Bug #72867 [Opn->Csd]: segfault zend.c:143 (gc_zval_possible_root)

Edit report at https://bugs.php.net/bug.php?id=72867&edit=1 ID: 72867 User updated by: brian dot carpenter at gmail dot com Reported by: brian dot carpenter at gmail dot com Summary: segfault zend.c:143 (gc_zval_possible_root) -Status: Open +Status: Closed Type: Bug Package: Reproducible crash Operating System: Debian 8 PHP Version: 5.6.24 Block user comment: N Private report: N New Comment: Does not affect 5.6.28. Previous Comments: ------------------------------------------------------------------------ [2016-11-21 20:06:04] brian dot carpenter at gmail dot com Does not affect 5.6.28. ------------------------------------------------------------------------ [2016-08-17 19:39:00] brian dot carpenter at gmail dot com Description: ------------ Fuzzing PHP 5.6.24 (x64) with American Fuzzy Lop, ASAN and libdislocator.so. Test script: --------------- <?php $poc='a:4:{i:0;i:0;i:1;a:1:{i:0;O:4:"ryat":2:0s:4:"ryat";R:3;s:4:"chtg";i:0;}}i:1;i:0;i:2;R:5;}';$t=unserialize($poc);gc_collect_cycles();$fa0ezval=0;$fa0ezval=ptr2str(0);l.unserialize($poc);$a="";for($i=0;0;);class ryat{var$t;var$g;function __destruct(){$this->chtg=$this->ryat;}}function ptr2str(){for(;$i<8;$i++){o.chr(0);}} Expected result: ---------------- No crash. Actual result: -------------- geeknik@debian:~/php-tmp/crashers/070816$ ./php segfault_gc_zval_possible_root ASAN:SIGSEGV ================================================================= ==496==ERROR: AddressSanitizer: SEGV on unknown address 0x7f262ce7ec69 (pc 0x0000016569ef bp 0x000002367b48 sp 0x7ffc86167c30 T0) #0 0x16569ee in gc_zval_possible_root /home/geeknik/php-5.6.24/Zend/zend_gc.c:143:3 #1 0x15599d2 in gc_zval_check_possible_root /home/geeknik/php-5.6.24/Zend/zend_gc.h:183:3 #2 0x15599d2 in i_zval_ptr_dtor /home/geeknik/php-5.6.24/Zend/zend_execute.h:86 #3 0x15599d2 in _zval_ptr_dtor /home/geeknik/php-5.6.24/Zend/zend_execute_API.c:424 #4 0x15f4075 in zend_hash_destroy /home/geeknik/php-5.6.24/Zend/zend_hash.c:548:4 #5 0x15a6c71 in _zval_dtor_func /home/geeknik/php-5.6.24/Zend/zend_variables.c:45:6 #6 0x155991a in _zval_dtor /home/geeknik/php-5.6.24/Zend/zend_variables.h:35:2 #7 0x155991a in i_zval_ptr_dtor /home/geeknik/php-5.6.24/Zend/zend_execute.h:79 #8 0x155991a in _zval_ptr_dtor /home/geeknik/php-5.6.24/Zend/zend_execute_API.c:424 #9 0x15f4075 in zend_hash_destroy /home/geeknik/php-5.6.24/Zend/zend_hash.c:548:4 #10 0x15a6c71 in _zval_dtor_func /home/geeknik/php-5.6.24/Zend/zend_variables.c:45:6 #11 0x155991a in _zval_dtor /home/geeknik/php-5.6.24/Zend/zend_variables.h:35:2 #12 0x155991a in i_zval_ptr_dtor /home/geeknik/php-5.6.24/Zend/zend_execute.h:79 #13 0x155991a in _zval_ptr_dtor /home/geeknik/php-5.6.24/Zend/zend_execute_API.c:424 #14 0x15f5185 in i_zend_hash_bucket_delete /home/geeknik/php-5.6.24/Zend/zend_hash.c:182:3 #15 0x15f5185 in zend_hash_bucket_delete /home/geeknik/php-5.6.24/Zend/zend_hash.c:192 #16 0x15f5581 in zend_hash_graceful_reverse_destroy /home/geeknik/php-5.6.24/Zend/zend_hash.c:613:3 #17 0x155a230 in shutdown_executor /home/geeknik/php-5.6.24/Zend/zend_execute_API.c:244:3 #18 0x15b0f83 in zend_deactivate /home/geeknik/php-5.6.24/Zend/zend.c:960:2 #19 0x13b807e in php_request_shutdown /home/geeknik/php-5.6.24/main/main.c:1899:2 #20 0x1908b17 in do_cli /home/geeknik/php-5.6.24/sapi/cli/php_cli.c:1177:3 #21 0x190474d in main /home/geeknik/php-5.6.24/sapi/cli/php_cli.c:1378:18 #22 0x7f0c6576bb44 in __libc_start_main /build/glibc-uPj9cH/glibc-2.19/csu/libc-start.c:287 #23 0x5095ac in _start (/home/geeknik/php-5.6.24/sapi/cli/php+0x5095ac) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV /home/geeknik/php-5.6.24/Zend/zend_gc.c:143 gc_zval_possible_root ==496==ABORTING ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=72867&edit=1