Bug #72090 [NoF->Opn]: AddressSanitizer: SEGV on unknown address 0x00000000 gdImageFlipVertical

Edit report at https://bugs.php.net/bug.php?id=72090&edit=1 ID: 72090 Updated by: cmb@php.net Reported by: fernando at null-life dot com Summary: AddressSanitizer: SEGV on unknown address 0x00000000 gdImageFlipVertical -Status: No Feedback +Status: Open Type: Bug Package: GD related Operating System: Linux PHP Version: 5.6.20 Assigned To: cmb Block user comment: N Private report: N New Comment: > ["GD Version"]=> > string(5) "2.1.1" Ah, a system libgd. I'll try to reproduce. Previous Comments: ------------------------------------------------------------------------ [2016-08-04 11:49:39] fernando at null-life dot com I don't have this debugging version anymore, however using ubuntu xenial current packages the issue can be reproduced: user@Xenial32-2:~$ php poc.php ?? ????Segmentation fault user@Xenial32-2:~$ php -v PHP 7.0.8-0ubuntu0.16.04.2 (cli) ( NTS ) Copyright (c) 1997-2016 The PHP Group Zend Engine v3.0.0, Copyright (c) 1998-2016 Zend Technologies with Zend OPcache v7.0.8-0ubuntu0.16.04.2, Copyright (c) 1999-2016, by Zend Technologies user@Xenial32-2:~$ php -r "var_dump(gd_info());" array(12) { ["GD Version"]=> string(5) "2.1.1" ["FreeType Support"]=> bool(true) ["FreeType Linkage"]=> string(13) "with freetype" ["GIF Read Support"]=> bool(true) ["GIF Create Support"]=> bool(true) ["JPEG Support"]=> bool(true) ["PNG Support"]=> bool(true) ["WBMP Support"]=> bool(true) ["XPM Support"]=> bool(true) ["XBM Support"]=> bool(true) ["WebP Support"]=> bool(true) ["JIS-mapped Japanese Font Support"]=> bool(false) } ------------------------------------------------------------------------ [2016-07-31 04:22:27] php-bugs at lists dot php dot net No feedback was provided. The bug is being suspended because we assume that you are no longer experiencing the problem. If this is not the case and you are able to provide the information that was requested earlier, please do so and change the status of the bug back to "Re-Opened". Thank you. ------------------------------------------------------------------------ [2016-07-23 18:18:13] cmb@php.net > SEGV on unknown address 0x00000000 Sounds like a null pointer access, but I can't reproduce that, and valgrind also doesn't complain. Which libgd do you use? (see phpinfo) ------------------------------------------------------------------------ [2016-04-24 01:02:45] fernando at null-life dot com Description: ------------ Run with ASAN Test script: --------------- <?php $var1 = imagecreatetruecolor ( 10, 10); imagegd($var1); imageflip($var1,2); Expected result: ---------------- Not crash Actual result: -------------- ASAN:SIGSEGV ================================================================= ==1805==ERROR: AddressSanitizer: SEGV on unknown address 0x00000000 (pc 0xb2a4147f bp 0xbf832b60 sp 0xbf832b24 T0) #0 0xb2a4147e in gdImageFlipVertical (/usr/lib/i386-linux-gnu/libgd.so.3+0xf47e) #1 0xb2ac02e8 in zif_imageflip /home/fmunozs/phpgit/php56/ext/gd/gd.c:4944 #2 0x9a7c718 in zend_do_fcall_common_helper_SPEC /home/fmunozs/phpgit/php56/Zend/zend_vm_execute.h:558 #3 0x9640316 in execute_ex /home/fmunozs/phpgit/php56/Zend/zend_vm_execute.h:363 #4 0x9a6c9c8 in zend_execute /home/fmunozs/phpgit/php56/Zend/zend_vm_execute.h:388 #5 0x9470b59 in zend_execute_scripts /home/fmunozs/phpgit/php56/Zend/zend.c:1341 #6 0x91acc6b in php_execute_script /home/fmunozs/phpgit/php56/main/main.c:2613 #7 0x9a8648a in do_cli /home/fmunozs/phpgit/php56/sapi/cli/php_cli.c:994 #8 0x808a502 in main /home/fmunozs/phpgit/php56/sapi/cli/php_cli.c:1378 #9 0xb6e2f645 in __libc_start_main (/lib/i386-linux-gnu/libc.so.6+0x18645) #10 0x808aaba (/home/fmunozs/phpgit/php56/sapi/cli/php+0x808aaba) ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=72090&edit=1