Bug #74310 [Asn]: segfault in i_zval_ptr_dtor()
Edit report at https://bugs.php.net/bug.php?id=74310&edit=1
ID: 74310
Updated by: cmb@php.net
Reported by: brian dot carpenter at gmail dot com
Summary: segfault in i_zval_ptr_dtor()
Status: Assigned
Type: Bug
Package: Reproducible crash
Operating System: Debian 8 x64
PHP Version: 7.1Git-2017-03-24 (Git)
Assigned To: pollita
Block user comment: N
Private report: N
New Comment:
> Also, I think the CVE should be CVE-2017-9119.
*facepalm*
Previous Comments:
------------------------------------------------------------------------
[2018-03-13 17:10:00] contacto at agora-security dot com
Hello,
This bug hasn't been patch, correct?
Also, I think the CVE should be CVE-2017-9119.
Cheers!
------------------------------------------------------------------------
[2017-09-10 21:34:53] cmb@php.net
Related To: Bug #74593
------------------------------------------------------------------------
[2017-03-27 22:10:26] pollita@php.net
Sort of...
It's happening because a zval referencing a free'd string is being dtor'd (in the
middle of a bailout).
I've got a fix for the problem and will push it when I finish testing edge cases.
------------------------------------------------------------------------
[2017-03-26 17:09:20] bwoebi@php.net
This happens as the refcount is decremented, but the assignment to the new value never happening,
thus leaving us with a zend_string with two references but rc=1.
A trivial fix would be:
https://bugs.php.net/patch-display.php?bug_id=74310&patch=bug_74310_decrement_after_alloc&revision=latest
But I'm not sure whether that's the ideal fix though.
------------------------------------------------------------------------
[2017-03-26 17:08:41] bwoebi@php.net
The following patch has been added/updated:
Patch Name: bug_74310_decrement_after_alloc
Revision: 1490548119
URL: https://bugs.php.net/patch-display.php?bug=74310&patch=bug_74310_decrement_after_alloc&revision=1490548119
------------------------------------------------------------------------
The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
https://bugs.php.net/bug.php?id=74310
--
Edit this bug report at https://bugs.php.net/bug.php?id=74310&edit=1
Thread (9 messages)