Sec Bug->Bug #73136 [Opn->Nab]: NULL pointer dereference in mb_parse_str

Edit report at https://bugs.php.net/bug.php?id=73136&edit=1 ID: 73136 Updated by: stas@php.net Reported by: minhrau dot vc dot 365 at gmail dot com Summary: NULL pointer dereference in mb_parse_str -Status: Open +Status: Not a bug -Type: Security +Type: Bug Package: mbstring related Operating System: ALL PHP Version: 7.0.11 Block user comment: N Private report: Y New Comment: Please stop. Previous Comments: ------------------------------------------------------------------------ [2016-09-26 03:06:27] minhrau dot vc dot 365 at gmail dot com The crash happen before reaching the Warning. Just export USE_ZEND_ALLOC=0 and check again. Thanks. ------------------------------------------------------------------------ [2016-09-26 03:06:02] stas@php.net Please next time report all non-standard settings you used. Setting USE_ZEND_ALLOC=0 overrides normal memory management, and in this case if you're out of memory you'd get segfault. ------------------------------------------------------------------------ [2016-09-26 03:03:07] minhrau dot vc dot 365 at gmail dot com I tried to add this line below into my testcase, its output is 1000. But I didn't get the "Warning: mb_parse_str(): Input variables exceeded 1000". But this is a warning, script will continue running? echo ini_get("max_input_vars"); And must export this: export USE_ZEND_ALLOC=0 to use normal alloc. ------------------------------------------------------------------------ [2016-09-26 02:50:46] stas@php.net The default for max_input_vars is 1000. Did you use any additional options? I still am unable to reproduce any issue. ------------------------------------------------------------------------ [2016-09-26 01:47:45] minhrau dot vc dot 365 at gmail dot com Could you check your php.ini? In default configuration, the line max_input_vars had been comment out. ; max_input_vars = 1000 Regards. ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=73136 -- Edit this bug report at https://bugs.php.net/bug.php?id=73136&edit=1