Segmentation fault in mhash()

[YuanchengJiang]

Description

The following code:

<?php
mhash(133, 1086849124, 133);

Resulted in this output:

/php-src/Zend/zend_operators.c:3064:18: runtime error: member access within null pointer of type 'zend_string' (aka 'struct _zend_string')

PHP Version

nightly

Operating System

No response

[Girgias]

Found the root cause: The algorithm 133 does not exist, thus algo is a nullptr which gets passed to php_hash_do_hash_hmac() which queries the php_hash_op via php_hash_fetch_ops() which assumes the zend_string is never null.

Same issue exists with php_hash_do_hash().

This does not happen with the hash_* variant, as they take strings as algo inputs rather than an int.