<?php
$v_61879 = __FILE__;
$v_61880 = dirname($v_61879,);
$v_61881 = '/';
$v_61882 = $v_61880 . $v_61881;
$v_61883 = 'bug72374';
$v_61882 = $v_61882 . $v_61883;
$v_61885 = mkdir($v_61882,);
$v_61886 = '/some-foo.txt';
$v_61887 = $v_61882 . $v_61886;
$v_61888 = touch($v_61887,);
$v_61889 = '/some-bar.txt';
$v_61890 = $v_61882 . $v_61889;
$v_61891 = touch($v_61890,);
$v_61892 = new ZipArchive();
$v_61893 = '/test.zip';
$v_61894 = $v_61882 . $v_61893;
$v_61895 = ZipArchive::CREATE;
$v_61896 = ZipArchive::OVERWRITE;
$v_61897 = $v_61895 | $v_61896;
$v_61898 = $v_61892->open($v_61894,$v_61897,);
$v_61899 = 0;
$v_61921 = 'http://www.google.com/';
$v_61903 = $v_61882 . $v_61921;
$v_61900 = array('remove_path' => $v_61903,);
$v_61904 = $v_61892->addGlob($v_61887,$v_61899,$v_61900,);
$v_61905 = 0;
$v_61910 = $v_61892->addGlob($v_61887,$v_61905,$v_61921,);
$v_61911 = 0;
$v_61912 = array('remove_path' => $v_61882,);
$v_61914 = $v_61892->addGlob($v_61890,$v_61911,$v_61912,);
$v_61922 = curl_init($v_61921,);
$v_61916 = 'foo.txt';
$v_61917 = 'some-foo.txt';
$v_61918 = 'some-bar.txt';
$v_61915 = array(0 => $v_61916,1 => $v_61917,2 => $v_61918,);
$v_61919 = verify_entries($v_61922,$v_61915,);
$v_61920 = $v_61892->close();=================================================================
==1871522==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x607000024418 at pc 0x00000061c746 bp 0x7ffcba1974e0 sp 0x7ffcba196c88
READ of size 53 at 0x607000024418 thread T0
#0 0x61c745 in MemcmpInterceptorCommon(void*, int (*)(void const*, void const*, unsigned long), void const*, void const*, unsigned long) (/home/w023dtc/nightly_php/php-src/sapi/cli/php+0x61c745)
#1 0x61cc3a in memcmp (/home/w023dtc/nightly_php/php-src/sapi/cli/php+0x61cc3a)
#2 0x490d77a in php_zip_add_from_pattern /home/w023dtc/nightly_php/php-src/ext/zip/php_zip.c:1747:37
#3 0x490bcb1 in zim_ZipArchive_addGlob /home/w023dtc/nightly_php/php-src/ext/zip/php_zip.c:1814:2
#4 0x5db44bb in ZEND_DO_FCALL_SPEC_RETVAL_USED_HANDLER /home/w023dtc/nightly_php/php-src/Zend/zend_vm_execute.h:2119:4
#5 0x5af34e3 in execute_ex /home/w023dtc/nightly_php/php-src/Zend/zend_vm_execute.h:113454:12
#6 0x5af5a6c in zend_execute /home/w023dtc/nightly_php/php-src/Zend/zend_vm_execute.h:119146:2
#7 0x6874b19 in zend_execute_script /home/w023dtc/nightly_php/php-src/Zend/zend.c:1977:3
#8 0x5059daa in php_execute_script_ex /home/w023dtc/nightly_php/php-src/main/main.c:2608:13
#9 0x505aee8 in php_execute_script /home/w023dtc/nightly_php/php-src/main/main.c:2648:9
#10 0x6889a2a in do_cli /home/w023dtc/nightly_php/php-src/sapi/cli/php_cli.c:952:5
#11 0x6883e0f in main /home/w023dtc/nightly_php/php-src/sapi/cli/php_cli.c:1363:18
#12 0x15122094ad8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#13 0x15122094ae3f in __libc_start_main csu/../csu/libc-start.c:392:3
#14 0x6061f4 in _start (/home/w023dtc/nightly_php/php-src/sapi/cli/php+0x6061f4)
