[php-src] Issue #11016: Heap buffer overflow in ZEND_ADD_ARRAY_UNPACK_SPEC_HANDLER
| From: | Changochen | Date: | Tue, 04 Apr 2023 20:23:20 +0000 |
| Subject: | [php-src] Issue #11016: Heap buffer overflow in ZEND_ADD_ARRAY_UNPACK_SPEC_HANDLER | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-244097@lists.php.net to get a copy of this message | ||
Issue: https://github.com/php/php-src/issues/11016
Author: Changochen
### Description
The following code:
```php
<?php
ob_flush ( ) ;
echo [ 6.5 => 0.5 , ... [ [ 1 ] , [ 1 ] , 1 ]] ;
```
Using the asan build and
USE_TRACKED_ALLOC=1 USE_ZEND_ALLOC=0 php-src/asan/sapi/cli/php -f
poc1.php
Resulted in this output:
```
heap-buffer-overflow write
```
But I expected this output instead:
```
Array
```
### PHP Version
PHP 8.3.0-dev
### Operating System
_No response_