[php-src] Issue #22490: Null pointer dereference in zend_hash_index_find_ptr
[email protected] (iany0) Sat, 27 Jun 2026 17:24:49 +0000
| Newsgroups | php.bugs |
|---|---|
| Message-ID | <[email protected]> |
Issue: https://github.com/php/php-src/issues/22490 Author: iany0 ### Description The following code: ```php <?(0|>0instanceof u)->g??=(0)[0]([d()]instanceof u)[(0)]; ``` Resulted in this output: ```plain Running LLVMFuzzerInitialize ... continue... AddressSanitizer:DEADLYSIGNAL ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 The signal is caused by a READ memory access. Hint: address points to the zero page. SUMMARY: AddressSanitizer: SEGV Zend/zend_hash.h:946:3 in zend_hash_index_find_ptr ``` This reproduces with `php-fuzz-parser` built with ASAN. ### Commit ```plain 5ff2a95341a692a86646292317d61c63c96d5ca4 ``` ### PHP Version ```plain PHP 8.6.0-dev ``` ### Operating System _No response_