Bug #74947 [NEW]: runtime error: member access within null pointer of type 'zend_string'

From: geeknik at protonmail dot ch Operating system: Fedora 26 x64 PHP version: 7.1.7 Package: Reproducible crash Bug Type: Bug Bug description:runtime error: member access within null pointer of type 'zend_string' Description: ------------ Built with afl-clang-fast and ASan/UBSan on Fedora 26 x64. While fuzzing with AFL this runtime error was triggered. Test script: --------------- <?200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000[ Expected result: ---------------- Business as usual. Actual result: -------------- Zend/zend_string.h:122:36: runtime error: member access within null pointer of type 'zend_string' (aka 'struct _zend_string') #0 0x1f0480c in zend_string_alloc /root/php-7.1.7/Zend/zend_string.h:122:36 #1 0x1f0480c in zend_string_init /root/php-7.1.7/Zend/zend_string.h:158 #2 0x1f0480c in _zend_hash_str_add /root/php-7.1.7/Zend/zend_hash.c:666 #3 0x1ae0ac5 in zend_hash_str_add_mem /root/php-7.1.7/Zend/zend_hash.h:620:12 #4 0x1ae0ac5 in sapi_register_post_entry /root/php-7.1.7/main/SAPI.c:954 #5 0x1ae07e6 in sapi_register_post_entries /root/php-7.1.7/main/SAPI.c:940:7 #6 0x1aeea3b in php_setup_sapi_content_types /root/php-7.1.7/main/php_content_types.c:64:2 #7 0x29801ee in main /root/php-7.1.7/sapi/cli/php_cli.c:1326:2 #8 0x7f08e77424d9 in __libc_start_main (/lib64/libc.so.6+0x204d9) #9 0x43aad9 in _start (/root/php-7.1.7/sapi/cli/php+0x43aad9) SUMMARY: AddressSanitizer: undefined-behavior Zend/zend_string.h:122:36 in -- Edit bug report at https://bugs.php.net/bug.php?id=74947&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=74947&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=74947&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=74947&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=74947&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=74947&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=74947&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=74947&r=needscript Try newer version: https://bugs.php.net/fix.php?id=74947&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=74947&r=support Expected behavior: https://bugs.php.net/fix.php?id=74947&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=74947&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=74947&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=74947&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=74947&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=74947&r=dst IIS Stability: https://bugs.php.net/fix.php?id=74947&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=74947&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=74947&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=74947&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=74947&r=mysqlcfg