Bug #61162 [Opn->Dup]: Passing and using tainted data in specific way crashes

Edit report at https://bugs.php.net/bug.php?id=61162&edit=1 ID: 61162 Updated by: laruence@php.net Reported by: mathieuk at gmail dot com Summary: Passing and using tainted data in specific way crashes -Status: Open +Status: Duplicate Type: Bug Package: taint Operating System: OS X PHP Version: 5.3.6 Block user comment: N Private report: N New Comment: dup to #61163 Previous Comments: ------------------------------------------------------------------------ [2012-02-20 16:02:24] mathieuk at gmail dot com Description: ------------ Was running into some whitescreens with the taint module on. Turns out I was appending to a variable that didn't exist yet in a function. This crashes PHP from the taint module. Reproduce code: --------------- <?php function test($test) { $data .= $test; // $data doesn't exist yet. } test($_GET['test']); ?> Expected result: ---------------- Proper execution of code, with an E_NOTICE error message reported. Actual result: -------------- crash. Program received signal EXC_BAD_ACCESS, Could not access memory. Reason: KERN_INVALID_ADDRESS at address: 0x0000000000000004 0x00000001011e5afc in zend_hash_quick_find () (gdb) bt #0 0x00000001011e5afc in zend_hash_quick_find () #1 0x0000000101e96990 in php_taint_assign_concat_handler () #2 0x00000001011fca8d in ZEND_USER_OPCODE_SPEC_HANDLER () #3 0x00000001011fdaeb in execute () #4 0x00000001011d8ffb in zend_execute_scripts () #5 0x0000000101181732 in php_execute_script () #6 0x0000000101268dbc in php_handler () #7 0x000000010000127b in ap_run_handler () #8 0x000000010000311d in ap_invoke_handler () #9 0x0000000100024c18 in ap_process_request () #10 0x00000001000217c8 in ap_process_http_connection () #11 0x000000010000e9bb in ap_run_process_connection () #12 0x00000001000294cd in child_main () #13 0x00000001000296ff in make_child () #14 0x000000010002a389 in ap_mpm_run () #15 0x0000000100007c18 in main () ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=61162&edit=1