Bug #79922 [Ver]: Crash after multiple calls to xml_parser_free()

Edit report at https://bugs.php.net/bug.php?id=79922&edit=1 ID: 79922 Updated by: cmb@php.net Reported by: srivas41 at purdue dot edu Summary: Crash after multiple calls to xml_parser_free() Status: Verified Type: Bug Package: Reproducible crash Operating System: Ubuntu 18.04 -PHP Version: 7.4.8 +PHP Version: 7.3 Assigned To: cmb Block user comment: N Private report: N New Comment: 7.3 is affected as well, but not PHP 8.0. Previous Comments: ------------------------------------------------------------------------ [2020-08-08 14:03:50] cmb@php.net I can confirm the crash; this is not particularly related to date_parse(), but rather to multiple calls to xml_parser_free() on the same XML parsers. ------------------------------------------------------------------------ [2020-08-01 23:29:22] srivas41 at purdue dot edu The summary details (OS, version, summary) were incorrect while I was submitting the bug report. Fixed them now. ------------------------------------------------------------------------ [2020-08-01 23:26:57] srivas41 at purdue dot edu Description: ------------ It is possible to trigger a null pointer dereference in date_parse which causes the PHP interpreter to crash. # Build instructions ## Download and build PHP-7.4.8 wget https://www.php.net/distributions/php-7.4.8.tar.gz && tar -xf php.7.4.8.tar.gz && cd php-7.4.8 ## Setup PHP interpreter ./buildconf --force && CC=clang-9 CXX=clang++-9 CFLAGS="-fsanitize=address -g" ./configure && make -jnproc ## Run instructions ./sapi/cli/php -f test_script.php # Authors Prashast Srivastava, Mathias Payer Test script: --------------- <?php $c=xml_parser_create_ns(); $a=xml_parser_free($c); $a=xml_parser_free($c); $c=0; date_parse($a); ?> Expected result: ---------------- The PHP interpreter should not crash. Actual result: -------------- # ASAN-disabled interpreter result $ ./sapi/cli/php -f null-ptr-deref.php Segmentation fault (core dumped) ./sapi/cli/php -f # ASAN Backtrace from ASAN-enabled interpreter $ ./sapi/cli/php -f null-ptr-deref.php AddressSanitizer:DEADLYSIGNAL ================================================================= ==10121==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x00000141b0d0 bp 0x7ffffffeef20 sp 0x7ffffffeee00 T0) ==10121==The signal is caused by a READ memory access. ==10121==Hint: address points to the zero page. #0 0x141b0cf in zend_mm_alloc_small /root/build/php-7.4.8/Zend/zend_alloc.c:1255:33 #1 0x141b0cf in zend_mm_alloc_heap /root/build/php-7.4.8/Zend/zend_alloc.c:1326:9 #2 0x141b0cf in _emalloc /root/build/php-7.4.8/Zend/zend_alloc.c:2539:9 #3 0x1421348 in _estrdup /root/build/php-7.4.8/Zend/zend_alloc.c:2622:15 #4 0x54fdf9 in add_error /root/build/php-7.4.8/parse_date.re:350:66 #5 0x5518be in scan /root/build/php-7.4.8/parse_date.re:1814:3 #6 0x54ef13 in timelib_strtotime /root/build/php-7.4.8/parse_date.re:1878:7 #7 0x50e22a in zif_date_parse /root/build/php-7.4.8/ext/date/php_date.c:3188:16 #8 0x1b0a280 in ZEND_DO_ICALL_SPEC_RETVAL_UNUSED_HANDLER /root/build/php-7.4.8/Zend/zend_vm_execute.h:1269:2 #9 0x17bee0a in execute_ex /root/build/php-7.4.8/Zend/zend_vm_execute.h:53618:7 #10 0x17c0377 in zend_execute /root/build/php-7.4.8/Zend/zend_vm_execute.h:57920:2 #11 0x155204a in zend_execute_scripts /root/build/php-7.4.8/Zend/zend.c:1678:4 #12 0x1283457 in php_execute_script /root/build/php-7.4.8/main/main.c:2621:14 #13 0x1c3cbb8 in do_cli /root/build/php-7.4.8/sapi/cli/php_cli.c:964:5 #14 0x1c39f29 in main /root/build/php-7.4.8/sapi/cli/php_cli.c:1359:18 #15 0x7ffff6307b96 in __libc_start_main /build/glibc-2ORdQG/glibc-2.27/csu/../csu/libc-start.c:310 #16 0x440049 in _start (/root/build/php-7.4.8/sapi/cli/php+0x440049) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV /root/build/php-7.4.8/Zend/zend_alloc.c:1255:33 in zend_mm_alloc_small ==10121==ABORTING ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=79922&edit=1