[php-src] Issue #15179: Segmentation fault (null pointer dereference) in ext/standard/url_scanner_ex.re
| From: | YuanchengJiang | Date: | Wed, 31 Jul 2024 04:50:25 +0000 |
| Subject: | [php-src] Issue #15179: Segmentation fault (null pointer dereference) in ext/standard/url_scanner_ex.re | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-247405@lists.php.net to get a copy of this message | ||
Issue: https://github.com/php/php-src/issues/15179
Author: YuanchengJiang
### Description
The following code:
```php
<?php
for ($i=0; $i<=$mb; $i++) {
$var.= str_repeat('a',1*1024*1024);
}
$x=$var;
output_add_rewrite_var($x,$x);
```
Resulted in this output:
```
Segmentation fault (core dumped)
```
UBSan:
```
ext/standard/url_scanner_ex.re:695:6: runtime error: member access within null pointer of type
'zend_string' (aka 'struct _zend_string')
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ext/standard/url_scanner_ex.re:695:6
```
### PHP Version
PHP 8.4.0-dev
### Operating System
ubuntu 22.04