Bug #79434 [NEW]: PHP 7.3 and PHP-7.4 crash with NULL-pointer dereference on !CS constant

From: bruno dot premont at restena dot lu Operating system: Linux PHP version: 7.3.16 Package: Variables related Bug Type: Bug Bug description:PHP 7.3 and PHP-7.4 crash with NULL-pointer dereference on !CS constant Description: ------------ Reproductible: - PHP-7.3.15-r1 - PHP-7.4.3-r1 Not affected: - PHP-7.2.28-r1 For all of them, pecl-radius 1.4.0_beta is loaded. Accessing constants defined by pecl-radius (which are defined as being case-insensitive) in namespaced manner causes PHP to crash (SEGFAULT on 0x01, 1byte within a NULL-pointer). Accessing the same constant in non-namespaced manner works as expected. Marking all pecl-radius constants case-sensistive also prevents the crash. Could not reproduce the same crash with TRUE/FALSE PHP-core constants which are case-insensitive as well. Test script: --------------- # following line works: echo RADIUS_ACCESS_REQUEST; # following alternate line crashes: echo \RADIUS_ACCESS_REQUEST); Actual result: -------------- Backtrace captured with php-cli-7.3.15-r1 (Gentoo) Code at zend_execute.c:3373 would be: is_deprecated = memcmp(ZSTR_VAL(c->name) + shortname_offset, Z_STRVAL_P(orig_key - 1) + shortname_offset, shortname_len) != 0; #0 0xf6dc4f60 in ?? () from /libx32/libc.so.6 No symbol table info available. #1 0x569b632d in _zend_quick_get_constant (check_defined_only=0, flags=<optimized out>, key=0xf4c8d0a0) at /var/tmp/portage/dev-lang/php-7.3.15-r1/work/sapis-build/cli/Zend/zend_execute.c:3373 ns_sep = <optimized out> shortname_offset = <optimized out> shortname_len = <optimized out> is_deprecated = <optimized out> zv = <optimized out> orig_key = <optimized out> c = 0x57426c90 zv = <optimized out> orig_key = <optimized out> c = <optimized out> actual = <optimized out> __z = <optimized out> __s = <optimized out> __z = <optimized out> __s = <optimized out> _z1 = <optimized out> _z2 = <optimized out> _gc = <optimized out> _t = <optimized out> _w2 = <optimized out> ns_sep = <optimized out> shortname_offset = <optimized out> shortname_len = <optimized out> is_deprecated = <optimized out> access_key = <optimized out> #2 zend_quick_get_constant (key=<optimized out>, flags=<optimized out>) at /var/tmp/portage/dev-lang/php-7.3.15-r1/work/sapis-build/cli/Zend/zend_execute.c:3394 No locals. #3 0x569f7de6 in ZEND_FETCH_CONSTANT_SPEC_UNUSED_CONST_HANDLER () at /var/tmp/portage/dev-lang/php-7.3.15-r1/work/sapis-build/cli/Zend/zend_vm_execute.h:32077 c = 0x1 c = <optimized out> _z1 = <optimized out> _z2 = <optimized out> _gc = <optimized out> _t = <optimized out> _w2 = <optimized out> -- Edit bug report at https://bugs.php.net/bug.php?id=79434&edit=1 -- Fix committed: https://bugs.php.net/fix.php?id=79434&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=79434&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=79434&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=79434&r=needscript Try newer version: https://bugs.php.net/fix.php?id=79434&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=79434&r=support Expected behavior: https://bugs.php.net/fix.php?id=79434&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=79434&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=79434&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=79434&r=globals PHP version support discontinued: https://bugs.php.net/fix.php?id=79434&r=phptooold Daylight Savings: https://bugs.php.net/fix.php?id=79434&r=dst IIS Stability: https://bugs.php.net/fix.php?id=79434&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=79434&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=79434&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=79434&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=79434&r=mysqlcfg