Skip to content

phpdbg_watch null pointer access #13681

Closed

Description

@YuanchengJiang

Description

Given the following phpt:

--TEST--
phpdbg_watch null pointer access
--SKIPIF--
<?php
if (getenv('SKIP_ASAN')) {
    die("skip intentionally causes segfaults");
}
?>
--FILE--
<?php
echo "*** Testing array_multisort() : Testing with anonymous arguments ***\n";
var_dump(array_multisort(array(1,3,2,4)));
$xconnect=$GLOBALS[array_rand($GLOBALS)];
echo "Done\n";
$a = [];
$a[0] = 1;
$a[0] = 2;
$a = [0 => 3, 1 => 4];
?>
--PHPDBG--
b 6
r
w a $a
c
q
--EXPECTF--
*** Testing array_multisort() : Testing with anonymous arguments ***
bool(true)
[Successful compilation of %s]
prompt> [Breakpoint #0 added at %s:6]
prompt> [Breakpoint #0 at %s:6, hits: 1]
>00006: $a[0] = 2;
 00007: 
 00008: $a = [0 => 3, 1 => 4];
prompt> [Added watchpoint #0 for $a[]]
prompt> [Breaking on watchpoint $a[]]
1 elements were added to the array
>00009: 
prompt> [$a[] has been removed, removing watchpoint]
[Script ended normally]
prompt> 

Resulted in this output:

[Successful compilation of /php-src/tests/test.php]
prompt> [Breakpoint #0 added at /php-src/tests/test.php:6]
prompt> *** Testing array_multisort() : Testing with anonymous arguments ***
bool(true)
Done
[Breakpoint #0 at /php-src/tests/test.php:6, hits: 1]
>00006: $a = [];
 00007: $a[0] = 1;
 00008: $a[0] = 2;
prompt> /php-src/sapi/phpdbg/phpdbg_watch.c:969:41: runtime error: member access within null pointer of type 'phpdbg_watchpoint_t' (aka 'struct _phpdbg_watchpoint_t')
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /php-src/sapi/phpdbg/phpdbg_watch.c:969:41 in
---- FAILED

PHP Version

PHP 8.4.0-dev

Operating System

ubuntu 22.04

Activity

  1. iluuu1994 commented on Mar 12, 2024

    @iluuu1994
    Member

    Hi @YuanchengJiang. Same as GH-13671. ASAN/LSAN failures on tests with SKIP_ASAN in their SKIPIF section don't need to be reported.

    skip intentionally causes segfaults

  2. iluuu1994 commented on Mar 12, 2024

    @iluuu1994
    Member

    Oh wait, it seems I was misunderstanding. This is a new test. Sorry.

  3. YuanchengJiang commented on Mar 12, 2024

    @YuanchengJiang
    Author

    Thanks. I have double-checked the case is not duplicated with existing test cases. (i.e., the crash site is new: sapi/phpdbg/phpdbg_watch.c:969:41).

  4. YuanchengJiang commented on Apr 8, 2024

    @YuanchengJiang
    Author

    I continuously detect the same issue in recent commits. Wondering any plan to fix it?

  5. ndossche commented on Apr 8, 2024

    @ndossche
    Member
  6. added a commit that references this issue on Jun 17, 2024
    03f0776
  7. added a commit that references this issue on May 21, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions