Edit report at https://bugs.php.net/bug.php?id=72098&edit=1
ID: 72098
User updated by: s dot paraschoudis at gmail dot com
Reported by: s dot paraschoudis at gmail dot com
Summary: Use-after-free in php_var_serialize_class_name()
Status: Assigned
Type: Bug
Package: Reproducible crash
Operating System: Ubuntu 14.04 64/32bit
PHP Version: 5.6.20
Assigned To: yohgaki
Block user comment: N
Private report: Y
New Comment:
Hi, could you please close this issue if it has been fixed?
Thanks.
Previous Comments:
------------------------------------------------------------------------
[2016-07-15 09:10:51] dmitry@php.net
The bug was fixed in PHP-7.1 by https://github.com/php/php-src/commit/bfb9307b2d679a91e138fd876880470ece60942b
The bug still affects PHP-7.0 and below.
Probably this patch might be partially backported.
$ USE_ZEND_ALLOC=0 valgrind php7.0/CGI-DEBUG/sapi/cli/php bug72098.php
string(11) "Loading Bar"
==1949== Invalid read of size 4
==1949== at 0x84A1132: php_var_serialize_class_name (var.c:658)
==1949== by 0x84A138A: php_var_serialize_class (var.c:705)
==1949== by 0x84A1D03: php_var_serialize_intern (var.c:908)
==1949== by 0x84A2082: php_var_serialize (var.c:996)
==1949== by 0x83C13A1: ps_srlzr_encode_php (session.c:1027)
==1949== by 0x83BF6A3: php_session_encode (session.c:223)
==1949== by 0x83C0103: php_session_save_current_state (session.c:581)
==1949== by 0x83C2958: php_session_flush (session.c:1685)
==1949== by 0x83C4735: zm_deactivate_session (session.c:2669)
==1949== by 0x85D9AE3: zend_deactivate_modules (zend_API.c:2580)
==1949== by 0x8562F94: php_request_shutdown (main.c:1807)
==1949== by 0x8671181: do_cli (php_cli.c:1141)
==1949== Address 0x986dcd0 is 32 bytes inside a block of size 224 free'd
==1949== at 0x402C3A2: free (vg_replace_malloc.c:530)
==1949== by 0x85A9643: _efree (zend_alloc.c:2461)
==1949== by 0x85E1F54: zend_array_destroy (zend_hash.c:1359)
==1949== by 0x85CFBFE: _zval_dtor_func_for_ptr (zend_variables.c:96)
==1949== by 0x85CF994: i_zval_ptr_dtor (zend_variables.h:58)
==1949== by 0x85CFC7F: _zval_dtor_func_for_ptr (zend_variables.c:122)
==1949== by 0x85BDF9F: i_zval_ptr_dtor (zend_variables.h:58)
==1949== by 0x85BF0F8: _zval_ptr_dtor (zend_execute_API.c:533)
==1949== by 0x83BF560: php_session_track_init (session.c:205)
==1949== by 0x83C000F: php_session_initialize (session.c:546)
==1949== by 0x83C292C: php_session_start (session.c:1676)
==1949== by 0x83C43D1: zif_session_start (session.c:2340)
==1949== Block was alloc'd at
==1949== at 0x402B289: malloc (vg_replace_malloc.c:299)
==1949== by 0x85A95B8: _emalloc (zend_alloc.c:2446)
==1949== by 0x85DEC7D: zend_hash_real_init_ex (zend_hash.c:140)
==1949== by 0x85DED88: zend_hash_check_init (zend_hash.c:163)
==1949== by 0x85DFF65: _zend_hash_add_or_update_i (zend_hash.c:563)
==1949== by 0x85E0310: _zend_hash_add_new (zend_hash.c:653)
==1949== by 0x8618F70: zend_fetch_dimension_address_inner (zend_execute.c:1610)
==1949== by 0x8639A8E: ZEND_ASSIGN_DIM_SPEC_VAR_CONST_HANDLER (zend_vm_execute.h:17455)
==1949== by 0x861B4B1: execute_ex (zend_vm_execute.h:414)
==1949== by 0x861B566: zend_execute (zend_vm_execute.h:458)
==1949== by 0x85D2711: zend_execute_scripts (zend.c:1427)
==1949== by 0x8563ECC: php_execute_script (main.c:2494)
------------------------------------------------------------------------
[2016-05-14 09:46:11] s dot paraschoudis at gmail dot com
Okay. Any plans for fixing it?
