Skip to content

Assertion Failure in zend_array_recalc_elements (zend_hash.c:464) #19839

Closed
Closed
Assertion Failure in zend_array_recalc_elements (zend_hash.c:464)#19839
Labels
BugStatus: Needs Triage

Description

@vi3tL0u1s
vi3tL0u1s
opened on Sep 15, 2025

Description

The following fuzzer-generated input:

https://github.com/vi3tL0u1s/poc/blob/master/php-src-assertion-zend_array_recalc_elements

Resulted in this output:

php: /path/to/php-src/Zend/zend_hash.c:464: uint32_t zend_array_recalc_elements(const HashTable *): Assertion `!(((__ht)->u.flags & (1<<2)) != 0)' failed.
Aborted

To reproduce:

curl -s https://raw.githubusercontent.com/vi3tL0u1s/poc/master/php-src-assertion-zend_array_recalc_elements | ./php-src/sapi/cli/php

Commit:

908a3cce92e3

Configurations:

CC="clang" CXX="clang++" CFLAGS="-fsanitize=address -g -O0" CXXFLAGS="-fsanitize=address -g -O0" ./configure --enable-debug --enable-address-sanitizer --disable-shared --with-pic

PHP Version

PHP 8.5.0-dev (cli) (built: Sep 15 2025 20:38:21) (NTS DEBUG)
Copyright (c) The PHP Group
Zend Engine v4.5.0-dev, Copyright (c) Zend Technologies
    with Zend OPcache v8.5.0-dev, Copyright (c), by Zend Technologies

Operating System

Ubuntu 22.04

Activity

  1. vi3tL0u1s
    added
    Bug
    Status: Needs Triage
    on Sep 15, 2025

  2. iluuu1994 commented on Sep 15, 2025

    @iluuu1994
    iluuu1994
    on Sep 15, 2025
    Member

    Thanks! Minimized reproducer:

    const A = 'a';

$a = [NULL];
unset(${A});

$a = $GLOBALS;
rsort($a);
serialize($a);
  3. iluuu1994
    closed this as completedin f045716on Sep 16, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    BugStatus: Needs Triage

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions