Bug #74950 [NEW]: null pointer deref in zim_simplexml_element_getDocNamespaces (simplexml.c:1621)

From: geeknik at protonmail dot ch Operating system: Fedora 26 x64 PHP version: 7.1.7 Package: Reproducible crash Bug Type: Bug Bug description:null pointer deref in zim_simplexml_element_getDocNamespaces (simplexml.c:1621) Description: ------------ null deref and segfault found with afl. Test script: --------------- $xml=new SimpleXMLElement(0,9000000000);var_dump($xml->getDocNamespaces())?> Actual result: -------------- ext/simplexml/php_simplexml_exports.h:45:43: runtime error: member access within null pointer of type 'php_sxe_object' SUMMARY: AddressSanitizer: undefined-behavior ext/simplexml/php_simplexml_exports.h:45:43 in Warning: SimpleXMLElement::__construct(): Invalid options in Command line code on line 1 /root/php-7.1.7/ext/simplexml/simplexml.c:1621:57: runtime error: member access within null pointer of type 'php_libxml_ref_obj' (aka 'struct _php_libxml_ref_obj') SUMMARY: AddressSanitizer: undefined-behavior /root/php-7.1.7/ext/simplexml/simplexml.c:1621:57 in /root/php-7.1.7/ext/simplexml/simplexml.c:1621:57: runtime error: load of null pointer of type 'void *' SUMMARY: AddressSanitizer: undefined-behavior /root/php-7.1.7/ext/simplexml/simplexml.c:1621:57 in ASAN:DEADLYSIGNAL ================================================================= ==12757==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x000001480ae7 bp 0x7ffe22d3c690 sp 0x7ffe22d3c5a0 T0) ==12757==The signal is caused by a READ memory access. ==12757==Hint: address points to the zero page. #0 0x1480ae6 in zim_simplexml_element_getDocNamespaces /root/php-7.1.7/ext/simplexml/simplexml.c:1621:57 #1 0x237e126 in ZEND_DO_FCALL_SPEC_RETVAL_USED_HANDLER /root/php-7.1.7/Zend/zend_vm_execute.h:1097:4 #2 0x21a9e8a in execute_ex /root/php-7.1.7/Zend/zend_vm_execute.h:432:7 #3 0x21ab3f7 in zend_execute /root/php-7.1.7/Zend/zend_vm_execute.h:474:2 #4 0x1d6dc24 in zend_eval_stringl /root/php-7.1.7/Zend/zend_execute_API.c:1120:4 #5 0x1d6ea20 in zend_eval_stringl_ex /root/php-7.1.7/Zend/zend_execute_API.c:1161:11 #6 0x1d6ea20 in zend_eval_string_ex /root/php-7.1.7/Zend/zend_execute_API.c:1172 #7 0x2982f44 in do_cli /root/php-7.1.7/sapi/cli/php_cli.c:1024:8 #8 0x2980752 in main /root/php-7.1.7/sapi/cli/php_cli.c:1381:18 #9 0x7f740e05f4d9 in __libc_start_main /usr/src/debug/glibc-2.25-24-g49f97e6/csu/../csu/libc-start.c:295 #10 0x43aad9 in _start (/root/php-7.1.7/sapi/cli/php+0x43aad9) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV /root/php-7.1.7/ext/simplexml/simplexml.c:1621:57 in zim_simplexml_element_getDocNamespaces ==12757==ABORTING -- Edit bug report at https://bugs.php.net/bug.php?id=74950&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=74950&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=74950&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=74950&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=74950&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=74950&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=74950&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=74950&r=needscript Try newer version: https://bugs.php.net/fix.php?id=74950&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=74950&r=support Expected behavior: https://bugs.php.net/fix.php?id=74950&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=74950&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=74950&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=74950&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=74950&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=74950&r=dst IIS Stability: https://bugs.php.net/fix.php?id=74950&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=74950&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=74950&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=74950&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=74950&r=mysqlcfg