Bug #75241 [NEW]: Null pointer dereference in zend_mm_alloc_small()

From: fumfi dot 255 at gmail dot com Operating system: Ubuntu 16.04 x64 PHP version: 7.1.9 Package: *General Issues Bug Type: Bug Bug description:Null pointer dereference in zend_mm_alloc_small() Description: ------------ After some fuzz testing I found a crashing test case. Version: 7.18 Command: php php_nullptr_zend_mm_alloc_small.php ASAN: ==22121==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x0000016aab11 bp 0x0fe6bf7c0010 sp 0x7fff4f0ba340 T0) ==22121==The signal is caused by a READ memory access. ==22121==Hint: address points to the zero page. #0 0x16aab10 in zend_mm_alloc_small XYZ/php-7.1.8/Zend/zend_alloc.c:1261:33 #1 0x16aab10 in zend_mm_alloc_heap XYZ/php-7.1.8/Zend/zend_alloc.c:1332 #2 0x16aab10 in _emalloc XYZ/php-7.1.8/Zend/zend_alloc.c:2417 #3 0x198bde8 in zend_string_alloc XYZ/php-7.1.8/Zend/zend_string.h:122:36 #4 0x198bde8 in ZEND_CONCAT_SPEC_TMPVAR_CONST_HANDLER XYZ/php-7.1.8/Zend/zend_vm_execute.h:52084 #5 0x196fb4d in execute_ex XYZ/php-7.1.8/Zend/zend_vm_execute.h:432:7 #6 0x176fb4c in zend_call_function XYZ/php-7.1.8/Zend/zend_execute_API.c:855:3 #7 0x176d73d in _call_user_function_ex XYZ/php-7.1.8/Zend/zend_execute_API.c:672:9 #8 0x17d018f in zend_error_noreturn XYZ/php-7.1.8/Zend/zend.c:1254:8 #9 0x1b111c5 in ZEND_ASSIGN_OBJ_SPEC_VAR_CONST_OP_DATA_CONST_HANDLER XYZ/php-7.1.8/Zend/zend_vm_execute.h:18801:5 #10 0x196fb4d in execute_ex XYZ/php-7.1.8/Zend/zend_vm_execute.h:432:7 #11 0x1970b2b in zend_execute XYZ/php-7.1.8/Zend/zend_vm_execute.h:474:2 #12 0x17d2629 in zend_execute_scripts XYZ/php-7.1.8/Zend/zend.c:1476:4 #13 0x156a812 in php_execute_script XYZ/php-7.1.8/main/main.c:2537:14 #14 0x1c4506d in do_cli XYZ/php-7.1.8/sapi/cli/php_cli.c:993:5 #15 0x1c418e5 in main XYZ/php-7.1.8/sapi/cli/php_cli.c:1381:18 #16 0x7f360124682f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) #17 0x43ac28 in _start (/usr/local/bin/php+0x43ac28) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV XYZ/php-7.1.8/Zend/zend_alloc.c:1261:33 in zend_mm_alloc_small ==22121==ABORTING Test script: --------------- <?php function eh(){e."0000000";}set_error_handler('eh');$d->d=&$d+$d->d/=0?><?$$d->b=0; -- Edit bug report at https://bugs.php.net/bug.php?id=75241&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=75241&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=75241&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=75241&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=75241&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=75241&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=75241&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=75241&r=needscript Try newer version: https://bugs.php.net/fix.php?id=75241&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=75241&r=support Expected behavior: https://bugs.php.net/fix.php?id=75241&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=75241&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=75241&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=75241&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=75241&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=75241&r=dst IIS Stability: https://bugs.php.net/fix.php?id=75241&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=75241&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=75241&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=75241&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=75241&r=mysqlcfg