Thanks.
------------------------------------------------------------------------
[2016-04-25 01:58:32] stas@php.net
Definitely not security issue, the problem is that session_start() in spl_autoload_register() cleans
up session, thus destroying the object __sleep is working on. Reproducible also on 5.x.
------------------------------------------------------------------------
[2016-04-24 20:56:12] s dot paraschoudis at gmail dot com
Description:
------------
There is a use-after-free vulnerability in php_var_serialize_class_name() which
affects all the major php versions.
Please note I am not able to reproduce the issue without ASAN instrumentation so
this might not be a security issue at all.
Test script:
---------------
Proof Of Concept
=================
<?php
spl_autoload_register(function ($class) {
session_start();
var_dump("Loading $class");
class Bar {};
});
class Foo {
function __sleep() {
new Bar;
return array();
}
}
session_start();
$_SESSION['foo'] = new Foo;
?>
Actual result:
--------------
PHP 7.0.5:
symeon@ubuntu:~/Desktop/0days/sessions$ USE_ZEND_ALLOC=0 ASAN_OPTIONS=detect_leaks=0
~/Desktop/php-7.0.5/sapi/cli/php session_uaf.php
string(11) "Loading Bar"
=================================================================
==4308==ERROR: AddressSanitizer: heap-use-after-free on address 0x61200000ebe0 at pc 0x00000169551c
bp 0x7ffe612e9690 sp 0x7ffe612e9688
READ of size 8 at 0x61200000ebe0 thread T0
#0 0x169551b in php_var_serialize_class_name
/home/symeon/Desktop/php-7.0.5/ext/standard/var.c:658:2
#1 0x1693fa5 in php_var_serialize_class /home/symeon/Desktop/php-7.0.5/ext/standard/var.c:675:21
#2 0x168db05 in php_var_serialize_intern /home/symeon/Desktop/php-7.0.5/ext/standard/var.c:882:9
#3 0x168c308 in php_var_serialize /home/symeon/Desktop/php-7.0.5/ext/standard/var.c:966:2
#4 0x12825e7 in ps_srlzr_encode_php /home/symeon/Desktop/php-7.0.5/ext/session/session.c:1009:2
#5 0x129fa58 in php_session_encode /home/symeon/Desktop/php-7.0.5/ext/session/session.c:223:10
#6 0x12a0464 in php_session_save_current_state
/home/symeon/Desktop/php-7.0.5/ext/session/session.c:582:11
#7 0x12a006d in php_session_flush /home/symeon/Desktop/php-7.0.5/ext/session/session.c:1658:3
#8 0x128e0b3 in zm_deactivate_session
/home/symeon/Desktop/php-7.0.5/ext/session/session.c:2642:3
#9 0x1ae524a in zend_deactivate_modules /home/symeon/Desktop/php-7.0.5/Zend/zend_API.c:2580:5
#10 0x17b6c18 in php_request_shutdown /home/symeon/Desktop/php-7.0.5/main/main.c:1804:3
#11 0x1f4fb87 in do_cli /home/symeon/Desktop/php-7.0.5/sapi/cli/php_cli.c:1141:3
#12 0x1f48e9a in main /home/symeon/Desktop/php-7.0.5/sapi/cli/php_cli.c:1344:18
#13 0x7f66da36bec4 in __libc_start_main /build/eglibc-3GlaMS/eglibc-2.19/csu/libc-start.c:287
#14 0x45f755 in _start (/home/symeon/Desktop/php-7.0.5/sapi/cli/php+0x45f755)
0x61200000ebe0 is located 32 bytes inside of 288-byte region [0x61200000ebc0,0x61200000ece0)
freed by thread T0 here:
#0 0x4fc800 in __interceptor_free
/home/symeon/Desktop/LLVM/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:30
#1 0x198fb76 in _efree /home/symeon/Desktop/php-7.0.5/Zend/zend_alloc.c:2461:4
#2 0x1b2c712 in zend_array_destroy /home/symeon/Desktop/php-7.0.5/Zend/zend_hash.c:1359:2
#3 0x1aa2ff9 in _zval_dtor_func_for_ptr
/home/symeon/Desktop/php-7.0.5/Zend/zend_variables.c:96:5
#4 0x1aa2cb0 in i_zval_ptr_dtor /home/symeon/Desktop/php-7.0.5/Zend/zend_variables.h:58:4
#5 0x1aa3143 in _zval_dtor_func_for_ptr
/home/symeon/Desktop/php-7.0.5/Zend/zend_variables.c:122:5
#6 0x1a26a70 in i_zval_ptr_dtor /home/symeon/Desktop/php-7.0.5/Zend/zend_variables.h:58:4
#7 0x1a24f0b in _zval_ptr_dtor /home/symeon/Desktop/php-7.0.5/Zend/zend_execute_API.c:533:2
#8 0x1290888 in php_session_track_init
/home/symeon/Desktop/php-7.0.5/ext/session/session.c:205:3
#9 0x128a485 in php_session_initialize
/home/symeon/Desktop/php-7.0.5/ext/session/session.c:547:2
#10 0x128920e in php_session_start /home/symeon/Desktop/php-7.0.5/ext/session/session.c:1649:2
#11 0x1299727 in zif_session_start /home/symeon/Desktop/php-7.0.5/ext/session/session.c:2313:2
#12 0x1e6236d in ZEND_DO_ICALL_SPEC_HANDLER
/home/symeon/Desktop/php-7.0.5/Zend/zend_vm_execute.h:586:2
#13 0x1c8324b in execute_ex /home/symeon/Desktop/php-7.0.5/Zend/zend_vm_execute.h:417:7
#14 0x1a2ef1e in zend_call_function /home/symeon/Desktop/php-7.0.5/Zend/zend_execute_API.c:863:4
#15 0x1b9091c in zend_call_method /home/symeon/Desktop/php-7.0.5/Zend/zend_interfaces.c:104:12
#16 0x12eca90 in zif_spl_autoload_call /home/symeon/Desktop/php-7.0.5/ext/spl/php_spl.c:429:4
#17 0x1a2f5de in zend_call_function /home/symeon/Desktop/php-7.0.5/Zend/zend_execute_API.c:882:4
#18 0x1a32aa1 in zend_lookup_class_ex
/home/symeon/Desktop/php-7.0.5/Zend/zend_execute_API.c:1044:7
#19 0x1a36b8d in zend_fetch_class_by_name
/home/symeon/Desktop/php-7.0.5/Zend/zend_execute_API.c:1390:19
#20 0x1d5e3de in ZEND_NEW_SPEC_CONST_HANDLER
/home/symeon/Desktop/php-7.0.5/Zend/zend_vm_execute.h:3354:9
#21 0x1c8324b in execute_ex /home/symeon/Desktop/php-7.0.5/Zend/zend_vm_execute.h:417:7
#22 0x1a2ef1e in zend_call_function /home/symeon/Desktop/php-7.0.5/Zend/zend_execute_API.c:863:4
#23 0x1a2af18 in call_user_function_ex
/home/symeon/Desktop/php-7.0.5/Zend/zend_execute_API.c:685:9
#24 0x168d638 in php_var_serialize_intern
/home/symeon/Desktop/php-7.0.5/ext/standard/var.c:870:12
#25 0x168c308 in php_var_serialize /home/symeon/Desktop/php-7.0.5/ext/standard/var.c:966:2
#26 0x12825e7 in ps_srlzr_encode_php /home/symeon/Desktop/php-7.0.5/ext/session/session.c:1009:2
#27 0x129fa58 in php_session_encode /home/symeon/Desktop/php-7.0.5/ext/session/session.c:223:10
#28 0x12a0464 in php_session_save_current_state
/home/symeon/Desktop/php-7.0.5/ext/session/session.c:582:11
#29 0x12a006d in php_session_flush /home/symeon/Desktop/php-7.0.5/ext/session/session.c:1658:3
previously allocated by thread T0 here:
#0 0x4fcb18 in malloc
/home/symeon/Desktop/LLVM/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:40
#1 0x198f8b8 in _emalloc /home/symeon/Desktop/php-7.0.5/Zend/zend_alloc.c:2446:11
#2 0x1b141b8 in zend_hash_real_init_ex /home/symeon/Desktop/php-7.0.5/Zend/zend_hash.c:140:3
#3 0x1b1922b in zend_hash_check_init /home/symeon/Desktop/php-7.0.5/Zend/zend_hash.c:163:3
#4 0x1b1f922 in _zend_hash_add_or_update_i /home/symeon/Desktop/php-7.0.5/Zend/zend_hash.c:563:3
#5 0x1b20f54 in _zend_hash_add_new /home/symeon/Desktop/php-7.0.5/Zend/zend_hash.c:653:9
#6 0x1ed72d6 in zend_fetch_dimension_address_inner
/home/symeon/Desktop/php-7.0.5/Zend/zend_execute.c:1610:15
#7 0x1e74bc6 in ZEND_ASSIGN_DIM_SPEC_VAR_CONST_HANDLER
/home/symeon/Desktop/php-7.0.5/Zend/zend_vm_execute.h:17426:19
#8 0x1c8324b in execute_ex /home/symeon/Desktop/php-7.0.5/Zend/zend_vm_execute.h:417:7
#9 0x1c83738 in zend_execute /home/symeon/Desktop/php-7.0.5/Zend/zend_vm_execute.h:458:2
#10 0x1ab5fac in zend_execute_scripts /home/symeon/Desktop/php-7.0.5/Zend/zend.c:1427:4
#11 0x17c2891 in php_execute_script /home/symeon/Desktop/php-7.0.5/main/main.c:2487:14
#12 0x1f4d39f in do_cli /home/symeon/Desktop/php-7.0.5/sapi/cli/php_cli.c:974:5
#13 0x1f48e9a in main /home/symeon/Desktop/php-7.0.5/sapi/cli/php_cli.c:1344:18
#14 0x7f66da36bec4 in __libc_start_main /build/eglibc-3GlaMS/eglibc-2.19/csu/libc-start.c:287
PHP 6.5.20:
=================================================================
==11546==ERROR: AddressSanitizer: heap-use-after-free on address 0x60300001cd88 at pc 0x0000017154c0
bp 0x7ffe11ecd210 sp 0x7ffe11ecd208
READ of size 8 at 0x60300001cd88 thread T0
#0 0x17154bf in php_var_serialize_class_name
/home/symeon/Desktop/php-5.6.20/ext/standard/var.c:607:2
#1 0x1710ccb in php_var_serialize_class
/home/symeon/Desktop/php-5.6.20/ext/standard/var.c:623:21
#2 0x1704140 in php_var_serialize_intern
/home/symeon/Desktop/php-5.6.20/ext/standard/var.c:813:9
#3 0x16f75b3 in php_var_serialize /home/symeon/Desktop/php-5.6.20/ext/standard/var.c:905:2
#4 0x1300672 in ps_srlzr_encode_php /home/symeon/Desktop/php-5.6.20/ext/session/session.c:982:2
#5 0x1327eeb in php_session_encode /home/symeon/Desktop/php-5.6.20/ext/session/session.c:209:14
