Bug #72164 [NEW]: Null Pointer Dereference

From: shm Operating system: PHP version: 7.0.6 Package: mbstring related Bug Type: Bug Bug description:Null Pointer Dereference Description: ------------ mb_ereg_replace causes Null pointer dereference in _php_mb_regex_ereg_replace_exec function. eval_buf can be derefered in case when eval option is turned on and pattern is empty. Test script: --------------- <?php $var0 = "e"; $var2 = ""; $var8 = mbereg_replace($var2,$_,$_,$var0); Expected result: ---------------- Null pointer is not derefered Actual result: -------------- $ ./php mbereg_replace.php ASAN:SIGSEGV ================================================================= ==906== ERROR: AddressSanitizer: SEGV on unknown address 0x000000000010 (pc 0x000000a29c5a sp 0x7ffffafed520 bp 0x7ffffafedb70 T0) AddressSanitizer can not provide additional info. #0 0xa29c59 in _php_mb_regex_ereg_replace_exec /home/shm/src/php-7.0.6/ext/mbstring/php_mbregex.c:941 #1 0xa2a949 in zif_mb_ereg_replace /home/shm/src/php-7.0.6/ext/mbstring/php_mbregex.c:1029 #2 0x101ced6 in ZEND_DO_ICALL_SPEC_HANDLER /home/shm/src/php-7.0.6/Zend/zend_vm_execute.h:586 #3 0x101bf4f in execute_ex /home/shm/src/php-7.0.6/Zend/zend_vm_execute.h:414 #4 0x101c1aa in zend_execute /home/shm/src/php-7.0.6/Zend/zend_vm_execute.h:458 #5 0xf31538 in zend_execute_scripts /home/shm/src/php-7.0.6/Zend/zend.c:1427 #6 0xdc0d02 in php_execute_script /home/shm/src/php-7.0.6/main/main.c:2494 #7 0x1148111 in do_cli /home/shm/src/php-7.0.6/sapi/cli/php_cli.c:974 #8 0x114a6ed in main /home/shm/src/php-7.0.6/sapi/cli/php_cli.c:1344 #9 0x7f6c245b1ec4 (/lib/x86_64-linux-gnu/libc.so.6+0x21ec4) #10 0x4247a8 in _start (/home/shm/src/php-7.0.6/sapi/cli/php+0x4247a8) SUMMARY: AddressSanitizer: SEGV /home/shm/src/php-7.0.6/ext/mbstring/php_mbregex.c:941 _php_mb_regex_ereg_replace_exec ==906== ABORTING Aborted -- Edit bug report at https://bugs.php.net/bug.php?id=72164&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=72164&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=72164&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=72164&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=72164&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=72164&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=72164&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=72164&r=needscript Try newer version: https://bugs.php.net/fix.php?id=72164&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=72164&r=support Expected behavior: https://bugs.php.net/fix.php?id=72164&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=72164&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=72164&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=72164&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=72164&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=72164&r=dst IIS Stability: https://bugs.php.net/fix.php?id=72164&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=72164&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=72164&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=72164&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=72164&r=mysqlcfg