Bug #79214 [NEW]: Seg fault in php_var_export_ex

From: changochen1 at gmail dot com Operating system: ALL PHP version: master-Git-2020-02-03 (Git) Package: Scripting Engine problem Bug Type: Bug Bug description:Seg fault in php_var_export_ex Description: ------------ The following poc causes a seg fault in php_var_export_ex.(run with `php -f poc.php`) Stack dump: --- ==248221==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x000000bc961e bp 0x7fffeef12990 sp 0x7fffeef11d80 T0) #0 0xbc961d in php_var_export_ex (/home/rxz226/php-src/bld_asan/sapi/cli/php+0xbc961d) #1 0xbc5658 in php_array_element_export (/home/rxz226/php-src/bld_asan/sapi/cli/php+0xbc5658) #2 0xbca1be in php_var_export_ex (/home/rxz226/php-src/bld_asan/sapi/cli/php+0xbca1be) #3 0xbc5658 in php_array_element_export (/home/rxz226/php-src/bld_asan/sapi/cli/php+0xbc5658) #4 0xbca1be in php_var_export_ex (/home/rxz226/php-src/bld_asan/sapi/cli/php+0xbca1be) #5 0xbcd1a6 in zif_var_export (/home/rxz226/php-src/bld_asan/sapi/cli/php+0xbcd1a6) #6 0x123c2d1 in execute_ex (/home/rxz226/php-src/bld_asan/sapi/cli/php+0x123c2d1) #7 0xdf5a2f in zend_call_function (/home/rxz226/php-src/bld_asan/sapi/cli/php+0xdf5a2f) #8 0xe6de12 in zend_fcall_info_call (/home/rxz226/php-src/bld_asan/sapi/cli/php+0xe6de12) #9 0xce8f9b in php_output_handler_op (/home/rxz226/php-src/bld_asan/sapi/cli/php+0xce8f9b) #10 0xcea7df in php_output_stack_pop (/home/rxz226/php-src/bld_asan/sapi/cli/php+0xcea7df) #11 0xce426e in php_output_end_all (/home/rxz226/php-src/bld_asan/sapi/cli/php+0xce426e) #12 0xca8df5 in php_request_shutdown (/home/rxz226/php-src/bld_asan/sapi/cli/php+0xca8df5) #13 0x1281d33 in do_cli (/home/rxz226/php-src/bld_asan/sapi/cli/php+0x1281d33) #14 0x1282acb in main (/home/rxz226/php-src/bld_asan/sapi/cli/php+0x1282acb) #15 0x7f9d7b3e782f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) #16 0x428a78 in _start (/home/rxz226/php-src/bld_asan/sapi/cli/php+0x428a78) --- Test script: --------------- <? for ( $GLOBALS = $a ; ; ( $b . set_error_handler ( function () { for ( $GLOBALS [] = $c ; $d < 10 ; $d ++ ) list ( $a [] , $a [ $e ] ) = array () ; } ) ) [ ob_start ( function () { $a [ $d ] < var_export ( $GLOBALS [] = & $GLOBALS , list ( var_dump ( [] ) [ var_export ( $GLOBALS [] = $GLOBALS , $f ) ] ) = array () [ $$g ] ) ; } ) ] ) ; -- Edit bug report at https://bugs.php.net/bug.php?id=79214&edit=1 -- Fix committed: https://bugs.php.net/fix.php?id=79214&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=79214&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=79214&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=79214&r=needscript Try newer version: https://bugs.php.net/fix.php?id=79214&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=79214&r=support Expected behavior: https://bugs.php.net/fix.php?id=79214&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=79214&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=79214&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=79214&r=globals PHP version support discontinued: https://bugs.php.net/fix.php?id=79214&r=phptooold Daylight Savings: https://bugs.php.net/fix.php?id=79214&r=dst IIS Stability: https://bugs.php.net/fix.php?id=79214&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=79214&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=79214&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=79214&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=79214&r=mysqlcfg