Bug #70782 [NEW]: null ptr deref and segfault (zend_get_class_fetch_type (zend_compile.c:1322))

From: brian dot carpenter at gmail dot com Operating system: Debian 7 x64 PHP version: 7.0Git-2015-10-24 (Git) Package: Reproducible crash Bug Type: Bug Bug description:null ptr deref and segfault (zend_get_class_fetch_type (zend_compile.c:1322)) Description: ------------ While fuzzing PHP 7.1.0-dev (cli) (built: Oct 22 2015 08:22:38) ( NTS ) with American Fuzzy Lop, I was able to trigger a null ptr deref and segfault. Test script: --------------- <?for(;;){?><?(-0)::$h;} Expected result: ---------------- No crash. For example, PHP 5.4.45-0+deb7u1 fails with the following error: PHP Parse error: syntax error, unexpected '::' (T_PAAMAYIM_NEKUDOTAYIM) in /home/geeknik/php-tmp/out/crashes/test0 on line 1 Actual result: -------------- valgrind -q ~/php-src/sapi/cli/php test0 ==7684== Conditional jump or move depends on uninitialised value(s) ==7684== at 0x15F013E: zend_hash_find (zend_hash.c:439) ==7684== by 0x17157BC: zend_do_inheritance (zend_inheritance.c:602) ==7684== by 0x158D5DA: zend_register_internal_class_ex (zend_API.c:2662) ==7684== by 0x164CEAE: zend_register_default_exception (zend_exceptions.c:862) ==7684== by 0x17059F5: zend_register_default_classes (zend_default_classes.c:34) ==7684== by 0x161A939: zm_startup_core (zend_builtin_functions.c:340) ==7684== by 0x157E797: zend_startup_module_ex (zend_API.c:1829) ==7684== by 0x15DB519: zend_hash_apply (zend_hash.c:1460) ==7684== by 0x1583225: zend_startup_modules (zend_API.c:1955) ==7684== by 0x1314AD9: php_module_startup (main.c:2194) ==7684== by 0x18F0C54: php_cli_startup (php_cli.c:423) ==7684== by 0x468257: main (php_cli.c:1325) ==7684== ==7684== Conditional jump or move depends on uninitialised value(s) ==7684== at 0x15F04DD: zend_hash_find (zend_hash.c:439) ==7684== by 0x17157BC: zend_do_inheritance (zend_inheritance.c:602) ==7684== by 0x158D5DA: zend_register_internal_class_ex (zend_API.c:2662) ==7684== by 0x164CEAE: zend_register_default_exception (zend_exceptions.c:862) ==7684== by 0x17059F5: zend_register_default_classes (zend_default_classes.c:34) ==7684== by 0x161A939: zm_startup_core (zend_builtin_functions.c:340) ==7684== by 0x157E797: zend_startup_module_ex (zend_API.c:1829) ==7684== by 0x15DB519: zend_hash_apply (zend_hash.c:1460) ==7684== by 0x1583225: zend_startup_modules (zend_API.c:1955) ==7684== by 0x1314AD9: php_module_startup (main.c:2194) ==7684== by 0x18F0C54: php_cli_startup (php_cli.c:423) ==7684== by 0x468257: main (php_cli.c:1325) ==7684== ==7684== Conditional jump or move depends on uninitialised value(s) ==7684== at 0x15F013E: zend_hash_find (zend_hash.c:439) ==7684== by 0x17157BC: zend_do_inheritance (zend_inheritance.c:602) ==7684== by 0x158D5DA: zend_register_internal_class_ex (zend_API.c:2662) ==7684== by 0x164D32D: zend_register_default_exception (zend_exceptions.c:880) ==7684== by 0x17059F5: zend_register_default_classes (zend_default_classes.c:34) ==7684== by 0x161A939: zm_startup_core (zend_builtin_functions.c:340) ==7684== by 0x157E797: zend_startup_module_ex (zend_API.c:1829) ==7684== by 0x15DB519: zend_hash_apply (zend_hash.c:1460) ==7684== by 0x1583225: zend_startup_modules (zend_API.c:1955) ==7684== by 0x1314AD9: php_module_startup (main.c:2194) ==7684== by 0x18F0C54: php_cli_startup (php_cli.c:423) ==7684== by 0x468257: main (php_cli.c:1325) ==7684== ==7684== Conditional jump or move depends on uninitialised