Bug #70947 [NEW]: INI parser segfault with INI_SCANNER_TYPED

From: samuli dot kauranne at naturalsciences dot be Operating system: * PHP version: 7.0.0RC7 Package: Filesystem function related Bug Type: Bug Bug description:INI parser segfault with INI_SCANNER_TYPED Description: ------------ This report should be viewed as continuation of Bug #70157, which seems to be solved only in a specific case. Observed with: PHP 7.0.0RC7 and PHP 5.6.16RC1 Operating systems: Any (tests run in Ubuntu 15.10, Ubuntu 15.04) parse_ini_string() and parse_ini_file() segfault when the new INI_SCANNER_TYPED scanner encounters an unquoted value of format 'STRING INT' or 'STRING FLOAT' in the ini. Inputs in formats 'STRING INT STRING', 'STRING STRING INT' also trigger the bug. I was first surprised to see that input in form 'INT STRING' does NOT trigger the bug, but this seems to be because the solution to Bug #70157 addresses this specific case only. Which integer or floating point number is used does not seem to affect the result (can be small or large). However, floating point numbers in format '1e-2' or '2.3E4' DO NOT trigger the bug, nor do hexadecimal values given in format '0x1234'. Whether the 'process_sections' argument is TRUE or FALSE does not seem to affect the bug. The bug does not manifest itself with INI_SCANNER_RAW or INI_SCANNER_NORMAL Test script: --------------- $o = parse_ini_string('foo = bar 123', FALSE, INI_SCANNER_TYPED); Expected result: ---------------- $o array(1) { ["foo"]=> string(7) "bar 123" } Actual result: -------------- #0 zend_ini_add_string (result=result@entry=0x7ffd59704310, op1=op1@entry=0x7ffd59704500, op2=0x7ffd59704510) at /root/php-7.0.0RC7/Zend/zend_ini_parser.c:185 #1 0x0000000000799bcc in ini_parse () at /root/php-7.0.0RC7/Zend/zend_ini_parser.c:1739 #2 0x000000000079a2e7 in zend_parse_ini_string (str=str@entry=0x7f1e5aa6b180 "foo=bar 24", unbuffered_errors=unbuffered_errors@entry=0 '\000', scanner_mode=<optimized out>, ini_parser_cb=ini_parser_cb@entry=0x6e70e0 <php_simple_ini_parser_cb>, arg=arg@entry=0x7f1e5aa120a0) at /root/php-7.0.0RC7/Zend/zend_ini_parser.c:317 #3 0x00000000006e749b in zif_parse_ini_string (execute_data=<optimized out>, return_value=0x7f1e5aa120a0) at /root/php-7.0.0RC7/ext/standard/basic_functions.c:5956 #4 0x000000000081310d in ZEND_DO_ICALL_SPEC_HANDLER () at /root/php-7.0.0RC7/Zend/zend_vm_execute.h:586 #5 0x000000000080456b in execute_ex (ex=<optimized out>) at /root/php-7.0.0RC7/Zend/zend_vm_execute.h:414 #6 0x0000000000857e67 in zend_execute (op_array=0x7f1e5aa7b000, op_array@entry=0x7f1e5aa7b160, return_value=return_value@entry=0x7f1e5aa12030) at /root/php-7.0.0RC7/Zend/zend_vm_execute.h:458 #7 0x00000000007c5993 in zend_execute_scripts (type=type@entry=8, retval=0x7f1e5aa12030, retval@entry=0x0, file_count=file_count@entry=3) at /root/php-7.0.0RC7/Zend/zend.c:1428 #8 0x0000000000766bd0 in php_execute_script (primary_file=0x7ffd597078c0) at /root/php-7.0.0RC7/main/main.c:2471 #9 0x0000000000859b3b in do_cli (argc=1500529424, argv=0x7ffd59704500) at /root/php-7.0.0RC7/sapi/cli/php_cli.c:974 #10 0x000000000043dc50 in main (argc=1500529424, argv=0x7ffd59704500) at /root/php-7.0.0RC7/sapi/cli/php_cli.c:1345 -- Edit bug report at https://bugs.php.net/bug.php?id=70947&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=70947&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=70947&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=70947&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=70947&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=70947&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=70947&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=70947&r=needscript Try newer version: https://bugs.php.net/fix.php?id=70947&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=70947&r=support Expected behavior: https://bugs.php.net/fix.php?id=70947&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=70947&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=70947&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=70947&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=70947&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=70947&r=dst IIS Stability: https://bugs.php.net/fix.php?id=70947&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=70947&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=70947&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=70947&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=70947&r=mysqlcfg