Sec Bug->Bug #72705 [Opn]: AddressSanitizer: negative-size-param in zend_compile_stmt
| From: | stas@php.net | Date: | Fri, 29 Jul 2016 08:23:29 +0000 |
| Subject: | Sec Bug->Bug #72705 [Opn]: AddressSanitizer: negative-size-param in zend_compile_stmt | ||
| References: | 1 | Groups: | php.bugs |
| Request: | Send a blank email to php-bugs+get-202696@lists.php.net to get a copy of this message | ||
Edit report at https://bugs.php.net/bug.php?id=72705&edit=1
ID: 72705
Updated by: stas@php.net
Reported by: pranjal dot jumde at gmail dot com
Summary: AddressSanitizer: negative-size-param in
zend_compile_stmt
Status: Open
-Type: Security
+Type: Bug
Package: Reproducible crash
Operating System: All
PHP Version: 7.1Git-2016-07-29 (Git)
Block user comment: N
Private report: Y
Previous Comments:
------------------------------------------------------------------------
[2016-07-29 07:18:18] pranjal dot jumde at gmail dot com
Description:
------------
=38807==ERROR: AddressSanitizer: negative-size-param: (size=-2147483648)
#0 0x1107632f2 in printf_common(void*, char const*, __va_list_tag*)
(libclang_rt.asan_osx_dynamic.dylib+0x1b2f2)
#1 0x110763c5b in wrap_vsprintf (libclang_rt.asan_osx_dynamic.dylib+0x1bc5b)
#2 0x110764956 in wrap_sprintf (libclang_rt.asan_osx_dynamic.dylib+0x1c956)
#3 0x10f89206f in zend_compile_stmt zend_compile.c:7785
#4 0x10f8a9a86 in zend_compile_top_stmt zend_compile.c:7691
#5 0x10f8a9a51 in zend_compile_top_stmt zend_compile.c:7686
#6 0x10f816a14 in zend_compile zend_language_scanner.l:600
#7 0x10f818713 in compile_string zend_language_scanner.l:765
#8 0x10fbb90be in zend_include_or_eval zend_execute.c:2857
Test script:
---------------
<?php
ini_set('memory_limit', '-1');
$newClassName = str_repeat("a", 2147483647);
eval("class $newClassName {
function hello() {
return \"Hello\";
}
};");
?>
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=72705&edit=1