Bug #74377 [NEW]: null pointer deref and crash in zval_addref_p()

From: brian dot carpenter at gmail dot com Operating system: Debian 8 x64 PHP version: 5.6.30 Package: Reproducible crash Bug Type: Bug Bug description:null pointer deref and crash in zval_addref_p() Description: ------------ PHP 5.6.30 on Debian 8 x64 compiled with afl-gcc and ASAN. Test script: --------------- https://drive.google.com/file/d/0B3Tl4QiWJUt8TkVpZFZaZUVHQlU/view?usp=sharing Expected result: ---------------- No crash. Actual result: -------------- ==22740==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x000001cf6a5c sp 0x7ffd0bcd1980 bp 0x7fc8ca0b49f8 T0) #0 0x1cf6a5b in zval_addref_p /root/php-5.6.30/Zend/zend.h:407 #1 0x1cf6a5b in zend_binary_assign_op_helper_SPEC_CV_CV /root/php-5.6.30/Zend/zend_vm_execute.h:40099 #2 0x1a2f7d6 in execute_ex /root/php-5.6.30/Zend/zend_vm_execute.h:363 #3 0x1898d30 in zend_execute_scripts /root/php-5.6.30/Zend/zend.c:1341 #4 0x15d377f in php_execute_script /root/php-5.6.30/main/main.c:2613 #5 0x1e5d29f in do_cli /root/php-5.6.30/sapi/cli/php_cli.c:998 #6 0x456eb8 in main /root/php-5.6.30/sapi/cli/php_cli.c:1382 #7 0x7fc8c7c0fb44 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b44) #8 0x457e3e (/root/php-5.6.30/sapi/cli/php+0x457e3e) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV /root/php-5.6.30/Zend/zend.h:407 zval_addref_p -- Edit bug report at https://bugs.php.net/bug.php?id=74377&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=74377&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=74377&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=74377&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=74377&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=74377&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=74377&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=74377&r=needscript Try newer version: https://bugs.php.net/fix.php?id=74377&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=74377&r=support Expected behavior: https://bugs.php.net/fix.php?id=74377&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=74377&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=74377&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=74377&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=74377&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=74377&r=dst IIS Stability: https://bugs.php.net/fix.php?id=74377&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=74377&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=74377&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=74377&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=74377&r=mysqlcfg