value(s) ==7684== at 0x15F04DD: zend_hash_find (zend_hash.c:439) ==7684== by 0x17157BC: zend_do_inheritance (zend_inheritance.c:602) ==7684== by 0x158D5DA: zend_register_internal_class_ex (zend_API.c:2662) ==7684== by 0x164D32D: zend_register_default_exception (zend_exceptions.c:880) ==7684== by 0x17059F5: zend_register_default_classes (zend_default_classes.c:34) ==7684== by 0x161A939: zm_startup_core (zend_builtin_functions.c:340) ==7684== by 0x157E797: zend_startup_module_ex (zend_API.c:1829) ==7684== by 0x15DB519: zend_hash_apply (zend_hash.c:1460) ==7684== by 0x1583225: zend_startup_modules (zend_API.c:1955) ==7684== by 0x1314AD9: php_module_startup (main.c:2194) ==7684== by 0x18F0C54: php_cli_startup (php_cli.c:423) ==7684== by 0x468257: main (php_cli.c:1325) ==7684== ==7684== Conditional jump or move depends on uninitialised value(s) ==7684== at 0x15F013E: zend_hash_find (zend_hash.c:439) ==7684== by 0x17157BC: zend_do_inheritance (zend_inheritance.c:602) ==7684== by 0x158D5DA: zend_register_internal_class_ex (zend_API.c:2662) ==7684== by 0x164D4EF: zend_register_default_exception (zend_exceptions.c:884) ==7684== by 0x17059F5: zend_register_default_classes (zend_default_classes.c:34) ==7684== by 0x161A939: zm_startup_core (zend_builtin_functions.c:340) ==7684== by 0x157E797: zend_startup_module_ex (zend_API.c:1829) ==7684== by 0x15DB519: zend_hash_apply (zend_hash.c:1460) ==7684== by 0x1583225: zend_startup_modules (zend_API.c:1955) ==7684== by 0x1314AD9: php_module_startup (main.c:2194) ==7684== by 0x18F0C54: php_cli_startup (php_cli.c:423) ==7684== by 0x468257: main (php_cli.c:1325) ==7684== ==7684== Conditional jump or move depends on uninitialised value(s) ==7684== at 0x15F04DD: zend_hash_find (zend_hash.c:439) ==7684== by 0x17157BC: zend_do_inheritance (zend_inheritance.c:602) ==7684== by 0x158D5DA: zend_register_internal_class_ex (zend_API.c:2662) ==7684== by 0x164D4EF: zend_register_default_exception (zend_exceptions.c:884) ==7684== by 0x17059F5: zend_register_default_classes (zend_default_classes.c:34) ==7684== by 0x161A939: zm_startup_core (zend_builtin_functions.c:340) ==7684== by 0x157E797: zend_startup_module_ex (zend_API.c:1829) ==7684== by 0x15DB519: zend_hash_apply (zend_hash.c:1460) ==7684== by 0x1583225: zend_startup_modules (zend_API.c:1955) ==7684== by 0x1314AD9: php_module_startup (main.c:2194) ==7684== by 0x18F0C54: php_cli_startup (php_cli.c:423) ==7684== by 0x468257: main (php_cli.c:1325) ==7684== ==7684== Conditional jump or move depends on uninitialised value(s) ==7684== at 0x15F013E: zend_hash_find (zend_hash.c:439) ==7684== by 0x17157BC: zend_do_inheritance (zend_inheritance.c:602) ==7684== by 0x158D5DA: zend_register_internal_class_ex (zend_API.c:2662) ==7684== by 0x164D6BE: zend_register_default_exception (zend_exceptions.c:888) ==7684== by 0x17059F5: zend_register_default_classes (zend_default_classes.c:34) ==7684== by 0x161A939: zm_startup_core (zend_builtin_functions.c:340) ==7684== by 0x157E797: zend_startup_module_ex (zend_API.c:1829) ==7684== by 0x15DB519: zend_hash_apply (zend_hash.c:1460) ==7684== by 0x1583225: zend_startup_modules (zend_API.c:1955) ==7684== by 0x1314AD9: php_module_startup (main.c:2194) ==7684== by 0x18F0C54: php_cli_startup (php_cli.c:423) ==7684== by 0x468257: main (php_cli.c:1325) ==7684== ==7684== Conditional jump or move depends on uninitialised value(s) ==7684== at 0x15F04DD: zend_hash_find (zend_hash.c:439) ==7684== by 0x17157BC: zend_do_inheritance (zend_inheritance.c:602) ==7684== by 0x158D5DA: zend_register_internal_class_ex (zend_API.c:2662) ==7684== by 0x164D6BE: zend_register_default_exception (zend_exceptions.c:888) ==7684== by 0x17059F5: zend_register_default_classes (zend_default_classes.c:34) ==7684== by 0x161A939: zm_startup_core (zend_builtin_functions.c:340) ==7684== by 0x157E797: zend_startup_module_ex (zend_API.c:1829) ==7684== by 0x15DB519: zend_hash_apply (zend_hash.c:1460) ==7684== by 0x1583225: zend_startup_modules (zend_API.c:1955) ==7684== by 0x1314AD9: php_module_startup (main.c:2194) ==7684== by 0x18F0C54: php_cli_startup (php_cli.c:423) ==7684== by 0x468257: main (php_cli.c:1325) ==7684== ==7684== Conditional jump or move depends on uninitialised value(s) ==7684== at 0x15F013E: zend_hash_find (zend_hash.c:439) ==7684== by 0x17157BC: zend_do_inheritance (zend_inheritance.c:602) ==7684== by 0x158D5DA: zend_register_internal_class_ex (zend_API.c:2662) ==7684== by 0x164D88A: zend_register_default_exception (zend_exceptions.c:892) ==7684== by 0x17059F5: zend_register_default_classes (zend_default_classes.c:34) ==7684== by 0x161A939: zm_startup_core (zend_builtin_functions.c:340) ==7684== by 0x157E797: zend_startup_module_ex (zend_API.c:1829) ==7684== by 0x15DB519: zend_hash_apply (zend_hash.c:1460) ==7684== by 0x1583225: zend_startup_modules (zend_API.c:1955) ==7684== by 0x1314AD9: php_module_startup (main.c:2194) ==7684== by 0x18F0C54: php_cli_startup (php_cli.c:423) ==7684== by 0x468257: main (php_cli.c:1325) ==7684== ==7684== Conditional jump or move depends on uninitialised value(s) ==7684== at 0x15F04DD: zend_hash_find (zend_hash.c:439) ==7684== by 0x17157BC: zend_do_inheritance (zend_inheritance.c:602) ==7684== by 0x158D5DA: zend_register_internal_class_ex (zend_API.c:2662) ==7684== by 0x164D88A: zend_register_default_exception (zend_exceptions.c:892) ==7684== by 0x17059F5: zend_register_default_classes (zend_default_classes.c:34) ==7684== by 0x161A939: zm_startup_core (zend_builtin_functions.c:340) ==7684== by 0x157E797: zend_startup_module_ex (zend_API.c:1829) ==7684== by 0x15DB519: zend_hash_apply (zend_hash.c:1460) ==7684== by 0x1583225: zend_startup_modules (zend_API.c:1955) ==7684== by 0x1314AD9: php_module_startup (main.c:2194) ==7684== by 0x18F0C54: php_cli_startup (php_cli.c:423) ==7684== by 0x468257: main (php_cli.c:1325) ==7684== ==7684== Conditional jump or move depends on uninitialised value(s) ==7684== at 0x15F013E: zend_hash_find (zend_hash.c:439) ==7684== by 0x17157BC: zend_do_inheritance (zend_inheritance.c:602) ==7684== by 0x158D5DA: zend_register_internal_class_ex (zend_API.c:2662) ==7684== by 0x16A37AC: zend_register_generator_ce (zend_generators.c:1124) ==7684== by 0x161A939: zm_startup_core (zend_builtin_functions.c:340) ==7684== by 0x157E797: zend_startup_module_ex (zend_API.c:1829) ==7684== by 0x15DB519: zend_hash_apply (zend_hash.c:1460) ==7684== by 0x1583225: zend_startup_modules (zend_API.c:1955) ==7684== by 0x1314AD9: php_module_startup (main.c:2194) ==7684== by 0x18F0C54: php_cli_startup (php_cli.c:423) ==7684== by 0x468257: main (php_cli.c:1325) ==7684== ==7684== Conditional jump or move depends on uninitialised value(s) ==7684== at 0x15F04DD: zend_hash_find (zend_hash.c:439) ==7684== by 0x17157BC: zend_do_inheritance (zend_inheritance.c:602) ==7684== by 0x158D5DA: zend_register_internal_class_ex (zend_API.c:2662) ==7684== by 0x16A37AC: zend_register_generator_ce (zend_generators.c:1124) ==7684== by 0x161A939: