Bug #72944 [NEW]: Null pointer deref in zval_delref_p

From: hanno at hboeck dot de Operating system: Linux PHP version: 7.0.10 Package: Reproducible crash Bug Type: Bug Bug description:Null pointer deref in zval_delref_p Description: ------------ Attached file crashes when run with USE_ZEND_ALLOC=0 on an address sanitizer build. This does not happen on a non-asan-build, I don't know why. Script to reproduce: https://crashes.fuzzing-project.org/nullptr.php Asan error message / stack trace: ==5235==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x000000d74c90 sp 0x7ffef1db4a90 bp 0x7fe86bdec8f0 T0) #0 0xd74c8f in zval_delref_p /var/tmp/portage/dev-lang/php-7.0.10/work/sapis-build/cli/Zend/zend_types.h:827 #1 0xd74c8f in _zval_ptr_dtor_nogc /var/tmp/portage/dev-lang/php-7.0.10/work/sapis-build/cli/Zend/zend_variables.h:49 #2 0xd74c8f in ZEND_BW_AND_SPEC_TMPVAR_TMPVAR_HANDLER /var/tmp/portage/dev-lang/php-7.0.10/work/sapis-build/cli/Zend/zend_vm_execute.h:45077 #3 0xcf748d in execute_ex /var/tmp/portage/dev-lang/php-7.0.10/work/sapis-build/cli/Zend/zend_vm_execute.h:414 #4 0xe5c7bd in zend_execute /var/tmp/portage/dev-lang/php-7.0.10/work/sapis-build/cli/Zend/zend_vm_execute.h:458 #5 0xc1d5ba in zend_execute_scripts /var/tmp/portage/dev-lang/php-7.0.10/work/sapis-build/cli/Zend/zend.c:1427 #6 0xb068bf in php_execute_script /var/tmp/portage/dev-lang/php-7.0.10/work/sapis-build/cli/main/main.c:2494 #7 0xe60b1f in do_cli /var/tmp/portage/dev-lang/php-7.0.10/work/sapis-build/cli/sapi/cli/php_cli.c:974 #8 0x48428b in main /var/tmp/portage/dev-lang/php-7.0.10/work/sapis-build/cli/sapi/cli/php_cli.c:1344 #9 0x7fe8710f978f in __libc_start_main (/lib64/libc.so.6+0x2078f) #10 0x484a18 in _start (/usr/lib64/php7.0/bin/php+0x484a18) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV /var/tmp/portage/dev-lang/php-7.0.10/work/sapis-build/cli/Zend/zend_types.h:827 zval_delref_p ==5235==ABORTING -- Edit bug report at https://bugs.php.net/bug.php?id=72944&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=72944&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=72944&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=72944&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=72944&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=72944&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=72944&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=72944&r=needscript Try newer version: https://bugs.php.net/fix.php?id=72944&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=72944&r=support Expected behavior: https://bugs.php.net/fix.php?id=72944&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=72944&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=72944&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=72944&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=72944&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=72944&r=dst IIS Stability: https://bugs.php.net/fix.php?id=72944&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=72944&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=72944&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=72944&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=72944&r=mysqlcfg