Bug #78702 [NEW]: Refreshable PHP crash

From: songmingxuan at cert dot org dot cn Operating system: #31~18.04.1-Ubuntu PHP version: 7.3.10 Package: Reproducible crash Bug Type: Bug Bug description:Refreshable PHP crash Description: ------------ #php test.php crash. Test script: --------------- test.php <?php spl_autoload_register(function ($name) { echo "IN: autoload($name)\n"; static $i = 0; if ($i++ > 10) { echo "-> Recursion detected - as expected.\n"; retu^n; } class_exists('UndefinedClass' . $i); echo "OUT: autoload($name)\n"; }); var_dump(class_exists('UndefinedClass0')); ?> Expected result: ---------------- no crash. Actual result: -------------- Program received signal SIGSEGV, Segmentation fault. [----------------------------------registers-----------------------------------] RAX: 0x0 RBX: 0x7fffff7ff618 --> 0x13 RCX: 0x7fffff7ff620 --> 0x3000000008 RDX: 0x55555740ebe7 ("%s\n%s: %s in %s on line %u\n%s") RSI: 0x1 RDI: 0x7fffff7ff5d0 --> 0x0 RBP: 0x25 ('%') RSP: 0x7fffff7fefe8 RIP: 0x555556c3047c (<xbuf_format_converter+140>: mov QWORD PTR [rsp],rdx) R8 : 0x7ffff2a69358 ("/home/fuzz/Desktop/phpcrash/crash1.php") R9 : 0x8 R10: 0x55555740ebe7 ("%s\n%s: %s in %s on line %u\n%s") R11: 0x4 R12: 0x2 R13: 0x5555573d16c4 --> 0x676e696e726157 ('Warning') R14: 0x5555573d63da --> 0x276e646c756f6300 ('') R15: 0x7ffff2a91000 ("Use of undefined constant retu - assumed 'retu' (this will throw an Error in a future version of PHP)") EFLAGS: 0x10202 (carry parity adjust zero sign trap INTERRUPT direction overflow) [-------------------------------------code-------------------------------------] 0x555556c3046c <xbuf_format_converter+124>: je 0x555556c308f8 <xbuf_format_converter+1288> 0x555556c30472 <xbuf_format_converter+130>: xchg ax,ax 0x555556c30474 <xbuf_format_converter+132>: lea rsp,[rsp-0x98] => 0x555556c3047c <xbuf_format_converter+140>: mov QWORD PTR [rsp],rdx 0x555556c30480 <xbuf_format_converter+144>: mov QWORD PTR [rsp+0x8],rcx 0x555556c30485 <xbuf_format_converter+149>: mov QWORD PTR [rsp+0x10],rax 0x555556c3048a <xbuf_format_converter+154>: mov rcx,0x5422 0x555556c30491 <xbuf_format_converter+161>: call 0x555556c36d68 <__afl_maybe_log> [------------------------------------stack-------------------------------------] Invalid $SP address: 0x7fffff7fefe8 [------------------------------------------------------------------------------] Legend: code, data, rodata, value Stopped reason: SIGSEGV 0x0000555556c3047c in xbuf_format_converter (xbuf=0x7fffff7ff5d0, is_char=0x1, fmt=0x55555740ebe7 "%s\n%s: %s in %s on line %u\n%s", ap=0x7fffff7ff620) at /home/fuzz/Desktop/fuzz_php/php-7.3.10/main/spprintf.c:237 237 while (*fmt) { gdb-peda$ -- Edit bug report at https://bugs.php.net/bug.php?id=78702&edit=1 -- Fix committed: https://bugs.php.net/fix.php?id=78702&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=78702&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=78702&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=78702&r=needscript Try newer version: https://bugs.php.net/fix.php?id=78702&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=78702&r=support Expected behavior: https://bugs.php.net/fix.php?id=78702&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=78702&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=78702&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=78702&r=globals PHP version support discontinued: https://bugs.php.net/fix.php?id=78702&r=phptooold Daylight Savings: https://bugs.php.net/fix.php?id=78702&r=dst IIS Stability: https://bugs.php.net/fix.php?id=78702&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=78702&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=78702&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=78702&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=78702&r=mysqlcfg