#6 0x1328915 in php_session_save_current_state
/home/symeon/Desktop/php-5.6.20/ext/session/session.c:542:10
#7 0x13284e1 in php_session_flush /home/symeon/Desktop/php-5.6.20/ext/session/session.c:1634:3
#8 0x1315bde in zm_deactivate_session
/home/symeon/Desktop/php-5.6.20/ext/session/session.c:2403:3
#9 0x1bc1ead in zend_deactivate_modules /home/symeon/Desktop/php-5.6.20/Zend/zend_API.c:2449:5
#10 0x185139e in php_request_shutdown /home/symeon/Desktop/php-5.6.20/main/main.c:1867:3
#11 0x1fb1ba5 in do_cli /home/symeon/Desktop/php-5.6.20/sapi/cli/php_cli.c:1177:3
#12 0x1faa2a0 in main /home/symeon/Desktop/php-5.6.20/sapi/cli/php_cli.c:1378:18
#13 0x7f371e059ec4 in __libc_start_main /build/eglibc-3GlaMS/eglibc-2.19/csu/libc-start.c:287
#14 0x45e195 in _start (/home/symeon/Desktop/php-5.6.20/sapi/cli/php+0x45e195)
0x60300001cd88 is located 8 bytes inside of 32-byte region [0x60300001cd80,0x60300001cda0)
freed by thread T0 here:
#0 0x4fb240 in __interceptor_free
/home/symeon/Desktop/LLVM/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:30
#1 0x1a37276 in _efree /home/symeon/Desktop/php-5.6.20/Zend/zend_alloc.c:2437:3
#2 0x1b0c2e6 in i_zval_ptr_dtor /home/symeon/Desktop/php-5.6.20/Zend/zend_execute.h:80:3
#3 0x1b0ac53 in _zval_ptr_dtor /home/symeon/Desktop/php-5.6.20/Zend/zend_execute_API.c:424:2
#4 0x1b1884e in zend_call_function /home/symeon/Desktop/php-5.6.20/Zend/zend_execute_API.c:889:3
#5 0x1b11a1b in call_user_function_ex
/home/symeon/Desktop/php-5.6.20/Zend/zend_execute_API.c:617:9
#6 0x1703b5e in php_var_serialize_intern
/home/symeon/Desktop/php-5.6.20/ext/standard/var.c:800:12
#7 0x16f75b3 in php_var_serialize /home/symeon/Desktop/php-5.6.20/ext/standard/var.c:905:2
#8 0x1300672 in ps_srlzr_encode_php /home/symeon/Desktop/php-5.6.20/ext/session/session.c:982:2
#9 0x1327eeb in php_session_encode /home/symeon/Desktop/php-5.6.20/ext/session/session.c:209:14
#10 0x1328915 in php_session_save_current_state
/home/symeon/Desktop/php-5.6.20/ext/session/session.c:542:10
#11 0x13284e1 in php_session_flush /home/symeon/Desktop/php-5.6.20/ext/session/session.c:1634:3
#12 0x1315bde in zm_deactivate_session
/home/symeon/Desktop/php-5.6.20/ext/session/session.c:2403:3
#13 0x1bc1ead in zend_deactivate_modules /home/symeon/Desktop/php-5.6.20/Zend/zend_API.c:2449:5
#14 0x185139e in php_request_shutdown /home/symeon/Desktop/php-5.6.20/main/main.c:1867:3
#15 0x1fb1ba5 in do_cli /home/symeon/Desktop/php-5.6.20/sapi/cli/php_cli.c:1177:3
#16 0x1faa2a0 in main /home/symeon/Desktop/php-5.6.20/sapi/cli/php_cli.c:1378:18
#17 0x7f371e059ec4 in __libc_start_main /build/eglibc-3GlaMS/eglibc-2.19/csu/libc-start.c:287
previously allocated by thread T0 here:
