Bug #72944 [Asn->Csd]: Null pointer deref in zval_delref_p

Edit report at https://bugs.php.net/bug.php?id=72944&edit=1 ID: 72944 Updated by: dmitry@php.net Reported by: hanno at hboeck dot de Summary: Null pointer deref in zval_delref_p -Status: Assigned +Status: Closed Type: Bug Package: Reproducible crash Operating System: Linux PHP Version: 7.0.10 Assigned To: dmitry Block user comment: N Private report: N New Comment: Automatic comment on behalf of dmitry@zend.com Revision: http://git.php.net/?p=php-src.git;a=commit;h=b66039db333f730be60c6f6e1925eeb01220e4eb Log: Fixed bug #72944 (Null pointer deref in zval_delref_p). Previous Comments: ------------------------------------------------------------------------ [2016-08-26 11:02:12] laruence@php.net the problem is in ZEND_IS_EQUAL handler: ZEND_VM_SMART_BRANCH(result, 0) ZVAL_BOOL(EX_VAR(opline->result.var), result); only checks wether next opline is JMP, but doesn't check if the operand is ZEND_IS_EQUAL's result. so, for you example: <?php "a"== e & $A = $A? 0 : 0 ?:0; will generate following opcodes : FETCH_CONSTANT "e" IS_EQUAL "a" ~0 ~1 (IS_EQUAL result) JMPZ $A J5 .... .... .... AND ~1 (IS_EQUAL result) then in ZEND_VM_SMART_BRANCH, it found next op is ZEND_JMPZ, then it do smart jmp, without setting result to EX_VAR(opline->result.var) which is ~1 then later in AND opcode, ~1 is IS_UNDEF. thanks ------------------------------------------------------------------------ [2016-08-26 10:37:43] hanno at hboeck dot de Uh? I can download it without problems. It contains nonstandard characters, therefore not sure if pasting will work, but I'll try anyway: <?php ÿ==e&$€=$€?0:0?:0; In case this didn't work, base64: PD9waHAg/z09ZSYkgD0kgD8wOjA/OjA7Cg== ------------------------------------------------------------------------ [2016-08-26 10:34:14] ab@php.net An empty page is shown in the posted link. Please post the PHP code. Thanks. ------------------------------------------------------------------------ [2016-08-26 09:04:20] hanno at hboeck dot de Description: ------------ Attached file crashes when run with USE_ZEND_ALLOC=0 on an address sanitizer build. This does not happen on a non-asan-build, I don't know why. Script to reproduce: https://crashes.fuzzing-project.org/nullptr.php Asan error message / stack trace: ==5235==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x000000d74c90 sp 0x7ffef1db4a90 bp 0x7fe86bdec8f0 T0) #0 0xd74c8f in zval_delref_p /var/tmp/portage/dev-lang/php-7.0.10/work/sapis-build/cli/Zend/zend_types.h:827 #1 0xd74c8f in _zval_ptr_dtor_nogc /var/tmp/portage/dev-lang/php-7.0.10/work/sapis-build/cli/Zend/zend_variables.h:49 #2 0xd74c8f in ZEND_BW_AND_SPEC_TMPVAR_TMPVAR_HANDLER /var/tmp/portage/dev-lang/php-7.0.10/work/sapis-build/cli/Zend/zend_vm_execute.h:45077 #3 0xcf748d in execute_ex /var/tmp/portage/dev-lang/php-7.0.10/work/sapis-build/cli/Zend/zend_vm_execute.h:414 #4 0xe5c7bd in zend_execute /var/tmp/portage/dev-lang/php-7.0.10/work/sapis-build/cli/Zend/zend_vm_execute.h:458 #5 0xc1d5ba in zend_execute_scripts /var/tmp/portage/dev-lang/php-7.0.10/work/sapis-build/cli/Zend/zend.c:1427 #6 0xb068bf in php_execute_script /var/tmp/portage/dev-lang/php-7.0.10/work/sapis-build/cli/main/main.c:2494 #7 0xe60b1f in do_cli /var/tmp/portage/dev-lang/php-7.0.10/work/sapis-build/cli/sapi/cli/php_cli.c:974 #8 0x48428b in main /var/tmp/portage/dev-lang/php-7.0.10/work/sapis-build/cli/sapi/cli/php_cli.c:1344 #9 0x7fe8710f978f in __libc_start_main (/lib64/libc.so.6+0x2078f) #10 0x484a18 in _start (/usr/lib64/php7.0/bin/php+0x484a18) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV /var/tmp/portage/dev-lang/php-7.0.10/work/sapis-build/cli/Zend/zend_types.h:827 zval_delref_p ==5235==ABORTING ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=72944&edit=1