zm_startup_core (zend_builtin_functions.c:340) ==7684== by 0x157E797: zend_startup_module_ex (zend_API.c:1829) ==7684== by 0x15DB519: zend_hash_apply (zend_hash.c:1460) ==7684== by 0x1583225: zend_startup_modules (zend_API.c:1955) ==7684== by 0x1314AD9: php_module_startup (main.c:2194) ==7684== by 0x18F0C54: php_cli_startup (php_cli.c:423) ==7684== by 0x468257: main (php_cli.c:1325) ==7684== ==7684== Invalid read of size 8 ==7684== at 0x1495EC6: zend_get_class_fetch_type (zend_compile.c:1322) ==7684== by 0x14C6214: zend_compile_class_ref (zend_compile.c:2130) ==7684== by 0x14CECA7: zend_compile_static_prop_common (zend_compile.c:2364) ==7684== by 0x14CF253: zend_compile_static_prop (zend_compile.c:2392) ==7684== by 0x14C241A: zend_compile_expr (zend_compile.c:7104) ==7684== by 0x14BF62A: zend_compile_stmt (zend_compile.c:7073) ==7684== by 0x14E106E: zend_compile_stmt_list (zend_compile.c:4340) ==7684== by 0x14BF143: zend_compile_stmt (zend_compile.c:6985) ==7684== by 0x14E7201: zend_compile_for (zend_compile.c:3853) ==7684== by 0x14BFA67: zend_compile_stmt (zend_compile.c:7022) ==7684== by 0x14E9665: zend_compile_top_stmt (zend_compile.c:6959) ==7684== by 0x13E34F7: compile_file (zend_language_scanner.l:607) ==7684== Address 0x10 is not stack'd, malloc'd or (recently) free'd ==7684== ==7684== ==7684== Process terminating with default action of signal 11 (SIGSEGV) ==7684== Access not within mapped region at address 0x10 ==7684== at 0x1495EC6: zend_get_class_fetch_type (zend_compile.c:1322) ==7684== by 0x14C6214: zend_compile_class_ref (zend_compile.c:2130) ==7684== by 0x14CECA7: zend_compile_static_prop_common (zend_compile.c:2364) ==7684== by 0x14CF253: zend_compile_static_prop (zend_compile.c:2392) ==7684== by 0x14C241A: zend_compile_expr (zend_compile.c:7104) ==7684== by 0x14BF62A: zend_compile_stmt (zend_compile.c:7073) ==7684== by 0x14E106E: zend_compile_stmt_list (zend_compile.c:4340) ==7684== by 0x14BF143: zend_compile_stmt (zend_compile.c:6985) ==7684== by 0x14E7201: zend_compile_for (zend_compile.c:3853) ==7684== by 0x14BFA67: zend_compile_stmt (zend_compile.c:7022) ==7684== by 0x14E9665: zend_compile_top_stmt (zend_compile.c:6959) ==7684== by 0x13E34F7: compile_file (zend_language_scanner.l:607) ==7684== If you believe this happened as a result of a stack ==7684== overflow in your program's main thread (unlikely but ==7684== possible), you can try to increase the size of the ==7684== main thread stack using the --main-stacksize= flag. ==7684== The main thread stack size used in this run was 8388608. Segmentation fault Program received signal SIGSEGV, Segmentation fault. zend_get_class_fetch_type (name=0x0) at /home/geeknik/php-src/Zend/zend_compile.c:1322 1322 if (zend_string_equals_literal_ci(name, "self")) { (gdb) bt #0 zend_get_class_fetch_type (name=0x0) at /home/geeknik/php-src/Zend/zend_compile.c:1322 #1 0x00000000014c6215 in zend_compile_class_ref (result=result@entry=0x7fffffffa740, name_ast=name_ast@entry=0x7ffff6077090, throw_exception=throw_exception@entry=1) at /home/geeknik/php-src/Zend/zend_compile.c:2130 #2 0x00000000014ceca8 in zend_compile_static_prop_common (result=0x7fffffffa870, ast=<optimized out>, type=type@entry=0, delayed=0) at /home/geeknik/php-src/Zend/zend_compile.c:2364 #3 0x00000000014cf254 in zend_compile_static_prop (result=<optimized out>, ast=<optimized out>, type=0, delayed=<optimized out>) at /home/geeknik/php-src/Zend/zend_compile.c:2392 #4 0x00000000014c241b in