Bug #81190 [Fbk->Opn]: 2 crashes(heap-buffer-overflow,SEGV) 5 memory leaks

Edit report at https://bugs.php.net/bug.php?id=81190&edit=1 ID: 81190 Updated by: nikic@php.net Reported by: gutaotao1995 at qq dot com Summary: 2 crashes(heap-buffer-overflow,SEGV) 5 memory leaks -Status: Feedback +Status: Open Type: Bug Package: *General Issues Operating System: linux PHP Version: 8.1.0alpha1 Block user comment: N Private report: N New Comment: leak-d8ad2e3ddc6bd2dc1b8b90d888839a14c4fc3e0d leak-9cce506f49cdcb36e163eec33660d04c4584b62c leak-6ffa0db8b44422f944c7cef615626d8700f03aba leak-54763f12cb80a6568ee17f2b20a51aa539d4081f leak-267580dd60d6d8d048a8e40eaa74d897efabd313 leak-2-php-execute leak-1-php-execute Fixed by https://github.com/php/php-src/commit/540fed1b3654339fc4683ed128f7a1c351e34c4f just before I started looking at this bug, based on the report from https://oss-fuzz.com/testcase-detail/5794742387474432. crash-15b5113dd0db60acc6b367b812c883f0e31c6258 Doesn't reproduce. leak-6b6a01c65b09e6170fa2c931a69bbd10b72dfa2d Reduction: <?php $obj = new stdClass; foreach ([0] as &$obj->prop) {} leak-570847a2eeae3e477d2ba8253adb1ca3f78feb26 Reduction: <?php null?->{[$x]}; crash-php-execute Reduction: <?php set_error_handler(function(A $r){}); strlen($undef); crash-eb98564ea8b9e5328defbc17269cfc2c6874d304 Reduction: <?php $o = new stdClass; $o->p =& $o; $o - $o->p=""; Previous Comments: ------------------------------------------------------------------------ [2021-07-01 12:01:21] gutaotao1995 at qq dot com Hello, No one has replied to me a few days ago. Since the vulnerability has not been disclosed, I set up private access permissions for safety reasons. At this time, I reset everyone to be accessible. Thanks for your reply. ------------------------------------------------------------------------ [2021-07-01 11:43:22] nikic@php.net Looks like the repo is no longer available. ------------------------------------------------------------------------ [2021-06-23 11:10:55] gutaotao1995 at qq dot com Hello, What is the result of the processing? ------------------------------------------------------------------------ [2021-06-22 15:35:58] gutaotao1995 at qq dot com Hello This is poc git repo:https://github.com/gtt1995/poc ------------------------------------------------------------------------ [2021-06-22 14:43:33] cmb@php.net > […] please tell me where to upload the POC. Anywhere on the web, where it is publicly available. Maybe gist.github.com or pastebin.com. ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=81190 -- Edit this bug report at https://bugs.php.net/bug.php?id=81190&edit=1