Bug #74377 [Fbk->NoF]: null pointer deref and crash in zval_addref_p()

Edit report at https://bugs.php.net/bug.php?id=74377&edit=1 ID: 74377 Updated by: php-bugs@lists.php.net Reported by: brian dot carpenter at gmail dot com Summary: null pointer deref and crash in zval_addref_p() -Status: Feedback +Status: No Feedback Type: Bug Package: Reproducible crash Operating System: Debian 8 x64 PHP Version: 5.6.30 Assigned To: cmb Private report: N New Comment: No feedback was provided. The bug is being suspended because we assume that you are no longer experiencing the problem. If this is not the case and you are able to provide the information that was requested earlier, please do so and change the status of the bug back to "Re-Opened". Thank you. Previous Comments: ------------------------------------------------------------------------ [2020-12-18 12:51:02] cmb@php.net I cannot reproduce the segfault. Instead the script outputs: Warning: Use of undefined constant d - assumed 'd' (this will throw an Error in a future version of PHP) in 74377.php on line 1 Warning: A non-numeric value encountered in 74377.php on line 1 Warning: Use of undefined constant � - assumed '�' (this will throw an Error in a future version of PHP) in 74377.php on line 1 Warning: A non-numeric value encountered in 74377.php on line 1 Fatal error: Uncaught DivisionByZeroError: Modulo by zero in 74377.php:1 Stack trace: #0 {main} thrown in 74377.php on line 1 Can you still reproduce this with any of the actively supported PHP versions[1]? [1] <https://www.php.net/supported-versions.php> ------------------------------------------------------------------------ [2017-04-05 19:24:49] brian dot carpenter at gmail dot com Description: ------------ PHP 5.6.30 on Debian 8 x64 compiled with afl-gcc and ASAN. Test script: --------------- https://drive.google.com/file/d/0B3Tl4QiWJUt8TkVpZFZaZUVHQlU/view?usp=sharing Expected result: ---------------- No crash. Actual result: -------------- ==22740==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x000001cf6a5c sp 0x7ffd0bcd1980 bp 0x7fc8ca0b49f8 T0) #0 0x1cf6a5b in zval_addref_p /root/php-5.6.30/Zend/zend.h:407 #1 0x1cf6a5b in zend_binary_assign_op_helper_SPEC_CV_CV /root/php-5.6.30/Zend/zend_vm_execute.h:40099 #2 0x1a2f7d6 in execute_ex /root/php-5.6.30/Zend/zend_vm_execute.h:363 #3 0x1898d30 in zend_execute_scripts /root/php-5.6.30/Zend/zend.c:1341 #4 0x15d377f in php_execute_script /root/php-5.6.30/main/main.c:2613 #5 0x1e5d29f in do_cli /root/php-5.6.30/sapi/cli/php_cli.c:998 #6 0x456eb8 in main /root/php-5.6.30/sapi/cli/php_cli.c:1382 #7 0x7fc8c7c0fb44 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b44) #8 0x457e3e (/root/php-5.6.30/sapi/cli/php+0x457e3e) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV /root/php-5.6.30/Zend/zend.h:407 zval_addref_p ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=74377&edit=1