Bug #72172 [NEW]: zend_hex_strtod should not use strlen

From: bwitz at hotmail dot com Operating system: Linux PHP version: 5.6.21 Package: *Compile Issues Bug Type: Bug Bug description:zend_hex_strtod should not use strlen Description: ------------ Purify reports an Invalid pointer read from zend_hex_strtod as a result of performing a strlen on the compile buffer. IPR: Invalid pointer read (3 times): * This is occurring while in thread 8137: strlen [rtlib.o] zend_hex_strtod [zend_strtod.c:2593] lex_scan [zend_language_scanner.l:1561] zendlex [zend_compile.c:6911] zendparse [zend_language_parser.c:3767] compile_file [zend_language_scanner.l:586] rnt_compile_file [rnt_opcode_cache.c:1118] ZEND_INCLUDE_OR_EVAL_SPEC_TMP_HANDLER [zend_vm_execute.h:8337] execute_ex [zend_vm_execute.h:363] zend_execute [zend_vm_execute.h:388] zend_execute_scripts [zend.c:1341] php_execute_script [main.c:2610] main [cgi_main.c:2720] __libc_start_main [libc.so.6] _start [crt1.o] * Reading 189460 bytes from 0xec44b66b between the heap and the stack (1 byte at 0xec479a7e illegal) Expected result: ---------------- Purify would not identify compilation of a php script as hitting an Invalid pointer read (IPR). In addition the strlen is quite inefficient since the compile buffer can be quite large. In this specific case, 189,460 bytes were read to determine that if (strlen(str) < 2) is false. -- Edit bug report at https://bugs.php.net/bug.php?id=72172&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=72172&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=72172&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=72172&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=72172&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=72172&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=72172&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=72172&r=needscript Try newer version: https://bugs.php.net/fix.php?id=72172&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=72172&r=support Expected behavior: https://bugs.php.net/fix.php?id=72172&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=72172&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=72172&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=72172&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=72172&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=72172&r=dst IIS Stability: https://bugs.php.net/fix.php?id=72172&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=72172&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=72172&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=72172&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=72172&r=mysqlcfg