Skip to content

SEGV zend_test_compile_string undefined var #17831

Closed
@YuanchengJiang

Description

@YuanchengJiang

Description

The following code:

<?php
zend_test_compile_string($fusion,$res,$x);

Resulted in this output:

/home/phpfuzz/WorkSpace/flowfusion/php-src/ext/zend_test/test.c:252:43: runtime error: member access within null pointer of type 'zend_string' (aka 'struct _zend_string')
    #0 0x344a223 in zif_zend_test_compile_string /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/zend_test/test.c:252:43
    #1 0x44add59 in ZEND_DO_ICALL_SPEC_RETVAL_UNUSED_HANDLER /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_vm_execute.h:1299:2
    #2 0x3fa31b7 in execute_ex /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_vm_execute.h:58595:7
    #3 0x3fa543c in zend_execute /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_vm_execute.h:64247:2
    #4 0x4d460b9 in zend_execute_script /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend.c:1943:3
    #5 0x353e4ca in php_execute_script_ex /home/phpfuzz/WorkSpace/flowfusion/php-src/main/main.c:2584:13
    #6 0x353f608 in php_execute_script /home/phpfuzz/WorkSpace/flowfusion/php-src/main/main.c:2624:9
    #7 0x4d5aecb in do_cli /home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php_cli.c:948:5
    #8 0x4d553af in main /home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php_cli.c:1348:18
    #9 0x7f4d44f9bd8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #10 0x7f4d44f9be3f in __libc_start_main csu/../csu/libc-start.c:392:3
    #11 0x605954 in _start (/home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php+0x605954)

SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/zend_test/test.c:252:43 in 

To reproduce:

./php-src/sapi/cli/php  ./test.php

Commit:

commit ed9c283589df568a90f2028aa085627ceeda2c6e
Author: Christoph M. Becker <[email protected]>
Date:   Sat Feb 15 18:26:11 2025 +0100

    Fail build_task.bat if main nmake failed (GH-17820)
    
    Otherwise we may not notice Windows CI build failures.
    
    Fixes GH-17818.

Configurations:

CC="clang-12" CXX="clang++-12" CFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" CXXFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" ./configure --enable-debug --enable-address-sanitizer --enable-undefined-sanitizer --enable-re2c-cgoto --enable-fpm --enable-litespeed --enable-phpdbg-debug --enable-zts --enable-bcmath --enable-calendar --enable-dba --enable-dl-test --enable-exif --enable-ftp --enable-gd --enable-gd-jis-conv --enable-mbstring --enable-pcntl --enable-shmop --enable-soap --enable-sockets --enable-sysvmsg --enable-zend-test --with-zlib --with-bz2 --with-curl --with-enchant --with-gettext --with-gmp --with-mhash --with-ldap --with-libedit --with-readline --with-snmp --with-sodium --with-xsl --with-zip

Operating System:

Ubuntu 20.04 Host, Docker 0599jiangyc/flowfusion:latest

This report is automatically generated by FlowFusion

PHP Version

ed9c283

Operating System

No response

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions