Bug #78703 [Dup]: Refreshable PHP crash

Edit report at https://bugs.php.net/bug.php?id=78703&edit=1 ID: 78703 Updated by: nikic@php.net Reported by: songmingxuan at cert dot org dot cn Summary: Refreshable PHP crash Status: Duplicate Type: Bug Package: Reproducible crash Operating System: #31~18.04.1-Ubuntu PHP Version: 7.3.10 Block user comment: N Private report: N New Comment: Sorry, I meant bug #78702 in the first reference. Previous Comments: ------------------------------------------------------------------------ [2019-10-21 07:58:24] nikic@php.net This is essentially the same test case as bug #78703, which has the same root cause as #64196. ------------------------------------------------------------------------ [2019-10-21 07:58:24] nikic@php.net Related To: Bug #78703 ------------------------------------------------------------------------ [2019-10-21 05:21:49] songmingxuan at cert dot org dot cn Description: ------------ #php test.php crash. Test script: --------------- test.php <?php spl_autoload_register(function ($name) { echo "IN: autoload($name)\n"; static $i = 0; if ($i++ > 10) { echo "-> Recursion detected - as expected.\n"; ; } class_exists('UndefinedClass' . $i); echo "OUT: autoload($name)\n"; }); var_dump(class_exists('UndefinedClass0')); ?> Expected result: ---------------- no crash. Actual result: -------------- Program received signal SIGSEGV, Segmentation fault. [----------------------------------registers-----------------------------------] RAX: 0x7ffff7fd4878 --> 0x555557804650 --> 0x55555799f6c0 --> 0x5555578046a0 --> 0x0 RBX: 0x0 RCX: 0x555557808600 --> 0x0 RDX: 0x55555799f6c0 --> 0x5555578046a0 --> 0x0 RSI: 0x555557804650 --> 0x55555799f6c0 --> 0x5555578046a0 --> 0x0 RDI: 0x7fffff7ff180 --> 0x38 ('8') RBP: 0x7fffff7ff180 --> 0x38 ('8') RSP: 0x7fffff7fefc8 RIP: 0x555556dc9e7c (<zend_call_function+172>: mov QWORD PTR [rsp],rdx) R8 : 0x55555785a7b0 --> 0x10000000001 R9 : 0x48 ('H') R10: 0x555557808600 --> 0x0 R11: 0x555557808600 --> 0x0 R12: 0x7fffff7ff160 --> 0x55555785a7b0 --> 0x10000000001 R13: 0x5555577f02c8 --> 0x9 ('\t') R14: 0x7fffff7ff1c0 --> 0x7ffff1d23000 --> 0x600000002 R15: 0x5555577f02c8 --> 0x9 ('\t') EFLAGS: 0x10202 (carry parity adjust zero sign trap INTERRUPT direction overflow) [-------------------------------------code-------------------------------------] 0x555556dc9e67 <zend_call_function+151>: cmp BYTE PTR [rcx+0x3e0],0x0 0x555556dc9e6e <zend_call_function+158>: je 0x555556dca92c <zend_call_function+2908> 0x555556dc9e74 <zend_call_function+164>: lea rsp,[rsp-0x98] => 0x555556dc9e7c <zend_call_function+172>: mov QWORD PTR [rsp],rdx 0x555556dc9e80 <zend_call_function+176>: mov QWORD PTR [rsp+0x8],rcx 0x555556dc9e85 <zend_call_function+181>: mov QWORD PTR [rsp+0x10],rax 0x555556dc9e8a <zend_call_function+186>: mov rcx,0xd8ba 0x555556dc9e91 <zend_call_function+193>: call 0x555556dd77b8 <__afl_maybe_log> [------------------------------------stack-------------------------------------] Invalid $SP address: 0x7fffff7fefc8 [------------------------------------------------------------------------------] Legend: code, data, rodata, value Stopped reason: SIGSEGV 0x0000555556dc9e7c in zend_call_function (fci=0x7fffff7ff180, fci_cache=0x7fffff7ff160) at /home/fuzz/Desktop/fuzz_php/php-7.3.10/Zend/zend_execute_API.c:611 611 if (!EG(active)) { gdb-peda$ ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=78703&edit=1