[php-src] Issue #13681: phpdbg_watch null pointer access
| From: | YuanchengJiang | Date: | Tue, 12 Mar 2024 06:19:44 +0000 |
| Subject: | [php-src] Issue #13681: phpdbg_watch null pointer access | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-246565@lists.php.net to get a copy of this message | ||
Issue: https://github.com/php/php-src/issues/13681
Author: YuanchengJiang
### Description
Given the following phpt:
```
--TEST--
phpdbg_watch null pointer access
--SKIPIF--
<?php
if (getenv('SKIP_ASAN')) {
die("skip intentionally causes segfaults");
}
?>
--FILE--
<?php
$s = "123";
$s1 = "test";
$s2 = "45345some";
$s >>= 2;
var_dump($s);
try {
$s1 >>= 1;
var_dump($s1);
} catch (\TypeError $e) {
echo $e->getMessage() . \PHP_EOL;
}
$s2 >>= 3;
var_dump($s2);
echo "Done\n";
?>
<?php
$a = [];
$a[0] = 1;
$a[0] = 2;
$a = [0 => 3, 1 => 4];
--PHPDBG--
b 6
r
w a $a
c
q
--EXPECTF--
int(30)
Unsupported operand types: string >> int
Warning: A non-numeric value encountered in %s on line %d
int(5668)
Done
[Successful compilation of %s]
prompt> [Breakpoint #0 added at %s:6]
prompt> [Breakpoint #0 at %s:6, hits: 1]
>00006: $a[0] = 2;
00007:
00008: $a = [0 => 3, 1 => 4];
prompt> [Added watchpoint #0 for $a[]]
prompt> [Breaking on watchpoint $a[]]
1 elements were added to the array
>00009:
prompt> [$a[] has been removed, removing watchpoint]
[Script ended normally]
prompt>
```
Resulted in this output:
```
/WorkSpace/php-src/sapi/phpdbg/phpdbg_watch.c:969:41: runtime error: member access within null
pointer of type 'phpdbg_watchpoint_t' (aka 'struct _phpdbg_watchpoint_t')
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior
/WorkSpace/php-src/sapi/phpdbg/phpdbg_watch.c:969:41 in
```
### PHP Version
PHP 8.4.0-dev
### Operating System
ubuntu 22.04