Bug #74593 [NEW]: crash in i_zval_ptr_dtor()
From: whitehat002 at hotmail dot com
Operating system:
PHP version: 7.1.5
Package: Reproducible crash
Bug Type: Bug
Bug description:crash in i_zval_ptr_dtor()
Description:
------------
The bug is related to bug#74310.But I find the bug still exists in
php7.1.5 which is the latest version.
Test script:
---------------
<?php
$array=array();
$$array[99999999]=$Array="AAA";
$$array[1]=$$Array="BBB";
Expected result:
----------------
no crash
Actual result:
--------------
root@hackyzh-virtual-machine:~# gdb -q --args ./php-7.1.5/sapi/cli/php
-n poc2.php
Reading symbols from /root/php-7.1.5/sapi/cli/php...done.
gdb-peda$ r
[Thread debugging using libthread_db enabled]
Using host libthread_db library
"/lib/i386-linux-gnu/libthread_db.so.1".
Fatal error: Allowed memory size of 134217728 bytes exhausted (tried to
allocate 100000020 bytes) in /root/poc2.php on line 4
Program received signal SIGSEGV, Segmentation fault.
[----------------------------------registers-----------------------------------]
EAX: 0xb7013060 --> 0xb0e00000
EBX: 0x8a8ae48 --> 0x1
ECX: 0xb0e00000
EDX: 0x0
ESI: 0xc0
EDI: 0xb70561c8 --> 0x0
EBP: 0xb70561c0 --> 0xb7013060 --> 0xb0e00000
ESP: 0xbfffe06c --> 0x83d205c
(<zend_hash_graceful_reverse_destroy+300>: mov eax,DWORD PTR
[esp+0x14])
EIP: 0x83b1d12 (<zend_unclean_zval_ptr_dtor+18>: mov edx,DWORD PTR
[ecx])
EFLAGS: 0x210202 (carry parity adjust zero sign trap INTERRUPT direction
overflow)
[-------------------------------------code-------------------------------------]
0x83b1d0a <zend_unclean_zval_ptr_dtor+10>: test BYTE PTR
[eax+0x9],0x4
0x83b1d0e <zend_unclean_zval_ptr_dtor+14>:
je 0x83b1d32 <zend_unclean_zval_ptr_dtor+50>
0x83b1d10 <zend_unclean_zval_ptr_dtor+16>: mov ecx,DWORD PTR
[eax]
=> 0x83b1d12 <zend_unclean_zval_ptr_dtor+18>: mov edx,DWORD PTR
[ecx]
0x83b1d14 <zend_unclean_zval_ptr_dtor+20>: sub edx,0x1
0x83b1d17 <zend_unclean_zval_ptr_dtor+23>: test edx,edx
0x83b1d19 <zend_unclean_zval_ptr_dtor+25>: mov DWORD PTR
[ecx],edx
0x83b1d1b <zend_unclean_zval_ptr_dtor+27>:
je 0x83b1d40 <zend_unclean_zval_ptr_dtor+64>
[------------------------------------stack-------------------------------------]
0000| 0xbfffe06c --> 0x83d205c
(<zend_hash_graceful_reverse_destroy+300>: mov eax,DWORD PTR
[esp+0x14])
0004| 0xbfffe070 --> 0xbfffe0a0 --> 0xb7013060 --> 0xb0e00000
0008| 0xbfffe074 --> 0x0
0012| 0xbfffe078 --> 0x1
0016| 0xbfffe07c --> 0xb7fff938 --> 0x0
0020| 0xbfffe080 --> 0x1
0024| 0xbfffe084 --> 0x8
0028| 0xbfffe088 --> 0x0
[------------------------------------------------------------------------------]
Legend: code, data, rodata, value
Stopped reason: SIGSEGV
i_zval_ptr_dtor (zval_ptr=0xb7013060) at
/root/php-7.1.5/Zend/zend_variables.h:47
47 if (!Z_DELREF_P(zval_ptr)) {
gdb-peda$ bt
#0 i_zval_ptr_dtor (zval_ptr=0xb7013060) at
/root/php-7.1.5/Zend/zend_variables.h:47
#1 zend_unclean_zval_ptr_dtor (zv=0xb7013060)
at /root/php-7.1.5/Zend/zend_execute_API.c:210
#2 0x083d205c in _zend_hash_del_el_ex (prev=<optimized out>,
p=<optimized out>,
idx=<optimized out>, ht=<optimized out>) at
/root/php-7.1.5/Zend/zend_hash.c:998
#3 _zend_hash_del_el (p=<optimized out>, idx=0xc0, ht=0x8a8ae48)
at /root/php-7.1.5/Zend/zend_hash.c:1021
#4 zend_hash_graceful_reverse_destroy (ht=0x8a8ae48)
at /root/php-7.1.5/Zend/zend_hash.c:1477
#5 0x083b2341 in shutdown_executor () at
/root/php-7.1.5/Zend/zend_execute_API.c:279
#6 0x083c161c in zend_deactivate () at /root/php-7.1.5/Zend/zend.c:999
#7 0x08361a97 in php_request_shutdown (dummy=0x0) at
/root/php-7.1.5/main/main.c:1877
#8 0x08458fc0 in do_cli (argc=0x3, argv=0x8a8e868)
at /root/php-7.1.5/sapi/cli/php_cli.c:1160
#9 0x080785ad in main (argc=0x3, argv=0x8a8e868)
at /root/php-7.1.5/sapi/cli/php_cli.c:1381
#10 0xb791daf3 in __libc_start_main () from
/lib/i386-linux-gnu/libc.so.6
#11 0x08078641 in _start ()
--
Edit bug report at https://bugs.php.net/bug.php?id=74593&edit=1
--
Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=74593&r=trysnapshot54
Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=74593&r=trysnapshot55
Try a snapshot (trunk): https://bugs.php.net/fix.php?id=74593&r=trysnapshottrunk
Fixed in SVN: https://bugs.php.net/fix.php?id=74593&r=fixed
Fixed in release: https://bugs.php.net/fix.php?id=74593&r=alreadyfixed
Need backtrace: https://bugs.php.net/fix.php?id=74593&r=needtrace
Need Reproduce Script: https://bugs.php.net/fix.php?id=74593&r=needscript
Try newer version: https://bugs.php.net/fix.php?id=74593&r=oldversion
Not developer issue: https://bugs.php.net/fix.php?id=74593&r=support
Expected behavior: https://bugs.php.net/fix.php?id=74593&r=notwrong
Not enough info: https://bugs.php.net/fix.php?id=74593&r=notenoughinfo
Submitted twice: https://bugs.php.net/fix.php?id=74593&r=submittedtwice
register_globals: https://bugs.php.net/fix.php?id=74593&r=globals
PHP 4 support discontinued: https://bugs.php.net/fix.php?id=74593&r=php4
Daylight Savings: https://bugs.php.net/fix.php?id=74593&r=dst
IIS Stability: https://bugs.php.net/fix.php?id=74593&r=isapi
Install GNU Sed: https://bugs.php.net/fix.php?id=74593&r=gnused
Floating point limitations: https://bugs.php.net/fix.php?id=74593&r=float
No Zend Extensions: https://bugs.php.net/fix.php?id=74593&r=nozend
MySQL Configuration Error: https://bugs.php.net/fix.php?id=74593&r=mysqlcfg
Thread (2 messages)
- whitehat002 at hotmail dot com