Assertion failure in binary operators when an error handler unsets an operand

Aberta
  • Algo errado?
#24,708 0 comentários 0 reações 0 responsáveis Ver no GitHub

Mantenedores costumam responder em até 1 dia

Ninguém assumiu esta issue ainda.

Avaliação

Dificuldade
4/5
Tempo estimado
3-5 dias
Facilidade para iniciantes
47/100
Tipo de issue
Bug
Clareza
Razoavelmente clara
Status de atividade
Ativa
Stack de tecnologia
c, php
Domínio
backend, testing-qa

Direção de pesquisa

The assertion occurs in Zend/zend_operators.c at zendi_try_get_long during bitwise_and_function; start by reading those functions and the supplied reproducer. Check how the error handler unsets an operand before the binary operation continues. Done means the reproducer no longer triggers the assertion or AddressSanitizer abort, with regression coverage for this case.

Escrita pelo modelo de indexação a partir do texto da issue.

Descrição

Bug Status: Needs Triage
Description

The following code:

<?php
set_error_handler(function () { unset($GLOBALS['x']); });
$x = 1;
$x & $y;

Resulted in this output:

php: php-src/Zend/zend_operators.c:463: zendi_try_get_long: Assertion `0' failed.
AddressSanitizer:DEADLYSIGNAL
=================================================================
==PID==ERROR: AddressSanitizer: ABRT on unknown address 0x5a2b22cb00131b90 (pc 0x7f89d54279bc bp 0x000000131b90 sp 0x7ffd2a94ea30 T0)
    #0 0x7f89d54279bc in pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x969bc)
    #1 0x7f89d53d3475 in raise (/lib/x86_64-linux-gnu/libc.so.6+0x42475)
    #2 0x7f89d53b97f2 in abort (/lib/x86_64-linux-gnu/libc.so.6+0x287f2)
    #3 0x7f89d53b971a  (/lib/x86_64-linux-gnu/libc.so.6+0x2871a)
    #4 0x7f89d53cae95 in __assert_fail (/lib/x86_64-linux-gnu/libc.so.6+0x39e95)
    #5 0x55a43aa94bbe in zendi_try_get_long php-src/Zend/zend_operators.c:463
    #6 0x55a43aaa0e5d in bitwise_and_function php-src/Zend/zend_operators.c:1894
    #7 0x55a43a7f443b in zend_bw_and_helper_SPEC php-src/Zend/zend_vm_execute.h:715
    #8 0x55a43a86489c in ZEND_BW_AND_SPEC_TMPVARCV_TMPVARCV_HANDLER php-src/Zend/zend_vm_execute.h:15243
    #9 0x55a43a96dbd7 in execute_ex php-src/Zend/zend_vm_execute.h:112535
    #10 0x55a43a97b05f in zend_execute php-src/Zend/zend_vm_execute.h:116055
    #11 0x55a43aaf429a in zend_execute_script php-src/Zend/zend.c:1986
    #12 0x55a43a4e2891 in php_execute_script_ex php-src/main/main.c:2636
    #13 0x55a43a4e2dee in php_execute_script php-src/main/main.c:2676
    #14 0x55a43aafa06c in do_cli php-src/sapi/cli/php_cli.c:941
    #15 0x55a43aafc849 in do_php_cli php-src/sapi/cli/php_cli.c:1354
    #16 0x55a43aaf5124 in main php-src/sapi/cli/php_cli_main.c:18
    #17 0x7f89d53bad8f  (/lib/x86_64-linux-gnu/libc.so.6+0x29d8f)
    #18 0x7f89d53bae3f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e3f)
    #19 0x55a439406ef4 in _start (php-src/sapi/cli/php+0x606ef4)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: ABRT (/lib/x86_64-linux-gnu/libc.so.6+0x969bc) in pthread_kill

To reproduce:

./php-src/sapi/cli/php poc.php

Commit:

49b2bc4532ec00859256707ac3771657d2889808

Configurations:

CC=gcc CFLAGS="-g -O1 -fsanitize=address -fno-omit-frame-pointer" LDFLAGS="-fsanitize=address" \
./configure --enable-debug --disable-shared --enable-pic --enable-mbstring --with-zlib --without-iconv

This bug was found by EyeQ, Following Dragons: Code Review-Guided Fuzzing (to appear at ICSE 2027).

PHP Version
PHP 8.7.0-dev (cli) (built: Oct 26 2026 10:28:24) (NTS DEBUG)
Copyright © The PHP Group and Contributors
Zend Engine v4.7.0-dev, Copyright © Zend by Perforce
Operating System

Ubuntu 22.04

Linguagem predominante
C
Estrelas
41.8k
Forks
8.5k
Merge médio
2d 13h
PRs com merge (30d)
145

Preparar o ambiente

Primeiros passos

  1. Leia a issue inteira e depois o guia de contribuição do projeto.
  2. Comente na issue dizendo que vai assumir — evita que duas pessoas façam o mesmo trabalho.
  3. Faça um fork do repositório e trabalhe em uma branch.
  4. Abra um pull request que referencie o número da issue.

Mais de php/php-src

Todas as issues de php/php-src

Issues semelhantes

Mais issues de C

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.