Bug #74310 [Asn->Csd]: segfault in i_zval_ptr_dtor()
Edit report at https://bugs.php.net/bug.php?id=74310&edit=1
ID: 74310
Updated by: nikic@php.net
Reported by: brian dot carpenter at gmail dot com
Summary: segfault in i_zval_ptr_dtor()
-Status: Assigned
+Status: Closed
Type: Bug
Package: Reproducible crash
Operating System: Debian 8 x64
PHP Version: 7.1Git-2017-03-24 (Git)
Assigned To: pollita
Block user comment: N
Private report: N
New Comment:
It looks like I fixed this issue in https://github.com/php/php-src/commit/573ad182d21df2457a0a2f6fd3c075e1f0bfca44.
Previous Comments:
------------------------------------------------------------------------
[2021-06-09 14:57:22] cmb@php.net
> Also, I think the CVE should be CVE-2017-9119.
*facepalm*
------------------------------------------------------------------------
[2018-03-13 17:10:00] contacto at agora-security dot com
Hello,
This bug hasn't been patch, correct?
Also, I think the CVE should be CVE-2017-9119.
Cheers!
------------------------------------------------------------------------
[2017-09-10 21:34:53] cmb@php.net
Related To: Bug #74593
------------------------------------------------------------------------
[2017-03-27 22:10:26] pollita@php.net
Sort of...
It's happening because a zval referencing a free'd string is being dtor'd (in the
middle of a bailout).
I've got a fix for the problem and will push it when I finish testing edge cases.
------------------------------------------------------------------------
[2017-03-26 17:09:20] bwoebi@php.net
This happens as the refcount is decremented, but the assignment to the new value never happening,
thus leaving us with a zend_string with two references but rc=1.
A trivial fix would be:
https://bugs.php.net/patch-display.php?bug_id=74310&patch=bug_74310_decrement_after_alloc&revision=latest
But I'm not sure whether that's the ideal fix though.
------------------------------------------------------------------------
The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
https://bugs.php.net/bug.php?id=74310
--
Edit this bug report at https://bugs.php.net/bug.php?id=74310&edit=1
Thread (9 messages)