Assertion failure in binary operators when an error handler unsets an operand

未关闭
  • 哪里不对？
#24,708 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度
4/5
预计耗时
3-5 天
新手友好度
47/100
Issue 类型
缺陷
描述清晰度
基本清楚
活跃度
活跃
技术栈
c, php
领域
backend, testing-qa

调研方向

The assertion occurs in Zend/zend_operators.c at zendi_try_get_long during bitwise_and_function; start by reading those functions and the supplied reproducer. Check how the error handler unsets an operand before the binary operation continues. Done means the reproducer no longer triggers the assertion or AddressSanitizer abort, with regression coverage for this case.

由索引模型根据 Issue 内容生成。

描述

Bug Status: Needs Triage
Description

The following code:

<?php
set_error_handler(function () { unset($GLOBALS['x']); });
$x = 1;
$x & $y;

Resulted in this output:

php: php-src/Zend/zend_operators.c:463: zendi_try_get_long: Assertion `0' failed.
AddressSanitizer:DEADLYSIGNAL
=================================================================
==PID==ERROR: AddressSanitizer: ABRT on unknown address 0x5a2b22cb00131b90 (pc 0x7f89d54279bc bp 0x000000131b90 sp 0x7ffd2a94ea30 T0)
    #0 0x7f89d54279bc in pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x969bc)
    #1 0x7f89d53d3475 in raise (/lib/x86_64-linux-gnu/libc.so.6+0x42475)
    #2 0x7f89d53b97f2 in abort (/lib/x86_64-linux-gnu/libc.so.6+0x287f2)
    #3 0x7f89d53b971a  (/lib/x86_64-linux-gnu/libc.so.6+0x2871a)
    #4 0x7f89d53cae95 in __assert_fail (/lib/x86_64-linux-gnu/libc.so.6+0x39e95)
    #5 0x55a43aa94bbe in zendi_try_get_long php-src/Zend/zend_operators.c:463
    #6 0x55a43aaa0e5d in bitwise_and_function php-src/Zend/zend_operators.c:1894
    #7 0x55a43a7f443b in zend_bw_and_helper_SPEC php-src/Zend/zend_vm_execute.h:715
    #8 0x55a43a86489c in ZEND_BW_AND_SPEC_TMPVARCV_TMPVARCV_HANDLER php-src/Zend/zend_vm_execute.h:15243
    #9 0x55a43a96dbd7 in execute_ex php-src/Zend/zend_vm_execute.h:112535
    #10 0x55a43a97b05f in zend_execute php-src/Zend/zend_vm_execute.h:116055
    #11 0x55a43aaf429a in zend_execute_script php-src/Zend/zend.c:1986
    #12 0x55a43a4e2891 in php_execute_script_ex php-src/main/main.c:2636
    #13 0x55a43a4e2dee in php_execute_script php-src/main/main.c:2676
    #14 0x55a43aafa06c in do_cli php-src/sapi/cli/php_cli.c:941
    #15 0x55a43aafc849 in do_php_cli php-src/sapi/cli/php_cli.c:1354
    #16 0x55a43aaf5124 in main php-src/sapi/cli/php_cli_main.c:18
    #17 0x7f89d53bad8f  (/lib/x86_64-linux-gnu/libc.so.6+0x29d8f)
    #18 0x7f89d53bae3f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e3f)
    #19 0x55a439406ef4 in _start (php-src/sapi/cli/php+0x606ef4)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: ABRT (/lib/x86_64-linux-gnu/libc.so.6+0x969bc) in pthread_kill

To reproduce:

./php-src/sapi/cli/php poc.php

Commit:

49b2bc4532ec00859256707ac3771657d2889808

Configurations:

CC=gcc CFLAGS="-g -O1 -fsanitize=address -fno-omit-frame-pointer" LDFLAGS="-fsanitize=address" \
./configure --enable-debug --disable-shared --enable-pic --enable-mbstring --with-zlib --without-iconv

This bug was found by EyeQ, Following Dragons: Code Review-Guided Fuzzing (to appear at ICSE 2027).

PHP Version
PHP 8.7.0-dev (cli) (built: Oct 26 2026 10:28:24) (NTS DEBUG)
Copyright © The PHP Group and Contributors
Zend Engine v4.7.0-dev, Copyright © Zend by Perforce
Operating System

Ubuntu 22.04

主要语言
C
星标
41.8k
派生
8.5k
平均合并
2 天 13 小时
30 天内合并 PR
145

环境准备

  • 没有 Dockerfile 或 Docker Compose 文件
  • 没有 Pull Request 模板
  • 阅读贡献指南

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

php/php-src 的其他 Issue

查看 php/php-src 的全部 Issue

相似的 Issue

更多 C Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。