Bug #74960 [NEW]: SIGSEV in concat_function

From: zhihua dot yao at dbappsecurity dot com dot cn Operating system: PHP version: 7.1.7 Package: Reproducible crash Bug Type: Bug Bug description:SIGSEV in concat_function Description: ------------ I have tested on Ubuntu x86. Test script: --------------- <?php ini_set("memory_limit",-1); $str=str_repeat("A",0x7fffffff); $str.=$str; ?> Expected result: ---------------- no crash Actual result: -------------- <?php ini_set("memory_limit",-1); $str=str_repeat("A",0x7fffffff); $str.=$str; ?> -- Edit bug report at https://bugs.php.net/bug.php?id=74960&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=74960&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=74960&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=74960&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=74960&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=74960&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=74960&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=74960&r=needscript Try newer version: https://bugs.php.net/fix.php?id=74960&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=74960&r=support Expected behavior: https://bugs.php.net/fix.php?id=74960&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=74960&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=74960&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=74960&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=74960&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=74960&r=dst IIS Stability: https://bugs.php.net/fix.php?id=74960&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=74960&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=74960&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=74960&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=74960&r=mysqlcfg