Skip to content

UBSan: member access within null pointer of type 'zend_object' in ext/standard/var.c:185 via var_dump() #21024

@YuanchengJiang

Description

@YuanchengJiang

Description

The following code:

<?php
set_error_handler(function ($errno, $errstr) {
global $b;
$b = null;
});
$b = &$a;
class Bar {
public function __debugInfo() {
}
}
$b = new Bar;
var_dump(get_defined_vars());

Resulted in this output:

/home/phpfuzz/WorkSpace/FusionFuzzLoop/projects/php/php-src/ext/standard/var.c:185:17: runtime error: member access within null pointer of type 'zend_object' (aka 'struct _zend_object')
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /home/phpfuzz/WorkSpace/FusionFuzzLoop/projects/php/php-src/ext/standard/var.c:185:17 in 

To reproduce:

./php-src/sapi/cli/php  ./test.php

Commit:

fb5d4784fe56ffd1ac11b227f7859e1f37d0207c

Configurations:

CC="clang-12" CXX="clang++-12" CFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" CXXFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" ./configure --enable-debug --enable-address-sanitizer --enable-undefined-sanitizer --enable-re2c-cgoto --enable-fpm --enable-litespeed --enable-phpdbg-debug --enable-zts --enable-bcmath --enable-calendar --enable-dba --enable-dl-test --enable-exif --enable-ftp --enable-gd --enable-gd-jis-conv --enable-mbstring --enable-pcntl --enable-shmop --enable-soap --enable-sockets --enable-sysvmsg --enable-zend-test --with-zlib --with-bz2 --with-curl --with-enchant --with-gettext --with-gmp --with-mhash --with-ldap --with-libedit --with-readline --with-snmp --with-sodium --with-xsl --with-zip --with-mysqli --with-pdo-mysql --with-pdo-pgsql --with-pgsql --with-sqlite3 --with-pdo-sqlite --with-webp --with-jpeg --with-freetype --enable-sigchild --with-readline --with-pcre-jit --with-iconv

Operating System:

Ubuntu 20.04 Host, Docker 0599jiangyc/flowfusion:latest

This report is automatically generated by FlowFusion

PHP Version

nightly

Operating System

No response

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions