Bug #74593 [Opn->Dup]: crash in i_zval_ptr_dtor()

Edit report at https://bugs.php.net/bug.php?id=74593&edit=1 ID: 74593 Updated by: cmb@php.net Reported by: whitehat002 at hotmail dot com Summary: crash in i_zval_ptr_dtor() -Status: Open +Status: Duplicate Type: Bug Package: Reproducible crash PHP Version: 7.1.5 -Assigned To: +Assigned To: cmb Block user comment: N Private report: N New Comment: > The bug is related to bug#74310.But I find the bug still exists > in php7.1.5 which is the latest version. Of course, since bug #74310 has not yet been fixed. Closing as duplicate. Previous Comments: ------------------------------------------------------------------------ [2017-05-15 08:20:30] whitehat002 at hotmail dot com Description: ------------ The bug is related to bug#74310.But I find the bug still exists in php7.1.5 which is the latest version. Test script: --------------- <?php $array=array(); $$array[99999999]=$Array="AAA"; $$array[1]=$$Array="BBB"; Expected result: ---------------- no crash Actual result: -------------- root@hackyzh-virtual-machine:~# gdb -q --args ./php-7.1.5/sapi/cli/php -n poc2.php Reading symbols from /root/php-7.1.5/sapi/cli/php...done. gdb-peda$ r [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/i386-linux-gnu/libthread_db.so.1". Fatal error: Allowed memory size of 134217728 bytes exhausted (tried to allocate 100000020 bytes) in /root/poc2.php on line 4 Program received signal SIGSEGV, Segmentation fault. [----------------------------------registers-----------------------------------] EAX: 0xb7013060 --> 0xb0e00000 EBX: 0x8a8ae48 --> 0x1 ECX: 0xb0e00000 EDX: 0x0 ESI: 0xc0 EDI: 0xb70561c8 --> 0x0 EBP: 0xb70561c0 --> 0xb7013060 --> 0xb0e00000 ESP: 0xbfffe06c --> 0x83d205c (<zend_hash_graceful_reverse_destroy+300>: mov eax,DWORD PTR [esp+0x14]) EIP: 0x83b1d12 (<zend_unclean_zval_ptr_dtor+18>: mov edx,DWORD PTR [ecx]) EFLAGS: 0x210202 (carry parity adjust zero sign trap INTERRUPT direction overflow) [-------------------------------------code-------------------------------------] 0x83b1d0a <zend_unclean_zval_ptr_dtor+10>: test BYTE PTR [eax+0x9],0x4 0x83b1d0e <zend_unclean_zval_ptr_dtor+14>: je 0x83b1d32 <zend_unclean_zval_ptr_dtor+50> 0x83b1d10 <zend_unclean_zval_ptr_dtor+16>: mov ecx,DWORD PTR [eax] => 0x83b1d12 <zend_unclean_zval_ptr_dtor+18>: mov edx,DWORD PTR [ecx] 0x83b1d14 <zend_unclean_zval_ptr_dtor+20>: sub edx,0x1 0x83b1d17 <zend_unclean_zval_ptr_dtor+23>: test edx,edx 0x83b1d19 <zend_unclean_zval_ptr_dtor+25>: mov DWORD PTR [ecx],edx 0x83b1d1b <zend_unclean_zval_ptr_dtor+27>: je 0x83b1d40 <zend_unclean_zval_ptr_dtor+64> [------------------------------------stack-------------------------------------] 0000| 0xbfffe06c --> 0x83d205c (<zend_hash_graceful_reverse_destroy+300>: mov eax,DWORD PTR [esp+0x14]) 0004| 0xbfffe070 --> 0xbfffe0a0 --> 0xb7013060 --> 0xb0e00000 0008| 0xbfffe074 --> 0x0 0012| 0xbfffe078 --> 0x1 0016| 0xbfffe07c --> 0xb7fff938 --> 0x0 0020| 0xbfffe080 --> 0x1 0024| 0xbfffe084 --> 0x8 0028| 0xbfffe088 --> 0x0 [------------------------------------------------------------------------------] Legend: code, data, rodata, value Stopped reason: SIGSEGV i_zval_ptr_dtor (zval_ptr=0xb7013060) at /root/php-7.1.5/Zend/zend_variables.h:47 47 if (!Z_DELREF_P(zval_ptr)) { gdb-peda$ bt #0 i_zval_ptr_dtor (zval_ptr=0xb7013060) at /root/php-7.1.5/Zend/zend_variables.h:47 #1 zend_unclean_zval_ptr_dtor (zv=0xb7013060) at /root/php-7.1.5/Zend/zend_execute_API.c:210 #2 0x083d205c in _zend_hash_del_el_ex (prev=<optimized out>, p=<optimized out>, idx=<optimized out>, ht=<optimized out>) at /root/php-7.1.5/Zend/zend_hash.c:998 #3 _zend_hash_del_el (p=<optimized out>, idx=0xc0, ht=0x8a8ae48) at /root/php-7.1.5/Zend/zend_hash.c:1021 #4 zend_hash_graceful_reverse_destroy (ht=0x8a8ae48) at /root/php-7.1.5/Zend/zend_hash.c:1477 #5 0x083b2341 in shutdown_executor () at /root/php-7.1.5/Zend/zend_execute_API.c:279 #6 0x083c161c in zend_deactivate () at /root/php-7.1.5/Zend/zend.c:999 #7 0x08361a97 in php_request_shutdown (dummy=0x0) at /root/php-7.1.5/main/main.c:1877 #8 0x08458fc0 in do_cli (argc=0x3, argv=0x8a8e868) at /root/php-7.1.5/sapi/cli/php_cli.c:1160 #9 0x080785ad in main (argc=0x3, argv=0x8a8e868) at /root/php-7.1.5/sapi/cli/php_cli.c:1381 #10 0xb791daf3 in __libc_start_main () from /lib/i386-linux-gnu/libc.so.6 #11 0x08078641 in _start () ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=74593&edit=1