Bug #75033 [NEW]: memory corrupton

From: zhihua dot yao at dbappsecurity dot com dot cn Operating system: PHP version: 7.1.8 Package: Reproducible crash Bug Type: Bug Bug description:memory corrupton Description: ------------ It cause deinal of service. Test script: --------------- <?php class A { public $a; public function __destruct() { $this->a=new A ; } } $class=unserialize('O:8:"stdClass":1:{s:1:"a";O:1:"A":0:{}}'); Expected result: ---------------- NO CRASH Actual result: -------------- Program received signal SIGSEGV, Segmentation fault. [----------------------------------registers-----------------------------------] EAX: 0xbf800000 EBX: 0xbf8002d0 ECX: 0xbf800270 EDX: 0xb454db8c --> 0xb440300c --> 0x6d697402 ESI: 0xb440300c --> 0x6d697402 EDI: 0x0 EBP: 0xbf800158 ESP: 0xbf7fffb0 EIP: 0x9ba47c8 (<zend_call_function+72>: mov DWORD PTR [ebp-0x18c],eax) EFLAGS: 0x210282 (carry parity adjust zero SIGN trap INTERRUPT direction overflow) [-------------------------------------code-------------------------------------] 0x9ba47b6 <zend_call_function+54>: lea eax,[ebp-0x158] 0x9ba47bc <zend_call_function+60>: sub esp,0x19c 0x9ba47c2 <zend_call_function+66>: mov edi,DWORD PTR ds:0xac55ca0 => 0x9ba47c8 <zend_call_function+72>: mov DWORD PTR [ebp-0x18c],eax 0x9ba47ce <zend_call_function+78>: test edi,edi 0x9ba47d0 <zend_call_function+80>: jne 0x9bae338 <zend_call_function+39864> 0x9ba47d6 <zend_call_function+86>: xchg ax,ax 0x9ba47d8 <zend_call_function+88>: lea esp,[esp-0x10] [------------------------------------stack-------------------------------------] Invalid $SP address: 0xbf7fffb0 [------------------------------------------------------------------------------] Legend: code, data, rodata, value Stopped reason: SIGSEGV 0x09ba47c8 in zend_call_function (fci=0xbf800270, fci_cache=0xbf8001f0) at /home/hjy/Desktop/php-7.1.8/Zend/zend_execute_API.c:677 677 { -- Edit bug report at https://bugs.php.net/bug.php?id=75033&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=75033&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=75033&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=75033&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=75033&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=75033&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=75033&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=75033&r=needscript Try newer version: https://bugs.php.net/fix.php?id=75033&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=75033&r=support Expected behavior: https://bugs.php.net/fix.php?id=75033&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=75033&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=75033&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=75033&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=75033&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=75033&r=dst IIS Stability: https://bugs.php.net/fix.php?id=75033&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=75033&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=75033&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=75033&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=75033&r=mysqlcfg