Bug #74950 [Opn->Csd]: null pointer deref in zim_simplexml_element_getDocNamespaces (simplexml.c:1621)

Edit report at https://bugs.php.net/bug.php?id=74950&edit=1 ID: 74950 Updated by: laruence@php.net Reported by: geeknik at protonmail dot ch Summary: null pointer deref in zim_simplexml_element_getDocNamespaces (simplexml.c:1621) -Status: Open +Status: Closed Type: Bug Package: Reproducible crash Operating System: Fedora 26 x64 PHP Version: 7.1.7 Block user comment: N Private report: N New Comment: Automatic comment on behalf of laruence@gmail.com Revision: http://git.php.net/?p=php-src.git;a=commit;h=3a7b0027f32881710ff64278a4f98b7e052578d2 Log: Fixed bug #74950 (nullpointer deref in simplexml_element_getDocNamespaces) Previous Comments: ------------------------------------------------------------------------ [2017-07-19 07:55:38] geeknik at protonmail dot ch Description: ------------ null deref and segfault found with afl. Test script: --------------- $xml=new SimpleXMLElement(0,9000000000);var_dump($xml->getDocNamespaces())?> Actual result: -------------- ext/simplexml/php_simplexml_exports.h:45:43: runtime error: member access within null pointer of type 'php_sxe_object' SUMMARY: AddressSanitizer: undefined-behavior ext/simplexml/php_simplexml_exports.h:45:43 in Warning: SimpleXMLElement::__construct(): Invalid options in Command line code on line 1 /root/php-7.1.7/ext/simplexml/simplexml.c:1621:57: runtime error: member access within null pointer of type 'php_libxml_ref_obj' (aka 'struct _php_libxml_ref_obj') SUMMARY: AddressSanitizer: undefined-behavior /root/php-7.1.7/ext/simplexml/simplexml.c:1621:57 in /root/php-7.1.7/ext/simplexml/simplexml.c:1621:57: runtime error: load of null pointer of type 'void *' SUMMARY: AddressSanitizer: undefined-behavior /root/php-7.1.7/ext/simplexml/simplexml.c:1621:57 in ASAN:DEADLYSIGNAL ================================================================= ==12757==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x000001480ae7 bp 0x7ffe22d3c690 sp 0x7ffe22d3c5a0 T0) ==12757==The signal is caused by a READ memory access. ==12757==Hint: address points to the zero page. #0 0x1480ae6 in zim_simplexml_element_getDocNamespaces /root/php-7.1.7/ext/simplexml/simplexml.c:1621:57 #1 0x237e126 in ZEND_DO_FCALL_SPEC_RETVAL_USED_HANDLER /root/php-7.1.7/Zend/zend_vm_execute.h:1097:4 #2 0x21a9e8a in execute_ex /root/php-7.1.7/Zend/zend_vm_execute.h:432:7 #3 0x21ab3f7 in zend_execute /root/php-7.1.7/Zend/zend_vm_execute.h:474:2 #4 0x1d6dc24 in zend_eval_stringl /root/php-7.1.7/Zend/zend_execute_API.c:1120:4 #5 0x1d6ea20 in zend_eval_stringl_ex /root/php-7.1.7/Zend/zend_execute_API.c:1161:11 #6 0x1d6ea20 in zend_eval_string_ex /root/php-7.1.7/Zend/zend_execute_API.c:1172 #7 0x2982f44 in do_cli /root/php-7.1.7/sapi/cli/php_cli.c:1024:8 #8 0x2980752 in main /root/php-7.1.7/sapi/cli/php_cli.c:1381:18 #9 0x7f740e05f4d9 in __libc_start_main /usr/src/debug/glibc-2.25-24-g49f97e6/csu/../csu/libc-start.c:295 #10 0x43aad9 in _start (/root/php-7.1.7/sapi/cli/php+0x43aad9) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV /root/php-7.1.7/ext/simplexml/simplexml.c:1621:57 in zim_simplexml_element_getDocNamespaces ==12757==ABORTING ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=74950&edit=1