Bug #72098 [Asn->Csd]: Use-after-free in php_var_serialize_class_name()

Edit report at https://bugs.php.net/bug.php?id=72098&edit=1 ID: 72098 Updated by: yohgaki@php.net Reported by: s dot paraschoudis at gmail dot com Summary: Use-after-free in php_var_serialize_class_name() -Status: Assigned +Status: Closed Type: Bug Package: Reproducible crash Operating System: Ubuntu 14.04 64/32bit PHP Version: 5.6.20 Assigned To: yohgaki Block user comment: N Private report: Y New Comment: My patch changes behavior a little. Since some users test session module behavior by their test scripts, slight change may break user's unit tests. (I got compliant before) Therefore, the fix is only for new release. Previous Comments: ------------------------------------------------------------------------ [2016-09-04 20:02:36] s dot paraschoudis at gmail dot com Hi, could you please close this issue if it has been fixed? Thanks. ------------------------------------------------------------------------ [2016-07-15 09:10:51] dmitry@php.net The bug was fixed in PHP-7.1 by https://github.com/php/php-src/commit/bfb9307b2d679a91e138fd876880470ece60942b The bug still affects PHP-7.0 and below. Probably this patch might be partially backported. $ USE_ZEND_ALLOC=0 valgrind php7.0/CGI-DEBUG/sapi/cli/php bug72098.php string(11) "Loading Bar" ==1949== Invalid read of size 4 ==1949== at 0x84A1132: php_var_serialize_class_name (var.c:658) ==1949== by 0x84A138A: php_var_serialize_class (var.c:705) ==1949== by 0x84A1D03: php_var_serialize_intern (var.c:908) ==1949== by 0x84A2082: php_var_serialize (var.c:996) ==1949== by 0x83C13A1: ps_srlzr_encode_php (session.c:1027) ==1949== by 0x83BF6A3: php_session_encode (session.c:223) ==1949== by 0x83C0103: php_session_save_current_state (session.c:581) ==1949== by 0x83C2958: php_session_flush (session.c:1685) ==1949== by 0x83C4735: zm_deactivate_session (session.c:2669) ==1949== by 0x85D9AE3: zend_deactivate_modules (zend_API.c:2580) ==1949== by 0x8562F94: php_request_shutdown (main.c:1807) ==1949== by 0x8671181: do_cli (php_cli.c:1141) ==1949== Address 0x986dcd0 is 32 bytes inside a block of size 224 free'd ==1949== at 0x402C3A2: free (vg_replace_malloc.c:530) ==1949== by 0x85A9643: _efree (zend_alloc.c:2461) ==1949== by 0x85E1F54: zend_array_destroy (zend_hash.c:1359) ==1949== by 0x85CFBFE: _zval_dtor_func_for_ptr (zend_variables.c:96) ==1949== by 0x85CF994: i_zval_ptr_dtor (zend_variables.h:58) ==1949== by 0x85CFC7F: _zval_dtor_func_for_ptr (zend_variables.c:122) ==1949== by 0x85BDF9F: i_zval_ptr_dtor (zend_variables.h:58) ==1949== by 0x85BF0F8: _zval_ptr_dtor (zend_execute_API.c:533) ==1949== by 0x83BF560: php_session_track_init (session.c:205) ==1949== by 0x83C000F: php_session_initialize (session.c:546) ==1949== by 0x83C292C: php_session_start (session.c:1676) ==1949== by 0x83C43D1: zif_session_start (session.c:2340) ==1949== Block was alloc'd at ==1949== at 0x402B289: malloc (vg_replace_malloc.c:299) ==1949== by 0x85A95B8: _emalloc (zend_alloc.c:2446) ==1949== by 0x85DEC7D: zend_hash_real_init_ex (zend_hash.c:140) ==1949== by 0x85DED88: zend_hash_check_init (zend_hash.c:163) ==1949== by 0x85DFF65: _zend_hash_add_or_update_i (zend_hash.c:563) ==1949== by 0x85E0310: _zend_hash_add_new (zend_hash.c:653) ==1949== by 0x8618F70: zend_fetch_dimension_address_inner (zend_execute.c:1610) ==1949== by 0x8639A8E: ZEND_ASSIGN_DIM_SPEC_VAR_CONST_HANDLER (zend_vm_execute.h:17455) ==1949== by 0x861B4B1: execute_ex (zend_vm_execute.h:414) ==1949== by 0x861B566: zend_execute (zend_vm_execute.h:458) ==1949== by 0x85D2711: zend_execute_scripts (zend.c:1427) ==1949== by 0x8563ECC: php_execute_script (main.c:2494) ------------------------------------------------------------------------ [2016-05-14 09:46:11] s dot paraschoudis at gmail dot com Okay. Any plans for fixing it? Thanks. ------------------------------------------------------------------------ [2016-04-25 01:58:32] stas@php.net Definitely not security issue, the problem is that session_start() in spl_autoload_register() cleans up session, thus destroying the object __sleep is working on. Reproducible also on 5.x. ------------------------------------------------------------------------ [2016-04-24 20:56:12] s dot paraschoudis at gmail dot com Description: ------------ There is a use-after-free vulnerability in php_var_serialize_class_name() which affects all the major php versions. Please note I am not able to reproduce the issue without ASAN instrumentation so this might not be a security issue at all. Test script: --------------- Proof Of Concept ================= <?php spl_autoload_register(function ($class) { session_start(); var_dump("Loading $class"); class Bar {}; }); class Foo { function __sleep() { new Bar; return array(); } } session_start(); $_SESSION['foo'] = new Foo; ?> Actual result: -------------- PHP 7.0.5: symeon@ubuntu:~/Desktop/0days/sessions$ USE_ZEND_ALLOC=0 ASAN_OPTIONS=detect_leaks=0 ~/Desktop/php-7.0.5/sapi/cli/php session_uaf.php string(11) "Loading Bar" ================================================================= ==4308==ERROR: AddressSanitizer: heap-use-after-free on address 0x61200000ebe0 at pc 0x00000169551c bp 0x7ffe612e9690 sp 0x7ffe612e9688 READ of size 8 at 0x61200000ebe0 thread T0 #0 0x169551b in php_var_serialize_class_name /home/symeon/Desktop/php-7.0.5/ext/standard/var.c:658:2 #1 0x1693fa5 in php_var_serialize_class /home/symeon/Desktop/php-7.0.5/ext/standard/var.c:675:21 #2 0x168db05 in php_var_serialize_intern /home/symeon/Desktop/php-7.0.5/ext/standard/var.c:882:9 #3 0x168c308 in php_var_serialize /home/symeon/Desktop/php-7.0.5/ext/standard/var.c:966:2 #4 0x12825e7 in ps_srlzr_encode_php /home/symeon/Desktop/php-7.0.5/ext/session/session.c:1009:2 #5 0x129fa58 in php_session_encode /home/symeon/Desktop/php-7.0.5/ext/session/session.c:223:10 #6 0x12a0464 in php_session_save_current_state /home/symeon/Desktop/php-7.0.5/ext/session/session.c:582:11 #7 0x12a006d in php_session_flush /home/symeon/Desktop/php-7.0.5/ext/session/session.c:1658:3 #8 0x128e0b3 in zm_deactivate_session /home/symeon/Desktop/php-7.0.5/ext/session/session.c:2642:3 #9 0x1ae524a in zend_deactivate_modules /home/symeon/Desktop/php-7.0.5/Zend/zend_API.c:2580:5 #10 0x17b6c18 in php_request_shutdown /home/symeon/Desktop/php-7.0.5/main/main.c:1804:3 #11 0x1f4fb87 in do_cli /home/symeon/Desktop/php-7.0.5/sapi/cli/php_cli.c:1141:3 #12 0x1f48e9a in main /home/symeon/Desktop/php-7.0.5/sapi/cli/php_cli.c:1344:18 #13 0x7f66da36bec4 in __libc_start_main /build/eglibc-3GlaMS/eglibc-2.19/csu/libc-start.c:287 #14 0x45f755 in _start (/home/symeon/Desktop/php-7.0.5/sapi/cli/php+0x45f755) 0x61200000ebe0 is located 32 bytes inside of 288-byte region [0x61200000ebc0,0x61200000ece0) freed by thread T0 here: #0 0x4fc800 in __interceptor_free /home/symeon/Desktop/LLVM/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:30 #1 0x198fb76 in _efree /home/symeon/Desktop/php-7.0.5/Zend/zend_alloc.c:2461:4 #2 0x1b2c712 in zend_array_destroy /home/symeon/Desktop/php-7.0.5/Zend/zend_hash.c:1359:2 #3 0x1aa2ff9 in _zval_dtor_func_for_ptr /home/symeon/Desktop/php-7.0.5/Zend/zend_variables.c:96:5 #4 0x1aa2cb0 in i_zval_ptr_dtor /home/symeon/Desktop/php-7.0.5/Zend/zend_variables.h:58:4 #5 0x1aa3143 in _zval_dtor_func_for_ptr /home/symeon/Desktop/php-7.0.5/Zend/zend_variables.c:122:5 #6 0x1a26a70 in i_zval_ptr_dtor /home/symeon/Desktop/php-7.0.5/Zend/zend_variables.h:58:4 #7 0x1a24f0b in _zval_ptr_dtor /home/symeon/Desktop/php-7.0.5/Zend/zend_execute_API.c:533:2 #8 0x1290888 in php_session_track_init /home/symeon/Desktop/php-7.0.5/ext/session/session.c:205:3 #9 0x128a485 in php_session_initialize /home/symeon/Desktop/php-7.0.5/ext/session/session.c:547:2 #10 0x128920e in php_session_start /home/symeon/Desktop/php-7.0.5/ext/session/session.c:1649:2 #11 0x1299727 in zif_session_start /home/symeon/Desktop/php-7.0.5/ext/session/session.c:2313:2 #12 0x1e6236d in ZEND_DO_ICALL_SPEC_HANDLER /home/symeon/Desktop/php-7.0.5/Zend/zend_vm_execute.h:586:2 #13 0x1c8324b in execute_ex /home/symeon/Desktop/php-7.0.5/Zend/zend_vm_execute.h:417:7 #14 0x1a2ef1e in zend_call_function /home/symeon/Desktop/php-7.0.5/Zend/zend_execute_API.c:863:4 #15 0x1b9091c in zend_call_method /home/symeon/Desktop/php-7.0.5/Zend/zend_interfaces.c:104:12 #16 0x12eca90 in zif_spl_autoload_call /home/symeon/Desktop/php-7.0.5/ext/spl/php_spl.c:429:4 #17 0x1a2f5de in zend_call_function /home/symeon/Desktop/php-7.0.5/Zend/zend_execute_API.c:882:4 #18 0x1a32aa1 in zend_lookup_class_ex /home/symeon/Desktop/php-7.0.5/Zend/zend_execute_API.c:1044:7 #19 0x1a36b8d in zend_fetch_class_by_name /home/symeon/Desktop/php-7.0.5/Zend/zend_execute_API.c:1390:19 #20 0x1d5e3de in ZEND_NEW_SPEC_CONST_HANDLER /home/symeon/Desktop/php-7.0.5/Zend/zend_vm_execute.h:3354:9 #21 0x1c8324b in execute_ex /home/symeon/Desktop/php-7.0.5/Zend/zend_vm_execute.h:417:7 #22 0x1a2ef1e in zend_call_function /home/symeon/Desktop/php-7.0.5/Zend/zend_execute_API.c:863:4 #23 0x1a2af18 in call_user_function_ex /home/symeon/Desktop/php-7.0.5/Zend/zend_execute_API.c:685:9 #24 0x168d638 in php_var_serialize_intern /home/symeon/Desktop/php-7.0.5/ext/standard/var.c:870:12 #25 0x168c308 in php_var_serialize /home/symeon/Desktop/php-7.0.5/ext/standard/var.c:966:2 #26 0x12825e7 in ps_srlzr_encode_php /home/symeon/Desktop/php-7.0.5/ext/session/session.c:1009:2 #27 0x129fa58 in php_session_encode /home/symeon/Desktop/php-7.0.5/ext/session/session.c:223:10 #28 0x12a0464 in php_session_save_current_state /home/symeon/Desktop/php-7.0.5/ext/session/session.c:582:11 #29 0x12a006d in php_session_flush /home/symeon/Desktop/php-7.0.5/ext/session/session.c:1658:3 previously allocated by thread T0 here: #0 0x4fcb18 in malloc /home/symeon/Desktop/LLVM/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:40 #1 0x198f8b8 in _emalloc /home/symeon/Desktop/php-7.0.5/Zend/zend_alloc.c:2446:11 #2 0x1b141b8 in zend_hash_real_init_ex /home/symeon/Desktop/php-7.0.5/Zend/zend_hash.c:140:3 #3 0x1b1922b in zend_hash_check_init /home/symeon/Desktop/php-7.0.5/Zend/zend_hash.c:163:3 #4 0x1b1f922 in _zend_hash_add_or_update_i /home/symeon/Desktop/php-7.0.5/Zend/zend_hash.c:563:3 #5 0x1b20f54 in _zend_hash_add_new /home/symeon/Desktop/php-7.0.5/Zend/zend_hash.c:653:9 #6 0x1ed72d6 in zend_fetch_dimension_address_inner /home/symeon/Desktop/php-7.0.5/Zend/zend_execute.c:1610:15 #7 0x1e74bc6 in ZEND_ASSIGN_DIM_SPEC_VAR_CONST_HANDLER /home/symeon/Desktop/php-7.0.5/Zend/zend_vm_execute.h:17426:19 #8 0x1c8324b in execute_ex /home/symeon/Desktop/php-7.0.5/Zend/zend_vm_execute.h:417:7 #9 0x1c83738 in zend_execute /home/symeon/Desktop/php-7.0.5/Zend/zend_vm_execute.h:458:2 #10 0x1ab5fac in zend_execute_scripts /home/symeon/Desktop/php-7.0.5/Zend/zend.c:1427:4 #11 0x17c2891 in php_execute_script /home/symeon/Desktop/php-7.0.5/main/main.c:2487:14 #12 0x1f4d39f in do_cli /home/symeon/Desktop/php-7.0.5/sapi/cli/php_cli.c:974:5 #13 0x1f48e9a in main /home/symeon/Desktop/php-7.0.5/sapi/cli/php_cli.c:1344:18 #14 0x7f66da36bec4 in __libc_start_main /build/eglibc-3GlaMS/eglibc-2.19/csu/libc-start.c:287 PHP 6.5.20: ================================================================= ==11546==ERROR: AddressSanitizer: heap-use-after-free on address 0x60300001cd88 at pc 0x0000017154c0 bp 0x7ffe11ecd210 sp 0x7ffe11ecd208 READ of size 8 at 0x60300001cd88 thread T0 #0 0x17154bf in php_var_serialize_class_name /home/symeon/Desktop/php-5.6.20/ext/standard/var.c:607:2 #1 0x1710ccb in php_var_serialize_class /home/symeon/Desktop/php-5.6.20/ext/standard/var.c:623:21 #2 0x1704140 in php_var_serialize_intern /home/symeon/Desktop/php-5.6.20/ext/standard/var.c:813:9 #3 0x16f75b3 in php_var_serialize /home/symeon/Desktop/php-5.6.20/ext/standard/var.c:905:2 #4 0x1300672 in ps_srlzr_encode_php /home/symeon/Desktop/php-5.6.20/ext/session/session.c:982:2 #5 0x1327eeb in php_session_encode /home/symeon/Desktop/php-5.6.20/ext/session/session.c:209:14 #6 0x1328915 in php_session_save_current_state /home/symeon/Desktop/php-5.6.20/ext/session/session.c:542:10 #7 0x13284e1 in php_session_flush /home/symeon/Desktop/php-5.6.20/ext/session/session.c:1634:3 #8 0x1315bde in zm_deactivate_session /home/symeon/Desktop/php-5.6.20/ext/session/session.c:2403:3 #9 0x1bc1ead in zend_deactivate_modules /home/symeon/Desktop/php-5.6.20/Zend/zend_API.c:2449:5 #10 0x185139e in php_request_shutdown /home/symeon/Desktop/php-5.6.20/main/main.c:1867:3 #11 0x1fb1ba5 in do_cli /home/symeon/Desktop/php-5.6.20/sapi/cli/php_cli.c:1177:3 #12 0x1faa2a0 in main /home/symeon/Desktop/php-5.6.20/sapi/cli/php_cli.c:1378:18 #13 0x7f371e059ec4 in __libc_start_main /build/eglibc-3GlaMS/eglibc-2.19/csu/libc-start.c:287 #14 0x45e195 in _start (/home/symeon/Desktop/php-5.6.20/sapi/cli/php+0x45e195) 0x60300001cd88 is located 8 bytes inside of 32-byte region [0x60300001cd80,0x60300001cda0) freed by thread T0 here: #0 0x4fb240 in __interceptor_free /home/symeon/Desktop/LLVM/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:30 #1 0x1a37276 in _efree /home/symeon/Desktop/php-5.6.20/Zend/zend_alloc.c:2437:3 #2 0x1b0c2e6 in i_zval_ptr_dtor /home/symeon/Desktop/php-5.6.20/Zend/zend_execute.h:80:3 #3 0x1b0ac53 in _zval_ptr_dtor /home/symeon/Desktop/php-5.6.20/Zend/zend_execute_API.c:424:2 #4 0x1b1884e in zend_call_function /home/symeon/Desktop/php-5.6.20/Zend/zend_execute_API.c:889:3 #5 0x1b11a1b in call_user_function_ex /home/symeon/Desktop/php-5.6.20/Zend/zend_execute_API.c:617:9 #6 0x1703b5e in php_var_serialize_intern /home/symeon/Desktop/php-5.6.20/ext/standard/var.c:800:12 #7 0x16f75b3 in php_var_serialize /home/symeon/Desktop/php-5.6.20/ext/standard/var.c:905:2 #8 0x1300672 in ps_srlzr_encode_php /home/symeon/Desktop/php-5.6.20/ext/session/session.c:982:2 #9 0x1327eeb in php_session_encode /home/symeon/Desktop/php-5.6.20/ext/session/session.c:209:14 #10 0x1328915 in php_session_save_current_state /home/symeon/Desktop/php-5.6.20/ext/session/session.c:542:10 #11 0x13284e1 in php_session_flush /home/symeon/Desktop/php-5.6.20/ext/session/session.c:1634:3 #12 0x1315bde in zm_deactivate_session /home/symeon/Desktop/php-5.6.20/ext/session/session.c:2403:3 #13 0x1bc1ead in zend_deactivate_modules /home/symeon/Desktop/php-5.6.20/Zend/zend_API.c:2449:5 #14 0x185139e in php_request_shutdown /home/symeon/Desktop/php-5.6.20/main/main.c:1867:3 #15 0x1fb1ba5 in do_cli /home/symeon/Desktop/php-5.6.20/sapi/cli/php_cli.c:1177:3 #16 0x1faa2a0 in main /home/symeon/Desktop/php-5.6.20/sapi/cli/php_cli.c:1378:18 #17 0x7f371e059ec4 in __libc_start_main /build/eglibc-3GlaMS/eglibc-2.19/csu/libc-start.c:287 previously allocated by thread T0 here: #0 0x4fb558 in malloc /home/symeon/Desktop/LLVM/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:40 #1 0x1a370c6 in _emalloc /home/symeon/Desktop/php-5.6.20/Zend/zend_alloc.c:2427:10 #2 0x1d771c7 in ZEND_NEW_SPEC_HANDLER /home/symeon/Desktop/php-5.6.20/Zend/zend_vm_execute.h:944:2 #3 0x1d02559 in execute_ex /home/symeon/Desktop/php-5.6.20/Zend/zend_vm_execute.h:363:14 #4 0x1d028af in zend_execute /home/symeon/Desktop/php-5.6.20/Zend/zend_vm_execute.h:388:2 #5 0x1b950b4 in zend_execute_scripts /home/symeon/Desktop/php-5.6.20/Zend/zend.c:1341:4 #6 0x185dd03 in php_execute_script /home/symeon/Desktop/php-5.6.20/main/main.c:2613:14 #7 0x1faeac2 in do_cli /home/symeon/Desktop/php-5.6.20/sapi/cli/php_cli.c:994:5 #8 0x1faa2a0 in main /home/symeon/Desktop/php-5.6.20/sapi/cli/php_cli.c:1378:18 #9 0x7f371e059ec4 in __libc_start_main /build/eglibc-3GlaMS/eglibc-2.19/csu/libc-start.c:287 PHP 5.5.34: ================================================================= ==57833==ERROR: AddressSanitizer: heap-use-after-free on address 0x60300001ced8 at pc 0x000001705300 bp 0x7ffd3c192810 sp 0x7ffd3c192808 READ of size 8 at 0x60300001ced8 thread T0 #0 0x17052ff in php_var_serialize_class_name /home/symeon/Desktop/php-5.5.34/ext/standard/var.c:607:2 #1 0x17005eb in php_var_serialize_class /home/symeon/Desktop/php-5.5.34/ext/standard/var.c:623:21 #2 0x16f3a50 in php_var_serialize_intern /home/symeon/Desktop/php-5.5.34/ext/standard/var.c:816:9 #3 0x16e6ec3 in php_var_serialize /home/symeon/Desktop/php-5.5.34/ext/standard/var.c:908:2 #4 0x12f4a5a in ps_srlzr_encode_php /home/symeon/Desktop/php-5.5.34/ext/session/session.c:981:2 #5 0x131b9bb in php_session_encode /home/symeon/Desktop/php-5.5.34/ext/session/session.c:209:14 #6 0x131c3e5 in php_session_save_current_state /home/symeon/Desktop/php-5.5.34/ext/session/session.c:542:10 #7 0x131bfb1 in php_session_flush /home/symeon/Desktop/php-5.5.34/ext/session/session.c:1633:3 #8 0x1309b9e in zm_deactivate_session /home/symeon/Desktop/php-5.5.34/ext/session/session.c:2365:3 #9 0x1baa69d in zend_deactivate_modules /home/symeon/Desktop/php-5.5.34/Zend/zend_API.c:2433:5 #10 0x184f78a in php_request_shutdown /home/symeon/Desktop/php-5.5.34/main/main.c:1781:3 #11 0x1f9b51c in do_cli /home/symeon/Desktop/php-5.5.34/sapi/cli/php_cli.c:1177:3 #12 0x1f93c30 in main /home/symeon/Desktop/php-5.5.34/sapi/cli/php_cli.c:1378:18 #13 0x7f6e66d48ec4 in __libc_start_main /build/eglibc-3GlaMS/eglibc-2.19/csu/libc-start.c:287 #14 0x45d9b5 in _start (/home/symeon/Desktop/php-5.5.34/sapi/cli/php+0x45d9b5) 