Bug #75775 [Opn->Csd]: readline_read_history segfaults with empty file

Edit report at https://bugs.php.net/bug.php?id=75775&edit=1 ID: 75775 Updated by: ab@php.net Reported by: fernando at null-life dot com Summary: readline_read_history segfaults with empty file -Status: Open +Status: Closed Type: Bug Package: Readline related Operating System: Windows PHP Version: 7.1.13 -Assigned To: +Assigned To: ab Block user comment: N Private report: N New Comment: Thanks for reporting. I've pushed a fix to our fork https://github.com/winlibs/wineditline/commit/43c25c4e3e01f06003ac6132a308b5be71fb2611 as the preparation for next RCs and also reported upstream. The patched version is available from the staging series. The issue is not the NULL, but the line containing unitialized data as nothing was read. Thanks. Previous Comments: ------------------------------------------------------------------------ [2018-01-08 02:06:45] fernando at null-life dot com Description: ------------ I believe the bug is caused by using strlen with null, fgets (probably) returns NULL on empty files. https://github.com/winlibs/wineditline/blob/master/src/history.c#L270 eof = fgets(&line[s], _EL_BUF_LEN, file); line_len = (int)strlen(line); Test script: --------------- <?php touch("empty.file"); readline_read_history("empty.file"); Expected result: ---------------- Nothing Actual result: -------------- (227c.1c20): Access violation - code c0000005 (first chance) First chance exceptions are reported before any exception handling. This exception may be expected and handled. php7!read_history+0xe3: 00007ff9d89bb8c3 40383413 cmp byte ptr [rbx+rdx],sil ds:000002230ea15000=?? 0:000> k Child-SP RetAddr Call Site 000000acd79fbc20 00007ff9d884d87a php7!read_history+0xe3 [e:\repo\winlibs_wineditline\src\history.c @ 270] 000000acd79fbc70 00007ff9d872b875 php7!zif_readline_read_history+0x5a [c:\php-snap-build\php71\vc14\x64\php-7.1.13\ext\readline\readline.c @ 420] 000000acd79fbca0 00007ff9d8708aa0 php7!ZEND_DO_ICALL_SPEC_RETVAL_UNUSED_HANDLER+0x55 [c:\php-snap-build\php71\vc14\x64\php-7.1.13\zend\zend_vm_execute.h @ 638] 000000acd79fbce0 00007ff9d8751c7d php7!execute_ex+0x80 [c:\php-snap-build\php71\vc14\x64\php-7.1.13\zend\zend_vm_execute.h @ 432] 000000acd79fbd30 00007ff9d87519d9 php7!zend_execute+0x14d [c:\php-snap-build\php71\vc14\x64\php-7.1.13\zend\zend_vm_execute.h @ 475] 000000acd79fbd60 00007ff9d87517a7 php7!zend_execute_scripts+0xa9 [c:\php-snap-build\php71\vc14\x64\php-7.1.13\zend\zend.c @ 1483] 000000acd79fbde0 00007ff6a06128e6 php7!php_execute_script+0x277 [c:\php-snap-build\php71\vc14\x64\php-7.1.13\main\main.c @ 2577] 000000acd79fe990 00007ff6a061375e php!do_cli+0x996 [c:\php-snap-build\php71\vc14\x64\php-7.1.13\sapi\cli\php_cli.c @ 994] 000000acd79ff5b0 00007ff6a061b5a9 php!main+0x67e [c:\php-snap-build\php71\vc14\x64\php-7.1.13\sapi\cli\php_cli.c @ 1381] 000000acd79ff7c0 00007ffa10431fe4 php!__scrt_common_main_seh+0x11d [f:\dd\vctools\crt\vcstartup\src\startup\exe_common.inl @ 253] 000000acd79ff800 00007ffa124cefb1 KERNEL32!BaseThreadInitThunk+0x14 000000acd79ff830 0000000000000000 ntdll!RtlUserThreadStart+0x21 ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=75775&edit=1