Skip to content

phpdbg_watch null pointer access #13681

@YuanchengJiang

Description

@YuanchengJiang

Description

Given the following phpt:

--TEST--
phpdbg_watch null pointer access
--SKIPIF--
<?php
if (getenv('SKIP_ASAN')) {
    die("skip intentionally causes segfaults");
}
?>
--FILE--
<?php
echo "*** Testing array_multisort() : Testing with anonymous arguments ***\n";
var_dump(array_multisort(array(1,3,2,4)));
$xconnect=$GLOBALS[array_rand($GLOBALS)];
echo "Done\n";
$a = [];
$a[0] = 1;
$a[0] = 2;
$a = [0 => 3, 1 => 4];
?>
--PHPDBG--
b 6
r
w a $a
c
q
--EXPECTF--
*** Testing array_multisort() : Testing with anonymous arguments ***
bool(true)
[Successful compilation of %s]
prompt> [Breakpoint #0 added at %s:6]
prompt> [Breakpoint #0 at %s:6, hits: 1]
>00006: $a[0] = 2;
 00007: 
 00008: $a = [0 => 3, 1 => 4];
prompt> [Added watchpoint #0 for $a[]]
prompt> [Breaking on watchpoint $a[]]
1 elements were added to the array
>00009: 
prompt> [$a[] has been removed, removing watchpoint]
[Script ended normally]
prompt> 

Resulted in this output:

[Successful compilation of /php-src/tests/test.php]
prompt> [Breakpoint #0 added at /php-src/tests/test.php:6]
prompt> *** Testing array_multisort() : Testing with anonymous arguments ***
bool(true)
Done
[Breakpoint #0 at /php-src/tests/test.php:6, hits: 1]
>00006: $a = [];
 00007: $a[0] = 1;
 00008: $a[0] = 2;
prompt> /php-src/sapi/phpdbg/phpdbg_watch.c:969:41: runtime error: member access within null pointer of type 'phpdbg_watchpoint_t' (aka 'struct _phpdbg_watchpoint_t')
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /php-src/sapi/phpdbg/phpdbg_watch.c:969:41 in
---- FAILED

PHP Version

PHP 8.4.0-dev

Operating System

ubuntu 22.04

Metadata

Metadata

Assignees

No one assigned

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions