[php-src] Issue #21664: `iconv_mime_decode()` with malformed UTF-8 encoded-word corrupts stack, causing unrecoverable SIGSEGV (ASan: nested bug in same thread)`

[email protected] (YuanchengJiang)
Newsgroups php.bugs
Message-ID <[email protected]>
Issue: https://github.com/php/php-src/issues/21664
Author: YuanchengJiang

### Description

The following code:

```php
<?php
var_dump(iconv_mime_decode("Illegal encoded-word: =?utf-8?Q?".chr(0xA1)."?= ."));
spl_autoload_register(function ($fusion) {
if ($class == 'A') {
} else {
class Y extends A {}
}
});
new B;
```

Resulted in this output:
```
AddressSanitizer:DEADLYSIGNAL
=================================================================
==902==ERROR: AddressSanitizer: SEGV on unknown address (pc 0x7b7a4a01d31e bp 0x64008de5fc9b9782 sp 0x8bb08de5c365d786 T0)
==902==The signal is caused by a READ memory access.
==902==Hint: this fault was caused by a dereference of a high value address (see register values below).  Disassemble the provided pc to learn which register was used.
AddressSanitizer:DEADLYSIGNAL
AddressSanitizer: nested bug in the same thread, aborting.
```

To reproduce:
```
./php-src/sapi/cli/php  ./test.php
```

Commit:
```
88c658e1f6e47024f297bc55b07a402c4ed3621c
```

Configurations:
```
CC="clang-12" CXX="clang++-12" CFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" CXXFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" ./configure --enable-debug --enable-address-sanitizer --enable-undefined-sanitizer --enable-re2c-cgoto --enable-fpm --enable-litespeed --enable-phpdbg-debug --enable-zts --enable-bcmath --enable-calendar --enable-dba --enable-dl-test --enable-exif --enable-ftp --enable-gd --enable-gd-jis-conv --enable-mbstring --enable-pcntl --enable-shmop --enable-soap --enable-sockets --enable-sysvmsg --enable-zend-test --with-zlib --with-bz2 --with-curl --with-enchant --with-gettext --with-gmp --with-mhash --with-ldap --with-libedit --with-readline --with-snmp --with-sodium --with-xsl --with-zip --with-mysqli --with-pdo-mysql --with-pdo-pgsql --with-pgsql --with-sqlite3 --with-pdo-sqlite --with-webp --with-jpeg --with-freetype --enable-sigchild --with-readline --with-pcre-jit --with-iconv
```

Operating System:
```
Ubuntu 20.04 Host, Docker 0599jiangyc/flowfusion:latest
```

*This report is automatically generated by [FlowFusion](https://github.com/php/flowfusion)*

### PHP Version

```plain
nightly
```

### Operating System

_No response_
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.