Fuzzer php-fuzz-execute crashing case in _zend_is_inconsistent

Description

Hi, we found a crashing test case when testing with the fuzzing driver php-fuzz-execute.

The following code:

<?php
class li0
{
    static $f;
    private $o;
    function stream_open()
    {
        return true;
    }
    function stream_read()
    {
    }
    function stream_eof()
    {
        include "li0://";
    }
    function stream_close()
    {
        [n];
    }
    function s()
    {
    }
}
str_repeat("", 0);
$s = "";
stream_wrapper_register("li0", li0::class);
include "li0://";

Resulted in this output:

/src/php-src/Zend/zend_hash.c(2678) : ht=0x1b3fcb8 is already destroyed
php-fuzz-execute: /src/php-src/Zend/zend_hash.c:73: void _zend_is_inconsistent(const HashTable *, const char *, int): Assertion `0' failed.

PHP Version

Commid id: d6300a3

Operating System

Linux

This doesn't reproduce for me. Did you use any special compilation flags?

This is my flags based on oss-fuzz's build.sh

export CFLAGS="-fno-sanitize=object-size"
./buildconf --force
./configure disable-all \
    --enable-debug-assertions \
    --enable-option-checking=fatal \
    --enable-fuzzer \
    --enable-exif \
    --without-pcre-jit \
    --disable-phpdbg \
    --disable-cgi \
    --with-pic
make -j$(nproc)

(BTW I observed different output between the fuzzer php-fuzz-execute and the program sapi/cli/php.)

That worked, thanks! I'll check which of those flags is responsible.

This is reproducible outside of the fuzzer with this example:

class Test {
    function stream_open() {
        return true;
    }

    function stream_read() {}

    function stream_eof() {
        static $nested = false;
        if (!$nested) {
            $nested = true;
            include 'Test://';
        }
        trigger_error('Bail', E_USER_ERROR);
    }

    function stream_close() {
        trigger_error('Bail', E_USER_ERROR);
    }
}

stream_wrapper_register('Test', Test::class);
include 'Test://';

Thanks for the report.

[fuzzer][skip ci] Wrap php_request_shutdown() in zend_try (GH-19846)

Use same SKIPIF as phpGH-19844

Navigation Menu

Repository navigation

Fuzzer `php-fuzz-execute` crashing case in `_zend_is_inconsistent` #19844

Description

PHP Version

Operating System

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Fuzzer php-fuzz-execute crashing case in _zend_is_inconsistent #19844

Description

Description

PHP Version

Operating System

Activity

iluuu1994 commented on Sep 15, 2025

gal1ium commented on Sep 15, 2025

iluuu1994 commented on Sep 15, 2025

iluuu1994 commented on Sep 15, 2025

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Fuzzer `php-fuzz-execute` crashing case in `_zend_is_inconsistent` #19844