Bug #79783 [NEW]: Segfault in php_str_replace_common

From: changochen1 at gmail dot com Operating system: PHP version: 8.0Git-2020-07-04 (Git) Package: Scripting Engine problem Bug Type: Bug Bug description:Segfault in php_str_replace_common Description: ------------ In release build, it triggers an segfault: --- MemorySanitizer:DEADLYSIGNAL ==160146==ERROR: MemorySanitizer: SEGV on unknown address 0x000000000018 (pc 0x000000f8da84 bp 0x000000000000 sp 0x7ffe10b2de00 T160146) ==160146==The signal is caused by a READ memory access. ==160146==Hint: address points to the zero page. #0 0xf8da83 in php_str_replace_common /home/yongheng/php_clean/ext/standard/string.c:4379:3 #1 0x1573b32 in ZEND_DO_ICALL_SPEC_RETVAL_UNUSED_HANDLER /home/yongheng/php_clean/Zend/zend_vm_execute.h:1236:2 #2 0x13ec04f in execute_ex /home/yongheng/php_clean/Zend/zend_vm_execute.h:51852:7 #3 0x13ec844 in zend_execute /home/yongheng/php_clean/Zend/zend_vm_execute.h:56146:2 #4 0x1337c58 in zend_execute_scripts /home/yongheng/php_clean/Zend/zend.c:1667:4 #5 0x10c1cd7 in php_execute_script /home/yongheng/php_clean/main/main.c:2579:14 #6 0x171abf1 in do_cli /home/yongheng/php_clean/sapi/cli/php_cli.c:958:5 #7 0x1716fcf in main /home/yongheng/php_clean/sapi/cli/php_cli.c:1357:18 #8 0x7f78981f4b96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310 #9 0x440309 in _start (/home/yongheng/php_clean/asan/sapi/cli/php+0x440309) MemorySanitizer can not provide additional info. SUMMARY: MemorySanitizer: SEGV /home/yongheng/php_clean/ext/standard/string.c:4379:3 in php_str_replace_common ==160146==ABORTING --- In debug build, it triggers an assertion: --- /home/yongheng/php_clean/ext/standard/string.c:4379: void php_str_replace_common(zend_execute_data *, zval *, int): Assertion `(zval_get_type(&(*(zcount))) == 10)' failed. --- Test script: --------------- <? str_replace ( array () , 1.500000 , array () , DEFINED ( 678.000000 ) ) ; -- Edit bug report at https://bugs.php.net/bug.php?id=79783&edit=1 -- Fix committed: https://bugs.php.net/fix.php?id=79783&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=79783&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=79783&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=79783&r=needscript Try newer version: https://bugs.php.net/fix.php?id=79783&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=79783&r=support Expected behavior: https://bugs.php.net/fix.php?id=79783&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=79783&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=79783&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=79783&r=globals PHP version support discontinued: https://bugs.php.net/fix.php?id=79783&r=phptooold Daylight Savings: https://bugs.php.net/fix.php?id=79783&r=dst IIS Stability: https://bugs.php.net/fix.php?id=79783&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=79783&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=79783&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=79783&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=79783&r=mysqlcfg