Bug #77844 [NEW]: Crass due to null pointer in parse_ini_string with INI_SCANNER_TYPED

From: hanno at hboeck dot de Operating system: Linux PHP version: 7.3.3 Package: *General Issues Bug Type: Bug Bug description:Crass due to null pointer in parse_ini_string with INI_SCANNER_TYPED Description: ------------ The example command will cause a segfault. With ASAN I get this stack trace, indicating a null pointer access: ==1102==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000018 (pc 0x7f0cdd59b756 bp 0x7ffed002f990 sp 0x7ffed002f7f0 T0) ==1102==The signal is caused by a READ memory access. ==1102==Hint: address points to the zero page. #0 0x7f0cdd59b755 (/lib64/libc.so.6+0x3e755) #1 0x4bd858 in __interceptor_strtol (/r/php/php+0x4bd858) #2 0x177eb4c in atoi /usr/include/stdlib.h:363:16 #3 0x177eb4c in zend_ini_do_op /f/php-7.3.3/Zend/zend_ini_parser.c:132 #4 0x177ae78 in ini_parse /f/php-7.3.3/Zend/zend_ini_parser.c:1859:7 #5 0x177defd in zend_parse_ini_string /f/php-7.3.3/Zend/zend_ini_parser.c:336:11 #6 0x14a8294 in zif_parse_ini_string /f/php-7.3.3/ext/standard/basic_functions.c:6129:6 #7 0x1bbc5a8 in ZEND_DO_ICALL_SPEC_RETVAL_USED_HANDLER /f/php-7.3.3/Zend/zend_vm_execute.h:690:2 #8 0x19ef40c in execute_ex /f/php-7.3.3/Zend/zend_vm_execute.h:55334:7 #9 0x19efcdf in zend_execute /f/php-7.3.3/Zend/zend_vm_execute.h:60881:2 #10 0x183f138 in zend_eval_stringl /f/php-7.3.3/Zend/zend_execute_API.c:1018:4 #11 0x183f85f in zend_eval_stringl_ex /f/php-7.3.3/Zend/zend_execute_API.c:1059:11 #12 0x183f85f in zend_eval_string_ex /f/php-7.3.3/Zend/zend_execute_API.c:1070 #13 0x1cc51c8 in do_cli /f/php-7.3.3/sapi/cli/php_cli.c:1030:8 #14 0x1cc23e2 in main /f/php-7.3.3/sapi/cli/php_cli.c:1392:18 #15 0x7f0cdd5814fa in __libc_start_main (/lib64/libc.so.6+0x244fa) #16 0x424419 in _start (/r/php/php+0x424419) Test script: --------------- php -r 'parse_ini_string("0=.0&0", TRUE, INI_SCANNER_TYPED);' -- Edit bug report at https://bugs.php.net/bug.php?id=77844&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=77844&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=77844&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=77844&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=77844&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=77844&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=77844&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=77844&r=needscript Try newer version: https://bugs.php.net/fix.php?id=77844&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=77844&r=support Expected behavior: https://bugs.php.net/fix.php?id=77844&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=77844&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=77844&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=77844&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=77844&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=77844&r=dst IIS Stability: https://bugs.php.net/fix.php?id=77844&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=77844&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=77844&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=77844&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=77844&r=mysqlcfg