Skip to content

Nested array_multisort invocation with error breaks #19300

@YuanchengJiang

Description

@YuanchengJiang

Description

The following code:

<?php
function error_handle($level, $message, $file = '', $line = 0){
array_multisort($a, SORT_ASC, $b);
}
set_error_handler('error_handle');
$data = [['aa'=> 'bb',], ['aa'=> 'bb',],];
$fusion = $data;
class classWithToString {
}
class classWithoutToString { }
$inputs = array(
'instance of classWithToString' => new classWithToString(),
'instance of classWithoutToString' => new classWithoutToString(),
'undefined var' => @$fusion,
);
var_dump(array_multisort($inputs, SORT_NUMERIC));

Resulted in this output:

AddressSanitizer:DEADLYSIGNAL
=================================================================
==2365786==ERROR: AddressSanitizer: SEGV on unknown address 0x7dc7b2e8cd90 (pc 0x7dc7b2e8cd90 bp 0x7ffced4086c0 sp 0x7ffced408588 T0)
==2365786==The signal is caused by a READ memory access.
==2365786==Hint: PC is at a non-executable region. Maybe a wild jump?
LLVMSymbolizer: error reading file: No such file or directory
    #0 0x7dc7b2e8cd90  ([anon:zend_alloc]+0x8cd90)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV ([anon:zend_alloc]+0x8cd90) 
==2365786==ABORTING

To reproduce:

./php-src/sapi/cli/php  ./test.php

Commit:

c1b129bd182991515c78835249c1514b480cfbea

Configurations:

CC="clang-12" CXX="clang++-12" CFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" CXXFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" ./configure --enable-debug --enable-address-sanitizer --enable-undefined-sanitizer --enable-re2c-cgoto --enable-fpm --enable-litespeed --enable-phpdbg-debug --enable-zts --enable-bcmath --enable-calendar --enable-dba --enable-dl-test --enable-exif --enable-ftp --enable-gd --enable-gd-jis-conv --enable-mbstring --enable-pcntl --enable-shmop --enable-soap --enable-sockets --enable-sysvmsg --enable-zend-test --with-zlib --with-bz2 --with-curl --with-enchant --with-gettext --with-gmp --with-mhash --with-ldap --with-libedit --with-readline --with-snmp --with-sodium --with-xsl --with-zip --with-mysqli --with-pdo-mysql --with-pdo-pgsql --with-pgsql --with-sqlite3 --with-pdo-sqlite --with-webp --with-jpeg --with-freetype --enable-sigchild --with-readline --with-pcre-jit --with-iconv

Operating System:

Ubuntu 20.04 Host, Docker 0599jiangyc/flowfusion:latest

This report is automatically generated by FlowFusion

PHP Version

c1b129bd182991515c78835249c1514b480cfbea

Operating System

No response

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions