Bug #74733 [NEW]: stack-overflow in spl_autoload_register

From: martino dot sani at gmail dot com Operating system: Linux x86_64 PHP version: 7.2Git-2017-06-09 (Git) Package: SPL related Bug Type: Bug Bug description:stack-overflow in spl_autoload_register Description: ------------ American fuzzy lop detects an infinite recursion that can lead to a stack-overflow. Test platform: Linux 4.9.20-std-1 #1 SMP Tue Apr 4 12:56:17 UTC 2017 x86_64 GNU/Linux GIT SHA: e72970026d381ab250b5cc4f9e3ad5f0a384ddaf Test script: --------------- <?php spl_autoload_register(function($e){static$i;if($i++){}class_exists(''.$i);});var_dump(class_exists('0'))?> Actual result: -------------- $ ./php -f 0.php.tmin ASAN:DEADLYSIGNAL ==18723==ERROR: AddressSanitizer: stack-overflow on address 0x7ffed1e32da8 (pc 0x0000004dcc91 bp 0x7ffed1e33650 sp 0x7ffed1e32db0 T0) #0 0x4dcc90 in __interceptor_memcmp.part.69 (/tmp/bin/php+0x4dcc90) #1 0x1aa4d2e in zend_hash_find_bucket /tmp/php-src-latest/Zend/zend_hash.c:491:8 #2 0x1aa4944 in zend_hash_find /tmp/php-src-latest/Zend/zend_hash.c:1958:6 #3 0x1db91c4 in ZEND_BIND_STATIC_SPEC_CV_CONST_HANDLER /tmp/php-src-latest/Zend/zend_vm_execute.h:38766:10 #4 0x1b8de13 in execute_ex /tmp/php-src-latest/Zend/zend_vm_execute.h:59725:7 #5 0x19f18d3 in zend_call_function /tmp/php-src-latest/Zend/zend_execute_API.c:863:3 #6 0x143a561 in zif_spl_autoload_call /tmp/php-src-latest/ext/spl/php_spl.c:451:4 #7 0x19f1cda in zend_call_function /tmp/php-src-latest/Zend/zend_execute_API.c:877:4 #8 0x19f40f0 in zend_lookup_class_ex /tmp/php-src-latest/Zend/zend_execute_API.c:1040:7 #9 0x19f464d in zend_lookup_class /tmp/php-src-latest/Zend/zend_execute_API.c:1061:9 #10 0x1ac3441 in zif_class_exists /tmp/php-src-latest/Zend/zend_builtin_functions.c:1391:8 -- Edit bug report at https://bugs.php.net/bug.php?id=74733&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=74733&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=74733&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=74733&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=74733&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=74733&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=74733&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=74733&r=needscript Try newer version: https://bugs.php.net/fix.php?id=74733&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=74733&r=support Expected behavior: https://bugs.php.net/fix.php?id=74733&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=74733&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=74733&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=74733&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=74733&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=74733&r=dst IIS Stability: https://bugs.php.net/fix.php?id=74733&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=74733&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=74733&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=74733&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=74733&r=mysqlcfg