Bug #79244 [Opn->Ver]: php crashes during parsing INI file

Edit report at https://bugs.php.net/bug.php?id=79244&edit=1 ID: 79244 Updated by: cmb@php.net Reported by: security at saur0n dot science Summary: php crashes during parsing INI file -Status: Open +Status: Verified Type: Bug Package: Reproducible crash Operating System: Linux PHP Version: 7.4.2 Block user comment: N Private report: N Previous Comments: ------------------------------------------------------------------------ [2020-02-07 17:40:57] security at saur0n dot science Can be reproduced on 7.0.8-0ubuntu0.16.04.3 as well. ------------------------------------------------------------------------ [2020-02-07 17:29:16] security at saur0n dot science Description: ------------ php crashes during parsing INI file with function parse_ini_file() or parse_ini_string(). Both CLI and CGI versions are affected. The crash occurs only if there is a section with integer name. Test script: --------------- <?php $string=<<<__INI__ [9] __INI__; var_dump(parse_ini_string($string, TRUE, INI_SCANNER_TYPED)); Expected result: ---------------- Expected correct process termination. Actual result: -------------- PHP crashed: Stack trace of thread 3685: #0 0x0000559f487cd33f _zend_handle_numeric_str (php + 0x6e833f) #1 0x0000559f4888d841 ini_parse (php + 0x7a8841) #2 0x0000559f4888e289 zend_parse_ini_string (php + 0x7a9289) #3 0x0000559f487cbc3e zif_parse_ini_string (php + 0x6e6c3e) #4 0x0000559f489086eb ZEND_DO_ICALL_SPEC_RETVAL_USED_HANDLER (php + 0x8236eb) #5 0x0000559f48907028 execute_ex (php + 0x822028) #6 0x0000559f48954b45 zend_execute (php + 0x86fb45) #7 0x0000559f488c49e4 zend_execute_scripts (php + 0x7df9e4) #8 0x0000559f48859770 php_execute_script (php + 0x774770) #9 0x0000559f48956ff8 do_cli (php + 0x871ff8) #10 0x0000559f48715d1f main (php + 0x630d1f) #11 0x00007f38d3f54e0b __libc_start_main (libc.so.6 + 0x26e0b) #12 0x0000559f48715e1a _start (php + 0x630e1a) ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=79244&edit=1