0x60300001ced8 is located 8 bytes inside of 32-byte region [0x60300001ced0,0x60300001cef0) freed by thread T0 here: #0 0x4faa60 in __interceptor_free /home/symeon/Desktop/LLVM/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:30 #1 0x1a276d6 in _efree /home/symeon/Desktop/php-5.5.34/Zend/zend_alloc.c:2437:3 #2 0x1afd5d6 in i_zval_ptr_dtor /home/symeon/Desktop/php-5.5.34/Zend/zend_execute.h:82:3 #3 0x1afbf43 in _zval_ptr_dtor /home/symeon/Desktop/php-5.5.34/Zend/zend_execute_API.c:423:2 #4 0x1b0c610 in zend_call_function /home/symeon/Desktop/php-5.5.34/Zend/zend_execute_API.c:994:3 #5 0x1b05acb in call_user_function_ex /home/symeon/Desktop/php-5.5.34/Zend/zend_execute_API.c:722:9 #6 0x16f346e in php_var_serialize_intern /home/symeon/Desktop/php-5.5.34/ext/standard/var.c:803:12 #7 0x16e6ec3 in php_var_serialize /home/symeon/Desktop/php-5.5.34/ext/standard/var.c:908:2 #8 0x12f4a5a in ps_srlzr_encode_php /home/symeon/Desktop/php-5.5.34/ext/session/session.c:981:2 #9 0x131b9bb in php_session_encode /home/symeon/Desktop/php-5.5.34/ext/session/session.c:209:14 #10 0x131c3e5 in php_session_save_current_state /home/symeon/Desktop/php-5.5.34/ext/session/session.c:542:10 #11 0x131bfb1 in php_session_flush /home/symeon/Desktop/php-5.5.34/ext/session/session.c:1633:3 #12 0x1309b9e in zm_deactivate_session /home/symeon/Desktop/php-5.5.34/ext/session/session.c:2365:3 #13 0x1baa69d in zend_deactivate_modules /home/symeon/Desktop/php-5.5.34/Zend/zend_API.c:2433:5 #14 0x184f78a in php_request_shutdown /home/symeon/Desktop/php-5.5.34/main/main.c:1781:3 #15 0x1f9b51c in do_cli /home/symeon/Desktop/php-5.5.34/sapi/cli/php_cli.c:1177:3 #16 0x1f93c30 in main /home/symeon/Desktop/php-5.5.34/sapi/cli/php_cli.c:1378:18 #17 0x7f6e66d48ec4 in __libc_start_main /build/eglibc-3GlaMS/eglibc-2.19/csu/libc-start.c:287 previously allocated by thread T0 here: #0 0x4fad78 in malloc /home/symeon/Desktop/LLVM/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:40 #1 0x1a27526 in _emalloc /home/symeon/Desktop/php-5.5.34/Zend/zend_alloc.c:2427:10 #2 0x1d4d037 in ZEND_NEW_SPEC_HANDLER /home/symeon/Desktop/php-5.5.34/Zend/zend_vm_execute.h:757:2 #3 0x1cd19c9 in execute_ex /home/symeon/Desktop/php-5.5.34/Zend/zend_vm_execute.h:363:14 #4 0x1cd1d1f in zend_execute /home/symeon/Desktop/php-5.5.34/Zend/zend_vm_execute.h:388:2 #5 0x1b7ee94 in zend_execute_scripts /home/symeon/Desktop/php-5.5.34/Zend/zend.c:1327:4 #6 0x185c0e3 in php_execute_script /home/symeon/Desktop/php-5.5.34/main/main.c:2525:14 #7 0x1f98430 in do_cli /home/symeon/Desktop/php-5.5.34/sapi/cli/php_cli.c:994:5 #8 0x1f93c30 in main /home/symeon/Desktop/php-5.5.34/sapi/cli/php_cli.c:1378:18 #9 0x7f6e66d48ec4 in __libc_start_main /build/eglibc-3GlaMS/eglibc-2.19/csu/libc-start.c:287 Cheers, Symeon ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=72098&edit=1