#0 0x4fb558 in malloc
/home/symeon/Desktop/LLVM/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:40
#1 0x1a370c6 in _emalloc /home/symeon/Desktop/php-5.6.20/Zend/zend_alloc.c:2427:10
#2 0x1d771c7 in ZEND_NEW_SPEC_HANDLER
/home/symeon/Desktop/php-5.6.20/Zend/zend_vm_execute.h:944:2
#3 0x1d02559 in execute_ex /home/symeon/Desktop/php-5.6.20/Zend/zend_vm_execute.h:363:14
#4 0x1d028af in zend_execute /home/symeon/Desktop/php-5.6.20/Zend/zend_vm_execute.h:388:2
#5 0x1b950b4 in zend_execute_scripts /home/symeon/Desktop/php-5.6.20/Zend/zend.c:1341:4
#6 0x185dd03 in php_execute_script /home/symeon/Desktop/php-5.6.20/main/main.c:2613:14
#7 0x1faeac2 in do_cli /home/symeon/Desktop/php-5.6.20/sapi/cli/php_cli.c:994:5
#8 0x1faa2a0 in main /home/symeon/Desktop/php-5.6.20/sapi/cli/php_cli.c:1378:18
#9 0x7f371e059ec4 in __libc_start_main /build/eglibc-3GlaMS/eglibc-2.19/csu/libc-start.c:287
PHP 5.5.34:
=================================================================
==57833==ERROR: AddressSanitizer: heap-use-after-free on address 0x60300001ced8 at pc 0x000001705300
bp 0x7ffd3c192810 sp 0x7ffd3c192808
READ of size 8 at 0x60300001ced8 thread T0
#0 0x17052ff in php_var_serialize_class_name
/home/symeon/Desktop/php-5.5.34/ext/standard/var.c:607:2
#1 0x17005eb in php_var_serialize_class
/home/symeon/Desktop/php-5.5.34/ext/standard/var.c:623:21
#2 0x16f3a50 in php_var_serialize_intern
/home/symeon/Desktop/php-5.5.34/ext/standard/var.c:816:9
#3 0x16e6ec3 in php_var_serialize /home/symeon/Desktop/php-5.5.34/ext/standard/var.c:908:2
#4 0x12f4a5a in ps_srlzr_encode_php /home/symeon/Desktop/php-5.5.34/ext/session/session.c:981:2
#5 0x131b9bb in php_session_encode /home/symeon/Desktop/php-5.5.34/ext/session/session.c:209:14
#6 0x131c3e5 in php_session_save_current_state
/home/symeon/Desktop/php-5.5.34/ext/session/session.c:542:10
#7 0x131bfb1 in php_session_flush /home/symeon/Desktop/php-5.5.34/ext/session/session.c:1633:3
#8 0x1309b9e in zm_deactivate_session
/home/symeon/Desktop/php-5.5.34/ext/session/session.c:2365:3
#9 0x1baa69d in zend_deactivate_modules /home/symeon/Desktop/php-5.5.34/Zend/zend_API.c:2433:5
#10 0x184f78a in php_request_shutdown /home/symeon/Desktop/php-5.5.34/main/main.c:1781:3
#11 0x1f9b51c in do_cli /home/symeon/Desktop/php-5.5.34/sapi/cli/php_cli.c:1177:3
#12 0x1f93c30 in main /home/symeon/Desktop/php-5.5.34/sapi/cli/php_cli.c:1378:18
#13 0x7f6e66d48ec4 in __libc_start_main /build/eglibc-3GlaMS/eglibc-2.19/csu/libc-start.c:287
#14 0x45d9b5 in _start (/home/symeon/Desktop/php-5.5.34/sapi/cli/php+0x45d9b5)
0x60300001ced8 is located 8 bytes inside of 32-byte region [0x60300001ced0,0x60300001cef0)
freed by thread T0 here:
#0 0x4faa60 in __interceptor_free
