH_DIM_RW_SPEC_VAR_UNUSED_HANDLER+1595> eflags 0x10246 [ PF ZF IF RF ] cs 0x33 51 ss 0x2b 43 ds 0x0 0 es 0x0 0 fs 0x0 0 gs 0x0 0 -- Edit bug report at https://bugs.php.net/bug.php?id=69905&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=69905&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=69905&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=69905&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=69905&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=69905&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=69905&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=69905&r=needscript Try newer version: https://bugs.php.net/fix.php?id=69905&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=69905&r=support Expected behavior: https://bugs.php.net/fix.php?id=69905&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=69905&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=69905&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=69905&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=69905&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=69905&r=dst IIS Stability: https://bugs.php.net/fix.php?id=69905&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=69905&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=69905&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=69905&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=69905&r=mysqlcfg