Bug #75128 [NEW]: Invalid write in zval_delref_p()

From: fumfi dot 255 at gmail dot com Operating system: Ubuntu 16.04 x64 PHP version: 7.1.8 Package: *General Issues Bug Type: Bug Bug description:Invalid write in zval_delref_p() Description: ------------ After some fuzz testing I found a crashing test case. Version: 7.18 Command: php php_iw_zval_delref_p.php Faulting PHP script: https://frankowicz.me/storage/crashes/php_iw_zval_delref_p.txt ASAN: ==32358==ERROR: AddressSanitizer: SEGV on unknown address 0x7ff1ff400000 (pc 0x0000017678cf bp 0x7ffc9544dc90 sp 0x7ffc9544daf0 T0) ==32358==The signal is caused by a WRITE memory access. #0 0x17678ce in zval_delref_p XYZ/php-7.1.8/Zend/zend_types.h:838:9 #1 0x17678ce in i_zval_ptr_dtor XYZ/php-7.1.8/Zend/zend_variables.h:47 #2 0x17678ce in zend_unclean_zval_ptr_dtor XYZ/php-7.1.8/Zend/zend_execute_API.c:210 #3 0x1851027 in _zend_hash_del_el_ex XYZ/php-7.1.8/Zend/zend_hash.c:997:3 #4 0x1851027 in _zend_hash_del_el XYZ/php-7.1.8/Zend/zend_hash.c:1020 #5 0x1851027 in zend_hash_graceful_reverse_destroy XYZ/php-7.1.8/Zend/zend_hash.c:1476 #6 0x1767f89 in shutdown_executor XYZ/php-7.1.8/Zend/zend_execute_API.c:279:3 #7 0x17ce8ca in zend_deactivate XYZ/php-7.1.8/Zend/zend.c:999:2 #8 0x1564144 in php_request_shutdown XYZ/php-7.1.8/main/main.c:1877:2 #9 0x1c4215c in do_cli XYZ/php-7.1.8/sapi/cli/php_cli.c:1160:3 #10 0x1c418e5 in main XYZ/php-7.1.8/sapi/cli/php_cli.c:1381:18 #11 0x7ff20a65982f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) #12 0x43ac28 in _start (/usr/local/bin/php+0x43ac28) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV XYZ/php-7.1.8/Zend/zend_types.h:838:9 in zval_delref_p ==32358==ABORTING -- Edit bug report at https://bugs.php.net/bug.php?id=75128&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=75128&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=75128&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=75128&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=75128&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=75128&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=75128&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=75128&r=needscript Try newer version: https://bugs.php.net/fix.php?id=75128&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=75128&r=support Expected behavior: https://bugs.php.net/fix.php?id=75128&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=75128&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=75128&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=75128&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=75128&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=75128&r=dst IIS Stability: https://bugs.php.net/fix.php?id=75128&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=75128&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=75128&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=75128&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=75128&r=mysqlcfg