[php-src] Issue #14290: Member access within null pointer in extension spl
| From: | YuanchengJiang | Date: | Tue, 21 May 2024 14:00:43 +0000 |
| Subject: | [php-src] Issue #14290: Member access within null pointer in extension spl | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-246940@lists.php.net to get a copy of this message | ||
Issue: https://github.com/php/php-src/issues/14290
Author: YuanchengJiang
### Description
The following code:
```php
<?php
class foo extends ArrayIterator {
public function __construct( ) {
parent::__construct(array(
'test'=>'test1'));
}
}
$h = new foo;
$i = new RegexIterator($h, '/^test(.*)/', RegexIterator::REPLACE);
foreach ($i as $name=>$value) {
var_dump($name, $value);
}
?>
```
Resulted in this output:
```
/php-src/ext/spl/spl_iterators.c:1904:5: runtime error: member access within null pointer of type
'zend_string' (aka 'struct _zend_string')
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /php-src/ext/spl/spl_iterators.c:1904:5
```
To reproduce:
```
/php-src/sapi/cli/php -n -c '/php-src/tmp-php.ini' -d
"opcache.cache_id=worker31" -d "output_handler=" -d "open_basedir=" -d
"disable_functions=" -d "output_buffering=Off" -d
"error_reporting=32767" -d "display_errors=1" -d
"display_startup_errors=1" -d "log_errors=0" -d "html_errors=0" -d
"track_errors=0" -d "report_memleaks=1" -d "report_zend_debug=0" -d
"docref_root=" -d "docref_ext=.html" -d "error_prepend_string=" -d
"error_append_string=" -d "auto_prepend_file=" -d "auto_append_file="
-d "ignore_repeated_errors=0" -d "precision=14" -d
"serialize_precision=-1" -d "memory_limit=128M" -d
"opcache.fast_shutdown=0" -d "opcache.file_update_protection=0" -d
"opcache.revalidate_freq=0" -d "opcache.jit_hot_loop=1" -d
"opcache.jit_hot_func=1" -d "opcache.jit_hot_return=1" -d
"opcache.jit_hot_side_exit=1" -d "opcache.jit_max_root_traces=100000" -d
"opcache.jit_max_side_traces=100000" -d "opcache.jit_max_exit_counters=100000"
-d "opcache.protect_memory=1" -d "zend.assertions=1" -d
"zend.exception_ignore_args=0" -d "zend.exception_string_param_max_len=15" -d
"short_open_tag=0" -d "extension_dir=/php-src/modules/" -d
"zend_extension=/php-src/modules/opcache.so" -d "session.auto_start=0" -d
"pcre.jit=0" -d "pcre.recursion_limit=2" -d "arg_separator.input==" -d
"internal_encoding=UTF-8" -d "ary2[1]=a" -d
"opcache.jit_buffer_size=1M" -f ./test.php
```
### PHP Version
latest commit
### Operating System
ubuntu 22.04