zend_compile_expr (result=result@entry=0x7fffffffa870, ast=ast@entry=0x7ffff60770b8) at /home/geeknik/php-src/Zend/zend_compile.c:7104 #5 0x00000000014bf62b in zend_compile_stmt (ast=0x7ffff60770b8) at /home/geeknik/php-src/Zend/zend_compile.c:7073 #6 0x00000000014e106f in zend_compile_stmt_list (ast=ast@entry=0x7ffff6077048) at /home/geeknik/php-src/Zend/zend_compile.c:4340 #7 0x00000000014bf144 in zend_compile_stmt (ast=ast@entry=0x7ffff6077048) at /home/geeknik/php-src/Zend/zend_compile.c:6985 #8 0x00000000014e7202 in zend_compile_for (ast=ast@entry=0x7ffff60770d0) at /home/geeknik/php-src/Zend/zend_compile.c:3853 #9 0x00000000014bfa68 in zend_compile_stmt (ast=ast@entry=0x7ffff60770d0) at /home/geeknik/php-src/Zend/zend_compile.c:7022 #10 0x00000000014e9666 in zend_compile_top_stmt (ast=0x7ffff60770d0) at /home/geeknik/php-src/Zend/zend_compile.c:6959 #11 zend_compile_top_stmt (ast=0x7ffff6077018) at /home/geeknik/php-src/Zend/zend_compile.c:6954 #12 0x00000000013e34f8 in compile_file (file_handle=<optimized out>, type=<optimized out>) at Zend/zend_language_scanner.l:607 #13 0x0000000000e95f50 in phar_compile_file (file_handle=0x7fffffffd270, type=8) at /home/geeknik/php-src/ext/phar/phar.c:3311 #14 0x0000000001565777 in zend_execute_scripts (type=type@entry=8, retval=retval@entry=0x0, file_count=file_count@entry=3) at /home/geeknik/php-src/Zend/zend.c:1422 #15 0x00000000013172a8 in php_execute_script (primary_file=primary_file@entry=0x7fffffffd270) at /home/geeknik/php-src/main/main.c:2471 #16 0x00000000018f5485 in do_cli (argc=2, argv=0x206d9f0) at /home/geeknik/php-src/sapi/cli/php_cli.c:974 #17 0x0000000000468e05 in main (argc=2, argv=0x206d9f0) at /home/geeknik/php-src/sapi/cli/php_cli.c:1345 (gdb) i r rax 0x0 0 rbx 0x7fffffffa740 140737488332608 rcx 0x4 4 rdx 0x0 0 rsi 0x0 0 rdi 0x0 0 rbp 0x7ffff6077090 0x7ffff6077090 rsp 0x7fffffffa6c0 0x7fffffffa6c0 r8 0x4 4 r9 0x0 0 r10 0x0 0 r11 0x7ffff6b53fb0 140737332461488 r12 0x1 1 r13 0x0 0 r14 0x7ffff60770b8 140737321070776 r15 0x7fffffffa870 140737488332912 rip 0x1495ec6 0x1495ec6 <zend_get_class_fetch_type+86> eflags 0x10246 [ PF ZF IF RF ] cs 0x33 51 ss 0x2b 43 ds 0x0 0 es 0x0 0 fs 0x0 0 gs 0x0 0 -- Edit bug report at https://bugs.php.net/bug.php?id=70782&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=70782&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=70782&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=70782&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=70782&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=70782&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=70782&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=70782&r=needscript Try newer version: https://bugs.php.net/fix.php?id=70782&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=70782&r=support Expected behavior: https://bugs.php.net/fix.php?id=70782&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=70782&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=70782&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=70782&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=70782&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=70782&r=dst IIS Stability: https://bugs.php.net/fix.php?id=70782&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=70782&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=70782&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=70782&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=70782&r=mysqlcfg