Assertion failure in binary operators when an error handler unsets an operand

未關閉
  • 哪裡不對？
#24,708 0 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視

維護者通常 1 天內回覆

還沒有人認領這個 Issue。

評估

難度
4/5
預估耗時
3-5 天
新手友好度
47/100
Issue 類型
缺陷
描述清晰度
基本清楚
活躍度
活躍
技術堆疊
c, php
領域
backend, testing-qa

研究方向

The assertion occurs in Zend/zend_operators.c at zendi_try_get_long during bitwise_and_function; start by reading those functions and the supplied reproducer. Check how the error handler unsets an operand before the binary operation continues. Done means the reproducer no longer triggers the assertion or AddressSanitizer abort, with regression coverage for this case.

由索引模型根據 Issue 內容生成。

描述

Bug Status: Needs Triage
Description

The following code:

<?php
set_error_handler(function () { unset($GLOBALS['x']); });
$x = 1;
$x & $y;

Resulted in this output:

php: php-src/Zend/zend_operators.c:463: zendi_try_get_long: Assertion `0' failed.
AddressSanitizer:DEADLYSIGNAL
=================================================================
==PID==ERROR: AddressSanitizer: ABRT on unknown address 0x5a2b22cb00131b90 (pc 0x7f89d54279bc bp 0x000000131b90 sp 0x7ffd2a94ea30 T0)
    #0 0x7f89d54279bc in pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x969bc)
    #1 0x7f89d53d3475 in raise (/lib/x86_64-linux-gnu/libc.so.6+0x42475)
    #2 0x7f89d53b97f2 in abort (/lib/x86_64-linux-gnu/libc.so.6+0x287f2)
    #3 0x7f89d53b971a  (/lib/x86_64-linux-gnu/libc.so.6+0x2871a)
    #4 0x7f89d53cae95 in __assert_fail (/lib/x86_64-linux-gnu/libc.so.6+0x39e95)
    #5 0x55a43aa94bbe in zendi_try_get_long php-src/Zend/zend_operators.c:463
    #6 0x55a43aaa0e5d in bitwise_and_function php-src/Zend/zend_operators.c:1894
    #7 0x55a43a7f443b in zend_bw_and_helper_SPEC php-src/Zend/zend_vm_execute.h:715
    #8 0x55a43a86489c in ZEND_BW_AND_SPEC_TMPVARCV_TMPVARCV_HANDLER php-src/Zend/zend_vm_execute.h:15243
    #9 0x55a43a96dbd7 in execute_ex php-src/Zend/zend_vm_execute.h:112535
    #10 0x55a43a97b05f in zend_execute php-src/Zend/zend_vm_execute.h:116055
    #11 0x55a43aaf429a in zend_execute_script php-src/Zend/zend.c:1986
    #12 0x55a43a4e2891 in php_execute_script_ex php-src/main/main.c:2636
    #13 0x55a43a4e2dee in php_execute_script php-src/main/main.c:2676
    #14 0x55a43aafa06c in do_cli php-src/sapi/cli/php_cli.c:941
    #15 0x55a43aafc849 in do_php_cli php-src/sapi/cli/php_cli.c:1354
    #16 0x55a43aaf5124 in main php-src/sapi/cli/php_cli_main.c:18
    #17 0x7f89d53bad8f  (/lib/x86_64-linux-gnu/libc.so.6+0x29d8f)
    #18 0x7f89d53bae3f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e3f)
    #19 0x55a439406ef4 in _start (php-src/sapi/cli/php+0x606ef4)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: ABRT (/lib/x86_64-linux-gnu/libc.so.6+0x969bc) in pthread_kill

To reproduce:

./php-src/sapi/cli/php poc.php

Commit:

49b2bc4532ec00859256707ac3771657d2889808

Configurations:

CC=gcc CFLAGS="-g -O1 -fsanitize=address -fno-omit-frame-pointer" LDFLAGS="-fsanitize=address" \
./configure --enable-debug --disable-shared --enable-pic --enable-mbstring --with-zlib --without-iconv

This bug was found by EyeQ, Following Dragons: Code Review-Guided Fuzzing (to appear at ICSE 2027).

PHP Version
PHP 8.7.0-dev (cli) (built: Oct 26 2026 10:28:24) (NTS DEBUG)
Copyright © The PHP Group and Contributors
Zend Engine v4.7.0-dev, Copyright © Zend by Perforce
Operating System

Ubuntu 22.04

主要語言
C
星號
41.8k
分支
8.5k
平均合併
2 天 13 小時
30 天內合併 PR
145

環境準備

  • 沒有 Dockerfile 或 Docker Compose 檔案
  • 沒有 Pull Request 範本
  • 閱讀貢獻指南

從這裡開始

  1. 先讀完整個 Issue，再讀專案的貢獻指南。
  2. 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
  3. Fork 儲存庫，在一個分支上完成修改。
  4. 送出 Pull Request，並在描述裡引用這個 Issue 編號。

php/php-src 的其他 Issue

查看 php/php-src 的全部 Issue

相似的 Issue

更多 C Issue

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。