Assertion failure in binary operators when an error handler unsets an operand

Abierto
  • ¿Algo no está bien?
#24,708 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
47/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
c, php
Área
backend, testing-qa

Línea de trabajo

The assertion occurs in Zend/zend_operators.c at zendi_try_get_long during bitwise_and_function; start by reading those functions and the supplied reproducer. Check how the error handler unsets an operand before the binary operation continues. Done means the reproducer no longer triggers the assertion or AddressSanitizer abort, with regression coverage for this case.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Bug Status: Needs Triage
Description

The following code:

<?php
set_error_handler(function () { unset($GLOBALS['x']); });
$x = 1;
$x & $y;

Resulted in this output:

php: php-src/Zend/zend_operators.c:463: zendi_try_get_long: Assertion `0' failed.
AddressSanitizer:DEADLYSIGNAL
=================================================================
==PID==ERROR: AddressSanitizer: ABRT on unknown address 0x5a2b22cb00131b90 (pc 0x7f89d54279bc bp 0x000000131b90 sp 0x7ffd2a94ea30 T0)
    #0 0x7f89d54279bc in pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x969bc)
    #1 0x7f89d53d3475 in raise (/lib/x86_64-linux-gnu/libc.so.6+0x42475)
    #2 0x7f89d53b97f2 in abort (/lib/x86_64-linux-gnu/libc.so.6+0x287f2)
    #3 0x7f89d53b971a  (/lib/x86_64-linux-gnu/libc.so.6+0x2871a)
    #4 0x7f89d53cae95 in __assert_fail (/lib/x86_64-linux-gnu/libc.so.6+0x39e95)
    #5 0x55a43aa94bbe in zendi_try_get_long php-src/Zend/zend_operators.c:463
    #6 0x55a43aaa0e5d in bitwise_and_function php-src/Zend/zend_operators.c:1894
    #7 0x55a43a7f443b in zend_bw_and_helper_SPEC php-src/Zend/zend_vm_execute.h:715
    #8 0x55a43a86489c in ZEND_BW_AND_SPEC_TMPVARCV_TMPVARCV_HANDLER php-src/Zend/zend_vm_execute.h:15243
    #9 0x55a43a96dbd7 in execute_ex php-src/Zend/zend_vm_execute.h:112535
    #10 0x55a43a97b05f in zend_execute php-src/Zend/zend_vm_execute.h:116055
    #11 0x55a43aaf429a in zend_execute_script php-src/Zend/zend.c:1986
    #12 0x55a43a4e2891 in php_execute_script_ex php-src/main/main.c:2636
    #13 0x55a43a4e2dee in php_execute_script php-src/main/main.c:2676
    #14 0x55a43aafa06c in do_cli php-src/sapi/cli/php_cli.c:941
    #15 0x55a43aafc849 in do_php_cli php-src/sapi/cli/php_cli.c:1354
    #16 0x55a43aaf5124 in main php-src/sapi/cli/php_cli_main.c:18
    #17 0x7f89d53bad8f  (/lib/x86_64-linux-gnu/libc.so.6+0x29d8f)
    #18 0x7f89d53bae3f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e3f)
    #19 0x55a439406ef4 in _start (php-src/sapi/cli/php+0x606ef4)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: ABRT (/lib/x86_64-linux-gnu/libc.so.6+0x969bc) in pthread_kill

To reproduce:

./php-src/sapi/cli/php poc.php

Commit:

49b2bc4532ec00859256707ac3771657d2889808

Configurations:

CC=gcc CFLAGS="-g -O1 -fsanitize=address -fno-omit-frame-pointer" LDFLAGS="-fsanitize=address" \
./configure --enable-debug --disable-shared --enable-pic --enable-mbstring --with-zlib --without-iconv

This bug was found by EyeQ, Following Dragons: Code Review-Guided Fuzzing (to appear at ICSE 2027).

PHP Version
PHP 8.7.0-dev (cli) (built: Oct 26 2026 10:28:24) (NTS DEBUG)
Copyright © The PHP Group and Contributors
Zend Engine v4.7.0-dev, Copyright © Zend by Perforce
Operating System

Ubuntu 22.04

Lenguaje dominante
C
Estrellas
41.8k
Forks
8.5k
Merge medio
2 d 13 h
PR fusionados (30 d)
145

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de php/php-src

Todos los issues de php/php-src

Issues similares

Más issues de C

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.