[php-src] Issue #14712: Segmentation fault (jump to 0x0) in Zend/zend_vm_execute.h
| From: | YuanchengJiang | Date: | Sat, 29 Jun 2024 07:52:36 +0000 |
| Subject: | [php-src] Issue #14712: Segmentation fault (jump to 0x0) in Zend/zend_vm_execute.h | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-247177@lists.php.net to get a copy of this message | ||
Issue: https://github.com/php/php-src/issues/14712
Author: YuanchengJiang
### Description
The following code:
```php
<?php
$db = new PDO('sqlite::memory:');
$x = $db->query('select 1 as queryStringxx');
$y = $x->fetch(PDO::FETCH_LAZY);
$script1_dataflow = $y;
$script1_dataflow->documentElement->firstChild->nextElementSibling->textContent =
"é";
```
Resulted in this output:
```
Segmentation fault (core dumped)
```
Valgrind:
```
==3394453== Jump to the invalid address stated on the next line
==3394453== at 0x0: ???
==3394453== by 0x9198EF: ZEND_FETCH_OBJ_W_SPEC_CV_CONST_HANDLER (zend_vm_execute.h:42165)
==3394453== by 0x939D9D: execute_ex (zend_vm_execute.h:61971)
==3394453== by 0x93AD56: zend_execute (zend_vm_execute.h:62962)
==3394453== by 0x9D180A: zend_execute_script (zend.c:1906)
==3394453== by 0x78AF30: php_execute_script_ex (main.c:2529)
==3394453== by 0x78B0B6: php_execute_script (main.c:2569)
==3394453== by 0x9D3C01: do_cli (php_cli.c:956)
==3394453== by 0x9D494F: main (php_cli.c:1330)
==3394453== Address 0x0 is not stack'd, malloc'd or (recently) free'd
```
ASan:
```
AddressSanitizer:DEADLYSIGNAL
=================================================================
==3387603==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x000000000000 bp
0x7ffe515cdc20 sp 0x7ffe515cd6b8 T0)
==3387603==Hint: pc points to the zero page.
==3387603==The signal is caused by a READ memory access.
==3387603==Hint: address points to the zero page.
#0 0x0 (<unknown module>)
#1 0x563474998418 in ZEND_FETCH_OBJ_W_SPEC_CV_CONST_HANDLER
/php-src/Zend/zend_vm_execute.h:42165:2
#2 0x56347464d2a7 in execute_ex /php-src/Zend/zend_vm_execute.h:57310:7
#3 0x56347464e672 in zend_execute /php-src/Zend/zend_vm_execute.h:62962:2
#4 0x5634750fe018 in zend_execute_script /php-src/Zend/zend.c:1906:3
#5 0x563473d23956 in php_execute_script_ex /php-src/main/main.c:2529:13
#6 0x563473d241f8 in php_execute_script /php-src/main/main.c:2569:9
#7 0x56347510be91 in do_cli /php-src/sapi/cli/php_cli.c:956:5
#8 0x563475107872 in main /php-src/sapi/cli/php_cli.c:1330:18
#9 0x7f233fdbed8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (<unknown module>)
==3387603==ABORTING
```
### PHP Version
PHP 8.4.0-dev
### Operating System
ubuntu 22.04