Bug #70912 [NEW]: Null ptr dereference instantiating class with invalid array property.

From: leigh@php.net Operating system: Linux PHP version: master-Git-2015-11-13 (Git) Package: Reproducible crash Bug Type: Bug Bug description:Null ptr dereference instantiating class with invalid array property. Description: ------------ Instantiating a class (normal or anonymous) that has property initialised with a double array short syntax causes a null pointer dereference in zend_ast_evaluate. PHP compiled with --disable-all. This affects 7.0alpha1 up to git-master - https://3v4l.org/cg1F3 Found with afl Test script: --------------- <?php new class { public $a = [][]; }; Expected result: ---------------- Exit code 0 Actual result: -------------- Program received signal SIGSEGV, Segmentation fault. 0x0000000000669709 in zend_ast_evaluate (result=0x7fffffffa160, ast=0x0, scope=0x0) at /home/leigh/php-src/Zend/zend_ast.c:217 217 switch (ast->kind) { Missing separate debuginfos, use: dnf debuginfo-install nss-softokn-freebl-3.20.1-1.0.fc23.x86_64 (gdb) bt #0 0x0000000000669709 in zend_ast_evaluate (result=0x7fffffffa160, ast=0x0, scope=0x0) at /home/leigh/php-src/Zend/zend_ast.c:217 #1 0x000000000066a305 in zend_ast_evaluate (result=0x7fffffffa280, ast=0x7ffff66020a8, scope=0x0) at /home/leigh/php-src/Zend/zend_ast.c:390 #2 0x000000000061712b in zval_update_constant_ex (p=0x7ffff66010f0, inline_change=1 '\001', scope=0x0) at /home/leigh/php-src/Zend/zend_execute_API.c:641 #3 0x0000000000633603 in zend_update_class_constants (class_type=0x7ffff6603018) at /home/leigh/php-src/Zend/zend_API.c:1155 #4 0x0000000000633bb9 in _object_and_properties_init (arg=0x7fffffffa4d0, class_type=0x7ffff6603018, properties=0x0, __zend_filename=0x87e988 "/home/leigh/php-src/Zend/zend_vm_execute.h", __zend_lineno=15353) at /home/leigh/php-src/Zend/zend_API.c:1273 #5 0x0000000000633cc7 in _object_init_ex (arg=0x7fffffffa4d0, class_type=0x7ffff6603018, __zend_filename=0x87e988 "/home/leigh/php-src/Zend/zend_vm_execute.h", __zend_lineno=15353) at /home/leigh/php-src/Zend/zend_API.c:1296 #6 0x00000000006a275e in ZEND_NEW_SPEC_VAR_HANDLER () at /home/leigh/php-src/Zend/zend_vm_execute.h:15353 #7 0x0000000000684d72 in execute_ex (ex=0x7ffff6614030) at /home/leigh/php-src/Zend/zend_vm_execute.h:414 #8 0x0000000000684e53 in zend_execute (op_array=0x7ffff6687000, return_value=0x0) at /home/leigh/php-src/Zend/zend_vm_execute.h:458 #9 0x000000000062e497 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /home/leigh/php-src/Zend/zend.c:1428 #10 0x00000000005aa22a in php_execute_script (primary_file=0x7fffffffdbc0) at /home/leigh/php-src/main/main.c:2471 #11 0x00000000006e62c9 in do_cli (argc=2, argv=0xafe4b0) at /home/leigh/php-src/sapi/cli/php_cli.c:974 #12 0x00000000006e7159 in main (argc=2, argv=0xafe4b0) at /home/leigh/php-src/sapi/cli/php_cli.c:1345 -- Edit bug report at https://bugs.php.net/bug.php?id=70912&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=70912&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=70912&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=70912&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=70912&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=70912&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=70912&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=70912&r=needscript Try newer version: https://bugs.php.net/fix.php?id=70912&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=70912&r=support Expected behavior: https://bugs.php.net/fix.php?id=70912&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=70912&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=70912&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=70912&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=70912&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=70912&r=dst IIS Stability: https://bugs.php.net/fix.php?id=70912&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=70912&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=70912&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=70912&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=70912&r=mysqlcfg