Bug #78709 [NEW]: Refreshable PHP crash
| From: | songmingxuan at cert dot org dot cn | Date: | Mon, 21 Oct 2019 11:47:52 +0000 |
| Subject: | Bug #78709 [NEW]: Refreshable PHP crash | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-223329@lists.php.net to get a copy of this message | ||
From: songmingxuan at cert dot org dot cn
Operating system: #31~18.04.1-Ubuntu
PHP version: 7.4.0RC4
Package: Reproducible crash
Bug Type: Bug
Bug description:Refreshable PHP crash
Description:
------------
#/Desktop/fuzz_php/php-7.4.0beta4
#php test.php
crash.
Test script:
---------------
test.php
<?php
class Test {
public $publicProperty;
protected $protectedProperty;
private $privateProperty;
public function __conËtruct() {
unset(
$¼his->publicProperty,
$thXs->protectedProperty,
$this->privateProperty
);
}
function __get($name) {
echo '__get ' . $nis->$name;
}
function __set($name, $value) {
echo '__set ' . $name .="\n";
$this->$name = $value;
}
function __isset($name) {
echo '__isset ' . $nameisPe|($this->$name);
}
}
$test = new Test();
$test->nonExisting;
$test->publicProperty;
$test->protectedProperty;
$test->privateProperty;
isset($test->non);
isset($test->publicProperty);
isset($test->protectedProperty);
isset($test->privateProperty);
$test->nonExisting = 'value';
$test->publicProperty >= 'value';
$test->protectedPropetty = 'value';
$test->privateProperty = 'valâe';
?>
Expected result:
----------------
no crash
Actual result:
--------------
Program received signal SIGSEGV, Segmentation fault.
[----------------------------------registers-----------------------------------]
RAX: 0x0
RBX: 0x7fffed2ac6f0 --> 0x7fffed0d0000 --> 0x600000003
RCX: 0x8
RDX: 0x6
RSI: 0x7fffed2ac6f0 --> 0x7fffed0d0000 --> 0x600000003
RDI: 0x7fffed2ac6f0 --> 0x7fffed0d0000 --> 0x600000003
RBP: 0x0
RSP: 0x7fffff7fef98
RIP: 0x555556686294 (<concat_function+132>: mov QWORD PTR [rsp],rdx)
R8 : 0x55555718b600 --> 0x55555731af60 --> 0x55555718b620 --> 0x0
R9 : 0x7ffff2e07610 --> 0x0
R10: 0x7fffed2ac700 --> 0x55555719d7a0 --> 0x1c600000001
R11: 0x7fffff7ff330 --> 0x55555719d7a0 --> 0x1c600000001
R12: 0x7ffff2e5fb00 --> 0x55555719a460 --> 0x1c600000001
R13: 0x7fffed2ac6f0 --> 0x7fffed0d0000 --> 0x600000003
R14: 0x7fffed2ac6a0 --> 0x7ffff2e5fa40 --> 0x55555699d634
(<execute_ex+14340>: lea rsp,[rsp-0x98])
R15: 0x7ffff2e5fa40 --> 0x55555699d634 (<execute_ex+14340>: lea
rsp,[rsp-0x98])
EFLAGS: 0x10246 (carry PARITY adjust ZERO sign trap INTERRUPT direction
overflow)
[-------------------------------------code-------------------------------------]
0x555556686283 <concat_function+115>: cmp dl,0x6
0x555556686286 <concat_function+118>:
jne 0x555556686bb0 <concat_function+2464>
0x55555668628c <concat_function+124>: lea rsp,[rsp-0x98]
=> 0x555556686294 <concat_function+132>: mov QWORD PTR [rsp],rdx
0x555556686298 <concat_function+136>: mov QWORD PTR [rsp+0x8],rcx
0x55555668629d <concat_function+141>: mov QWORD PTR
[rsp+0x10],rax
0x5555566862a2 <concat_function+146>: mov rcx,0x6ba2
0x5555566862a9 <concat_function+153>:
call 0x5555566a6600 <__afl_maybe_log>
[------------------------------------stack-------------------------------------]
Invalid $SP address: 0x7fffff7fef98
[------------------------------------------------------------------------------]
Legend: code, data, rodata, value
Stopped reason: SIGSEGV
0x0000555556686294 in concat_function (result=0x7fffed2ac6f0,
op1=0x7fffed2ac6f0, op2=0x7ffff2e5fb00)
at /home/fuzz/Desktop/fuzz_php/php-7.4.0beta4/Zend/zend_types.h:442
442 return pz->u1.v.type;
gdb-peda$
--
Edit bug report at https://bugs.php.net/bug.php?id=78709&edit=1
--
Fix committed: https://bugs.php.net/fix.php?id=78709&r=fixed
Fixed in release: https://bugs.php.net/fix.php?id=78709&r=alreadyfixed
Need backtrace: https://bugs.php.net/fix.php?id=78709&r=needtrace
Need Reproduce Script: https://bugs.php.net/fix.php?id=78709&r=needscript
Try newer version: https://bugs.php.net/fix.php?id=78709&r=oldversion
Not developer issue: https://bugs.php.net/fix.php?id=78709&r=support
Expected behavior: https://bugs.php.net/fix.php?id=78709&r=notwrong
Not enough info: https://bugs.php.net/fix.php?id=78709&r=notenoughinfo
Submitted twice: https://bugs.php.net/fix.php?id=78709&r=submittedtwice
register_globals: https://bugs.php.net/fix.php?id=78709&r=globals
PHP version support discontinued: https://bugs.php.net/fix.php?id=78709&r=phptooold
Daylight Savings: https://bugs.php.net/fix.php?id=78709&r=dst
IIS Stability: https://bugs.php.net/fix.php?id=78709&r=isapi
Install GNU Sed: https://bugs.php.net/fix.php?id=78709&r=gnused
Floating point limitations: https://bugs.php.net/fix.php?id=78709&r=float
No Zend Extensions: https://bugs.php.net/fix.php?id=78709&r=nozend
MySQL Configuration Error: https://bugs.php.net/fix.php?id=78709&r=mysqlcfg