[php-src] Issue #8889: Found some crashes of cli
| From: | mimicria | Date: | Wed, 29 Jun 2022 05:10:00 +0000 |
| Subject: | [php-src] Issue #8889: Found some crashes of cli | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-241830@lists.php.net to get a copy of this message | ||
Issue: https://github.com/php/php-src/issues/8889
Author: mimicria
### Description
Hi!
As a result of fuzz testing using AFL, several crashes were found for latest version of PHP cli.
These crashes probably can be exploited.
So input files causing crashes attached with commands for GDB in gdb_script:
[php-checked-crashes.tar.gz](https://github.com/php/php-src/files/9007340/php-checked-crashes.tar.gz)
For example:
```
~/php-src/sapi/cli/php
~/fuzz/php/out/checked_crashes/m1:id:000002,sig:11,src:000316,time:22664756,execs:4824122,op:havoc,rep:4
Warning: Undefined variable $▒ndex in
/home/user/fuzz/php/out/checked_crashes/m1:id:000002,sig:11,src:000316,time:22664756,execs:4824122,op:havoc,rep:4
on line 15
Warning: Undefined array key "" in
/home/user/fuzz/php/out/checked_crashes/m1:id:000002,sig:11,src:000316,time:22664756,execs:4824122,op:havoc,rep:4
on line 15
Ошибка сегментирования
```
Sample GDB output:
```
Program received signal SIGSEGV, Segmentation fault.
0x00005555559a736b in sapi_cli_single_write (str=str@entry=0x7ffff5657328
"Iauto(UndefinedClass10898)\n", str_length=str_length@entry=27) at
/home/user/php-src/sapi/cli/php_cli.c:265
265 ret = write(STDOUT_FILENO, str, str_length);
```
### PHP Version
PHP 8.2.0-dev
### Operating System
Ubuntu 22.04