/home/symeon/Desktop/LLVM/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:30
#1 0x1a276d6 in _efree /home/symeon/Desktop/php-5.5.34/Zend/zend_alloc.c:2437:3
#2 0x1afd5d6 in i_zval_ptr_dtor /home/symeon/Desktop/php-5.5.34/Zend/zend_execute.h:82:3
#3 0x1afbf43 in _zval_ptr_dtor /home/symeon/Desktop/php-5.5.34/Zend/zend_execute_API.c:423:2
#4 0x1b0c610 in zend_call_function /home/symeon/Desktop/php-5.5.34/Zend/zend_execute_API.c:994:3
#5 0x1b05acb in call_user_function_ex
/home/symeon/Desktop/php-5.5.34/Zend/zend_execute_API.c:722:9
#6 0x16f346e in php_var_serialize_intern
/home/symeon/Desktop/php-5.5.34/ext/standard/var.c:803:12
#7 0x16e6ec3 in php_var_serialize /home/symeon/Desktop/php-5.5.34/ext/standard/var.c:908:2
#8 0x12f4a5a in ps_srlzr_encode_php /home/symeon/Desktop/php-5.5.34/ext/session/session.c:981:2
#9 0x131b9bb in php_session_encode /home/symeon/Desktop/php-5.5.34/ext/session/session.c:209:14
#10 0x131c3e5 in php_session_save_current_state
/home/symeon/Desktop/php-5.5.34/ext/session/session.c:542:10
#11 0x131bfb1 in php_session_flush /home/symeon/Desktop/php-5.5.34/ext/session/session.c:1633:3
#12 0x1309b9e in zm_deactivate_session
/home/symeon/Desktop/php-5.5.34/ext/session/session.c:2365:3
#13 0x1baa69d in zend_deactivate_modules /home/symeon/Desktop/php-5.5.34/Zend/zend_API.c:2433:5
#14 0x184f78a in php_request_shutdown /home/symeon/Desktop/php-5.5.34/main/main.c:1781:3
#15 0x1f9b51c in do_cli /home/symeon/Desktop/php-5.5.34/sapi/cli/php_cli.c:1177:3
#16 0x1f93c30 in main /home/symeon/Desktop/php-5.5.34/sapi/cli/php_cli.c:1378:18
#17 0x7f6e66d48ec4 in __libc_start_main /build/eglibc-3GlaMS/eglibc-2.19/csu/libc-start.c:287
previously allocated by thread T0 here:
#0 0x4fad78 in malloc
/home/symeon/Desktop/LLVM/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:40
#1 0x1a27526 in _emalloc /home/symeon/Desktop/php-5.5.34/Zend/zend_alloc.c:2427:10
#2 0x1d4d037 in ZEND_NEW_SPEC_HANDLER
/home/symeon/Desktop/php-5.5.34/Zend/zend_vm_execute.h:757:2
#3 0x1cd19c9 in execute_ex /home/symeon/Desktop/php-5.5.34/Zend/zend_vm_execute.h:363:14
#4 0x1cd1d1f in zend_execute /home/symeon/Desktop/php-5.5.34/Zend/zend_vm_execute.h:388:2
#5 0x1b7ee94 in zend_execute_scripts /home/symeon/Desktop/php-5.5.34/Zend/zend.c:1327:4
#6 0x185c0e3 in php_execute_script /home/symeon/Desktop/php-5.5.34/main/main.c:2525:14
#7 0x1f98430 in do_cli /home/symeon/Desktop/php-5.5.34/sapi/cli/php_cli.c:994:5
#8 0x1f93c30 in main /home/symeon/Desktop/php-5.5.34/sapi/cli/php_cli.c:1378:18
#9 0x7f6e66d48ec4 in __libc_start_main /build/eglibc-3GlaMS/eglibc-2.19/csu/libc-start.c:287
Cheers,
Symeon
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=72098&edit=1