Skip to content

Accessing a BcMath\Number property by ref crashes #18641

Closed
@YuanchengJiang

Description

@YuanchengJiang

Description

The following code:

<?php
$a = new BCMath\Number("1");
$fusion = $a;
Test::$test = &$fusion->value;

Resulted in this output:

/home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_types.h:670:13: runtime error: member access within misaligned address 0x7e5313a4b3d7 for type 'const zval' (aka 'const struct _zval_struct'), which requires 8 byte alignment
0x7e5313a4b3d7: note: pointer points here
<memory cannot be printed>
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_types.h:670:13 in 

To reproduce:

./php-src/sapi/cli/php  ./test.php

Commit:

dfff6ac852a23c6e33c06c7716d095ad4a7166d8

Configurations:

CC="clang-12" CXX="clang++-12" CFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" CXXFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" ./configure --enable-debug --enable-address-sanitizer --enable-undefined-sanitizer --enable-re2c-cgoto --enable-fpm --enable-litespeed --enable-phpdbg-debug --enable-zts --enable-bcmath --enable-calendar --enable-dba --enable-dl-test --enable-exif --enable-ftp --enable-gd --enable-gd-jis-conv --enable-mbstring --enable-pcntl --enable-shmop --enable-soap --enable-sockets --enable-sysvmsg --enable-zend-test --with-zlib --with-bz2 --with-curl --with-enchant --with-gettext --with-gmp --with-mhash --with-ldap --with-libedit --with-readline --with-snmp --with-sodium --with-xsl --with-zip --with-mysqli --with-pdo-mysql --with-pdo-pgsql --with-pgsql --with-sqlite3 --with-pdo-sqlite --with-webp --with-jpeg --with-freetype --enable-sigchild --with-readline --with-pcre-jit --with-iconv

Operating System:

Ubuntu 20.04 Host, Docker 0599jiangyc/flowfusion:latest

This report is automatically generated by FlowFusion

PHP Version

dfff6ac852a23c6e33c06c7716d095ad4a7166d8

Operating System

No response

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions