Bug #71843 [NEW]: null ptr deref ZEND_RETURN_SPEC_CONST_HANDLER (zend_vm_execute.h:3479)

From: brian dot carpenter at gmail dot com Operating system: Debian 8.2 x64 PHP version: 7.0Git-2016-03-17 (Git) Package: Reproducible crash Bug Type: Bug Bug description:null ptr deref ZEND_RETURN_SPEC_CONST_HANDLER (zend_vm_execute.h:3479) Description: ------------ While fuzzing PHP 7.1.0-dev (cli) (built: Mar 16 2016 17:03:41) with American Fuzzy Lop, I encountered a null pointer dereference and segfault. Test script: --------------- <?0&~e&~r;6&&~_?> Expected result: ---------------- No crash. Actual result: -------------- geeknik@debian:~/php-tmp/out/4/crashes$ valgrind -q ~/php-src/sapi/cli/php test01 ==55572== Invalid write of size 8 ==55572== at 0x1877A42: ZEND_RETURN_SPEC_CONST_HANDLER (zend_vm_execute.h:3479) ==55572== by 0x1615532: execute_ex (zend_vm_execute.h:423) ==55572== by 0x187F654: zend_execute (zend_vm_execute.h:467) ==55572== by 0x14520D7: zend_execute_scripts (zend.c:1427) ==55572== by 0x11FFE8F: php_execute_script (main.c:2487) ==55572== by 0x18888E4: do_cli (php_cli.c:974) ==55572== by 0x4507F0: main (php_cli.c:1344) ==55572== Address 0x3 is not stack'd, malloc'd or (recently) free'd ==55572== ==55572== ==55572== Process terminating with default action of signal 11 (SIGSEGV) ==55572== Access not within mapped region at address 0x3 ==55572== at 0x1877A42: ZEND_RETURN_SPEC_CONST_HANDLER (zend_vm_execute.h:3479) ==55572== by 0x1615532: execute_ex (zend_vm_execute.h:423) ==55572== by 0x187F654: zend_execute (zend_vm_execute.h:467) ==55572== by 0x14520D7: zend_execute_scripts (zend.c:1427) ==55572== by 0x11FFE8F: php_execute_script (main.c:2487) ==55572== by 0x18888E4: do_cli (php_cli.c:974) ==55572== by 0x4507F0: main (php_cli.c:1344) ==55572== If you believe this happened as a result of a stack ==55572== overflow in your program's main thread (unlikely but ==55572== possible), you can try to increase the size of the ==55572== main thread stack using the --main-stacksize= flag. ==55572== The main thread stack size used in this run was 8388608. Segmentation fault (gdb) r test01 Starting program: /home/geeknik/php-src/sapi/cli/php test01 [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". Program received signal SIGSEGV, Segmentation fault. 0x0000000001877a42 in ZEND_RETURN_SPEC_CONST_HANDLER () at /home/geeknik/php-src/Zend/zend_vm_execute.h:3479 3479 ZVAL_COPY_VALUE(EX(return_value), retval_ptr); (gdb) bt #0 0x0000000001877a42 in ZEND_RETURN_SPEC_CONST_HANDLER () at /home/geeknik/php-src/Zend/zend_vm_execute.h:3479 #1 0x0000000001615533 in execute_ex (ex=<optimized out>) at /home/geeknik/php-src/Zend/zend_vm_execute.h:423 #2 0x000000000187f655 in zend_execute (op_array=op_array@entry=0x7ffff6085140, return_value=return_value@entry=0x0) at /home/geeknik/php-src/Zend/zend_vm_execute.h:467 #3 0x00000000014520d8 in zend_execute_scripts (type=type@entry=8, retval=retval@entry=0x0, file_count=-167694288, file_count@entry=3) at /home/geeknik/php-src/Zend/zend.c:1427 #4 0x00000000011ffe90 in php_execute_script (primary_file=0x7fffffffcf10) at /home/geeknik/php-src/main/main.c:2487 #5 0x00000000018888e5 in do_cli (argc=4, argv=0x1) at /home/geeknik/php-src/sapi/cli/php_cli.c:974 #6 0x00000000004507f1 in main (argc=4, argv=0x1) at /home/geeknik/php-src/sapi/cli/php_cli.c:1344 (gdb) list 3474 zval_dtor_func_for_ptr(Z_COUNTED_P(free_op1)); 3475 } 3476 } 3477 } else { 3478 if ((IS_CONST & (IS_CONST|IS_TMP_VAR))) { 3479 ZVAL_COPY_VALUE(EX(return_value), retval_ptr); 3480 if (IS_CONST == IS_CONST) { 3481 if (UNEXPECTED(Z_OPT_COPYABLE_P(EX(return_value)))) { 3482 zval_copy_ctor_func(EX(return_value)); 3483 } -- Edit bug report at https://bugs.php.net/bug.php?id=71843&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=71843&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=71843&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=71843&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=71843&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=71843&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=71843&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=71843&r=needscript Try newer version: https://bugs.php.net/fix.php?id=71843&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=71843&r=support Expected behavior: https://bugs.php.net/fix.php?id=71843&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=71843&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=71843&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=71843&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=71843&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=71843&r=dst IIS Stability: https://bugs.php.net/fix.php?id=71843&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=71843&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=71843&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=71843&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=71843&r=mysqlcfg