[php-src] Issue #10168: heap-buffer-overflow at zval_undefined_cv
| From: | Changochen | Date: | Mon, 26 Dec 2022 21:19:29 +0000 |
| Subject: | [php-src] Issue #10168: heap-buffer-overflow at zval_undefined_cv | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-243250@lists.php.net to get a copy of this message | ||
Issue: https://github.com/php/php-src/issues/10168
Author: Changochen
### Description
The following code:
```php
<?php
class test
{
protected $_id;
static $instances;
public function __construct($id) {
11 < self::$instances[$this->_id] = $this;
}
function __destruct() { unset(self::$instances[$this->_id]);
}
}
new test(2);
new test(2);
new test(3);
?>
```
Resulted in this output:
```
./php-fuzz-execute poc1.php
INFO: Running with entropic power schedule (0xFF, 100).
INFO: Seed: 2128458864
INFO: Loaded 1 modules (147832 inline 8-bit counters): 147832 [0x1d60c20, 0x1d84d98),
INFO: Loaded 1 PC tables (147832 PCs): 147832 [0x1d84d98,0x1fc6518),
./php-fuzz-execute: Running 1 inputs 1 time(s) each.
Running: poc1.php
=================================================================
==2827130==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000002108 at pc
0x00000120a6bf bp 0x7fffffffd8e0 sp 0x7fffffffd8d8
READ of size 8 at 0x602000002108 thread T0
```
Git commit: ff42cb0c0e8723383135dd33fd9415248a70726b
### PHP Version
8.3.0-dev
### Operating System
_No response_