Bug #77844 [Ver->Asn]: Crash due to null pointer in parse_ini_string with INI_SCANNER_TYPED

Edit report at https://bugs.php.net/bug.php?id=77844&edit=1 ID: 77844 Updated by: nikic@php.net Reported by: hanno at hboeck dot de Summary: Crash due to null pointer in parse_ini_string with INI_SCANNER_TYPED -Status: Verified +Status: Assigned Type: Bug Package: *General Issues Operating System: Linux PHP Version: 7.2 -Assigned To: +Assigned To: nikic Block user comment: N Private report: N Previous Comments: ------------------------------------------------------------------------ [2019-04-08 08:52:29] nikic@php.net Also segfaults on PHP 7.2. ------------------------------------------------------------------------ [2019-04-04 10:39:48] hanno at hboeck dot de Description: ------------ The example command will cause a segfault. With ASAN I get this stack trace, indicating a null pointer access: ==1102==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000018 (pc 0x7f0cdd59b756 bp 0x7ffed002f990 sp 0x7ffed002f7f0 T0) ==1102==The signal is caused by a READ memory access. ==1102==Hint: address points to the zero page. #0 0x7f0cdd59b755 (/lib64/libc.so.6+0x3e755) #1 0x4bd858 in __interceptor_strtol (/r/php/php+0x4bd858) #2 0x177eb4c in atoi /usr/include/stdlib.h:363:16 #3 0x177eb4c in zend_ini_do_op /f/php-7.3.3/Zend/zend_ini_parser.c:132 #4 0x177ae78 in ini_parse /f/php-7.3.3/Zend/zend_ini_parser.c:1859:7 #5 0x177defd in zend_parse_ini_string /f/php-7.3.3/Zend/zend_ini_parser.c:336:11 #6 0x14a8294 in zif_parse_ini_string /f/php-7.3.3/ext/standard/basic_functions.c:6129:6 #7 0x1bbc5a8 in ZEND_DO_ICALL_SPEC_RETVAL_USED_HANDLER /f/php-7.3.3/Zend/zend_vm_execute.h:690:2 #8 0x19ef40c in execute_ex /f/php-7.3.3/Zend/zend_vm_execute.h:55334:7 #9 0x19efcdf in zend_execute /f/php-7.3.3/Zend/zend_vm_execute.h:60881:2 #10 0x183f138 in zend_eval_stringl /f/php-7.3.3/Zend/zend_execute_API.c:1018:4 #11 0x183f85f in zend_eval_stringl_ex /f/php-7.3.3/Zend/zend_execute_API.c:1059:11 #12 0x183f85f in zend_eval_string_ex /f/php-7.3.3/Zend/zend_execute_API.c:1070 #13 0x1cc51c8 in do_cli /f/php-7.3.3/sapi/cli/php_cli.c:1030:8 #14 0x1cc23e2 in main /f/php-7.3.3/sapi/cli/php_cli.c:1392:18 #15 0x7f0cdd5814fa in __libc_start_main (/lib64/libc.so.6+0x244fa) #16 0x424419 in _start (/r/php/php+0x424419) Test script: --------------- php -r 'parse_ini_string("0=.0&0", TRUE, INI_SCANNER_TYPED);' ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=77844&edit=1