[php-src] Issue #18844: Fuzzer `php-fuzz-execute` crashes at `zend_gc_delref`
| From: | gal1ium | Date: | Fri, 13 Jun 2025 05:22:04 +0000 |
| Subject: | [php-src] Issue #18844: Fuzzer `php-fuzz-execute` crashes at `zend_gc_delref` | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-250255@lists.php.net to get a copy of this message | ||
Issue: https://github.com/php/php-src/issues/18844
Author: gal1ium
### Description
The following code:
```php
<?php
$var1[][]=$l;
set_error_handler(
function()use(&$var1){
$var1=0;
}
);
$var1[0].=0;
```
Resulted in this crashing status by the fuzzing driver
php-fuzz-execute:
```
==961978== ERROR: libFuzzer: deadly signal
#0 zend_gc_delref () at Zend/zend_types.h:1371
#1 i_zval_ptr_dtor () at Zend/zend_variables.h:44
#2 concat_function () at Zend/zend_operators.c:2085
#3 zend_binary_op () at Zend/zend_execute.c:1635
#4 ZEND_ASSIGN_DIM_OP_SPEC_CV_CONST_HANDLER () at Zend/zend_vm_execute.h:42722
#5 fuzzer_execute_ex () at sapi/fuzzer/fuzzer-execute-common.h:59
#6 zend_execute () at Zend/zend_vm_execute.h:64385
#7 fuzzer_do_request_from_buffer () at sapi/fuzzer/fuzzer-sapi.c:274
#8 LLVMFuzzerTestOneInput () at sapi/fuzzer/fuzzer-execute.c:27
```
### PHP Version
```plain
dbabbe180b157eeaac5002276667f1f56f0b4def 2025-06-10 22:35:56+0200
```
### Operating System
Linux