0x607000024418 is located 0 bytes to the right of 72-byte region [0x6070000243d0,0x607000024418)
allocated by thread T0 here:
#0 0x6810bd in malloc (/home/w023dtc/nightly_php/php-src/sapi/cli/php+0x6810bd)
#1 0x56cdb73 in __zend_malloc /home/w023dtc/nightly_php/php-src/Zend/zend_alloc.c:3561:14
#2 0x56cc2d9 in _emalloc /home/w023dtc/nightly_php/php-src/Zend/zend_alloc.c:2798:10
#3 0x5726128 in zend_string_alloc /home/w023dtc/nightly_php/php-src/Zend/zend_string.h:167:36
#4 0x571446a in zend_string_init /home/w023dtc/nightly_php/php-src/Zend/zend_string.h:189:21
#5 0x571fb61 in add_next_index_string /home/w023dtc/nightly_php/php-src/Zend/zend_API.c:2198:2
#6 0x48f79b3 in php_zip_glob /home/w023dtc/nightly_php/php-src/ext/zip/php_zip.c:671:3
#7 0x490cda1 in php_zip_add_from_pattern /home/w023dtc/nightly_php/php-src/ext/zip/php_zip.c:1724:11
#8 0x490bcb1 in zim_ZipArchive_addGlob /home/w023dtc/nightly_php/php-src/ext/zip/php_zip.c:1814:2
#9 0x5db44bb in ZEND_DO_FCALL_SPEC_RETVAL_USED_HANDLER /home/w023dtc/nightly_php/php-src/Zend/zend_vm_execute.h:2119:4
#10 0x5af34e3 in execute_ex /home/w023dtc/nightly_php/php-src/Zend/zend_vm_execute.h:113454:12
#11 0x5af5a6c in zend_execute /home/w023dtc/nightly_php/php-src/Zend/zend_vm_execute.h:119146:2
#12 0x6874b19 in zend_execute_script /home/w023dtc/nightly_php/php-src/Zend/zend.c:1977:3
#13 0x5059daa in php_execute_script_ex /home/w023dtc/nightly_php/php-src/main/main.c:2608:13
#14 0x505aee8 in php_execute_script /home/w023dtc/nightly_php/php-src/main/main.c:2648:9
#15 0x6889a2a in do_cli /home/w023dtc/nightly_php/php-src/sapi/cli/php_cli.c:952:5
#16 0x6883e0f in main /home/w023dtc/nightly_php/php-src/sapi/cli/php_cli.c:1363:18
#17 0x15122094ad8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
SUMMARY: AddressSanitizer: heap-buffer-overflow (/home/w023dtc/nightly_php/php-src/sapi/cli/php+0x61c745) in MemcmpInterceptorCommon(void*, int (*)(void const*, void const*, unsigned long), void const*, void const*, unsigned long)
Shadow bytes around the buggy address:
0x0c0e7fffc830: fa fa fa fa 00 00 00 00 00 00 00 00 00 fa fa fa
0x0c0e7fffc840: fa fa 00 00 00 00 00 00 00 00 00 fa fa fa fa fa
0x0c0e7fffc850: 00 00 00 00 00 00 00 00 00 fa fa fa fa fa 00 00
0x0c0e7fffc860: 00 00 00 00 00 00 00 00 fa fa fa fa 00 00 00 00
0x0c0e7fffc870: 00 00 00 00 00 00 fa fa fa fa 00 00 00 00 00 00
=>0x0c0e7fffc880: 00 00 00[fa]fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0e7fffc890: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0e7fffc8a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0e7fffc8b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0e7fffc8c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0e7fffc8d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==1871522==ABORTING
Description
The following code:
Resulted in this output:
USE_ZEND_ALLOC=0 php test.php
PHP Version
Operating System
20.04