[go: up one dir, main page]

Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

phpdbg_watch null pointer access #13681

Closed
YuanchengJiang opened this issue Mar 12, 2024 · 5 comments
Closed

phpdbg_watch null pointer access #13681

YuanchengJiang opened this issue Mar 12, 2024 · 5 comments

Comments

@YuanchengJiang
Copy link
YuanchengJiang commented Mar 12, 2024

Description

Given the following phpt:

--TEST--
phpdbg_watch null pointer access
--SKIPIF--
<?php
if (getenv('SKIP_ASAN')) {
    die("skip intentionally causes segfaults");
}
?>
--FILE--
<?php
echo "*** Testing array_multisort() : Testing with anonymous arguments ***\n";
var_dump(array_multisort(array(1,3,2,4)));
$xconnect=$GLOBALS[array_rand($GLOBALS)];
echo "Done\n";
$a = [];
$a[0] = 1;
$a[0] = 2;
$a = [0 => 3, 1 => 4];
?>
--PHPDBG--
b 6
r
w a $a
c
q
--EXPECTF--
*** Testing array_multisort() : Testing with anonymous arguments ***
bool(true)
[Successful compilation of %s]
prompt> [Breakpoint #0 added at %s:6]
prompt> [Breakpoint #0 at %s:6, hits: 1]
>00006: $a[0] = 2;
 00007: 
 00008: $a = [0 => 3, 1 => 4];
prompt> [Added watchpoint #0 for $a[]]
prompt> [Breaking on watchpoint $a[]]
1 elements were added to the array
>00009: 
prompt> [$a[] has been removed, removing watchpoint]
[Script ended normally]
prompt> 

Resulted in this output:

[Successful compilation of /php-src/tests/test.php]
prompt> [Breakpoint #0 added at /php-src/tests/test.php:6]
prompt> *** Testing array_multisort() : Testing with anonymous arguments ***
bool(true)
Done
[Breakpoint #0 at /php-src/tests/test.php:6, hits: 1]
>00006: $a = [];
 00007: $a[0] = 1;
 00008: $a[0] = 2;
prompt> /php-src/sapi/phpdbg/phpdbg_watch.c:969:41: runtime error: member access within null pointer of type 'phpdbg_watchpoint_t' (aka 'struct _phpdbg_watchpoint_t')
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /php-src/sapi/phpdbg/phpdbg_watch.c:969:41 in
---- FAILED

PHP Version

PHP 8.4.0-dev

Operating System

ubuntu 22.04

@iluuu1994
Copy link
Member

Hi @YuanchengJiang. Same as GH-13671. ASAN/LSAN failures on tests with SKIP_ASAN in their SKIPIF section don't need to be reported.

skip intentionally causes segfaults

@iluuu1994 iluuu1994 closed this as not planned Won't fix, can't repro, duplicate, stale Mar 12, 2024
@iluuu1994
Copy link
Member

Oh wait, it seems I was misunderstanding. This is a new test. Sorry.

@iluuu1994 iluuu1994 reopened this Mar 12, 2024
@YuanchengJiang
Copy link
Author

Thanks. I have double-checked the case is not duplicated with existing test cases. (i.e., the crash site is new: sapi/phpdbg/phpdbg_watch.c:969:41).

@YuanchengJiang
Copy link
Author

I continuously detect the same issue in recent commits. Wondering any plan to fix it?

@nielsdos
Copy link
Member
nielsdos commented Apr 8, 2024

Cc @bwoebi

devnexen added a commit to devnexen/php-src that referenced this issue Jun 8, 2024
thus when removing its entry, no watch point is set and crash on
pointer access.
devnexen added a commit to devnexen/php-src that referenced this issue Jun 9, 2024
thus when removing its entry, no watch point is set and crash on
pointer access.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants