[php-src] Issue #13695: Segfault caused by a derefernce of a high value address

From: Date: Wed, 13 Mar 2024 12:07:46 +0000
Subject: [php-src] Issue #13695: Segfault caused by a derefernce of a high value address
Groups: php.bugs 
Request: Send a blank email to php-bugs+get-246573@lists.php.net to get a copy of this message
Issue: https://github.com/php/php-src/issues/13695 Author: YuanchengJiang ### Description The following code: ```php <?php ob_start(); echo "*** Testing session_decode() : error functionality ***\n"; $data = "foo|a:3:{i:0;i:1;i:1;i:2;i:2;i:3;}guff|R:1;blah|R:1;"; for($index = 0; $index < strlen($data); $index++) { if(session_status() != PHP_SESSION_ACTIVE) { session_start(); } echo "\n-- Iteration $index --\n"; $encoded = substr($data, 0, $index); var_dump(session_decode($encoded)); var_dump($_SESSION); }; $file_c = __DIR__ . "file_does_not_exist1"; $file_p = __DIR__ . "file_does_not_exist2"; file_put_contents($file_c, "<?php require '$file_p'; class c extends p {} ?>"); file_put_contents($file_p, '<?php class p { protected $var = ""; } ?>'); require $file_c; $a = new c(); require $file_c; ?> ``` Resulted in this output: (asan enabled) ``` Segmentation fault (core dumped) ``` or ``` ==1523719==ERROR: AddressSanitizer: SEGV on unknown address (pc 0x7f28d5b0b31e bp 0x65f9f2bee1cf8551 sp 0xece1f2bee1a4f502 T0) ==1523719==The signal is caused by a READ memory access. ==1523719==Hint: this fault was caused by a dereference of a high value address (see register values below). Disassemble the provided pc to learn which register was used. AddressSanitizer:DEADLYSIGNAL ``` ### PHP Version PHP 8.4.0-dev ### Operating System ubuntu 22.04

« previous php.bugs (#246573) next »