Bug #74951 [NEW]: Null pointer dereference in add_property_resource_ex()

From: fumfi dot 255 at gmail dot com Operating system: Linux x64 PHP version: 7.1.7 Package: *General Issues Bug Type: Bug Bug description:Null pointer dereference in add_property_resource_ex() Description: ------------ After some fuzz testing I found a crashing test case. PHP 7.1.6 compiled from source with ASAN. To reproduce: /php-7.1.6/sapi/cli/php php_null_ptr_add_property_resource_ex.php ASAN report: ==21705==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000018 (pc 0x0000017f43a9 bp 0x7ffff9782530 sp 0x7ffff9782460 T0) ==21705==The signal is caused by a READ memory access. ==21705==Hint: address points to the zero page. #0 0x17f43a8 in add_property_resource_ex XYZ/php-7.1.6/Zend/zend_API.c:1722:2 #1 0x16167d7 in user_stream_create_object XYZ/php-7.1.6/main/streams/userspace.c:290:3 #2 0x1611afd in user_wrapper_opener XYZ/php-7.1.6/main/streams/userspace.c:357:2 #3 0x15f2121 in _php_stream_open_wrapper_ex XYZ/php-7.1.6/main/streams/streams.c:2055:13 #4 0x1391f60 in php_if_fopen XYZ/php-7.1.6/ext/standard/file.c:870:11 #5 0x10db629 in phar_fopen XYZ/php-7.1.6/ext/phar/func_interceptors.c:427:2 #6 0x1b0c5e2 in ZEND_DO_ICALL_SPEC_RETVAL_USED_HANDLER XYZ/php-7.1.6/Zend/zend_vm_execute.h:675:2 #7 0x19752fd in execute_ex XYZ/php-7.1.6/Zend/zend_vm_execute.h:432:7 #8 0x19762db in zend_execute XYZ/php-7.1.6/Zend/zend_vm_execute.h:474:2 #9 0x17d7f09 in zend_execute_scripts XYZ/php-7.1.6/Zend/zend.c:1476:4 #10 0x1570102 in php_execute_script XYZ/php-7.1.6/main/main.c:2537:14 #11 0x1c4b05d in do_cli XYZ/php-7.1.6/sapi/cli/php_cli.c:993:5 #12 0x1c478d5 in main XYZ/php-7.1.6/sapi/cli/php_cli.c:1381:18 #13 0x7f85bd76c82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) #14 0x43abf8 in _start (XYZ/php-7.1.6/sapi/cli/php+0x43abf8) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV XYZ/php-7.1.6/Zend/zend_API.c:1722:2 in add_property_resource_ex ==21705==ABORTING Test script: --------------- <?php trait Stream00ploiter{public function s(){}public function n($_){}}var_dump();stream_wrapper_register('e0ploit','Stream00ploiter');$s=fopen('e0ploit://',0); -- Edit bug report at https://bugs.php.net/bug.php?id=74951&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=74951&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=74951&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=74951&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=74951&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=74951&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=74951&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=74951&r=needscript Try newer version: https://bugs.php.net/fix.php?id=74951&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=74951&r=support Expected behavior: https://bugs.php.net/fix.php?id=74951&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=74951&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=74951&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=74951&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=74951&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=74951&r=dst IIS Stability: https://bugs.php.net/fix.php?id=74951&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=74951&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=74951&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=74951&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=74951&r=mysqlcfg