[php-src] Issue #23121: Assertion failure zend_fcc_addref zend_API.h

[email protected] (YuanchengJiang)
Newsgroups php.bugs
Message-ID <zZ3uNOTRzy0KzydqWgLjFRuutcUPhRRHNFa0uvmDUyM@main.internal.php.net>
Issue: https://github.com/php/php-src/issues/23121
Author: YuanchengJiang

### Description

The following code:

```php
<?php
try {
$sx1 = new SimpleXMLElement("<root />");
try { libxml_set_external_entity_loader($sx1); } catch (\Throwable $e) {};
} catch (\Throwable $_ffl_e) {}
```

Resulted in this output:
```
php: /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/Zend/zend_API.h:796: void zend_fcc_addref(zend_fcall_info_cache *): Assertion `((*fcc).function_handler != ((void*)0)) && "FCC Not initialized, possibly refetch trampoline freed by ZPP?"' failed.
Aborted (core dumped)
```

To reproduce:
```
/home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/sapi/cli/php  ./test.php
```

Commit:
```
94136cf9bfbab89e072e3f04992c1e16c3a981a1
```

Configurations:
```
CC="clang-12" CXX="clang++-12" CFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" CXXFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" ./configure --enable-debug --enable-address-sanitizer --enable-undefined-sanitizer --enable-re2c-cgoto --enable-fpm --enable-litespeed --enable-phpdbg-debug --enable-zts --enable-bcmath --enable-calendar --enable-dba --enable-dl-test --enable-exif --enable-ftp --enable-gd --enable-gd-jis-conv --enable-mbstring --enable-pcntl --enable-shmop --enable-soap --enable-sockets --enable-sysvmsg --enable-zend-test --with-zlib --with-bz2 --with-curl --with-enchant --with-gettext --with-gmp --with-mhash --with-ldap --with-libedit --with-readline --with-snmp --with-sodium --with-xsl --with-zip --with-mysqli --with-pdo-mysql --with-pdo-pgsql --with-pgsql --with-sqlite3 --with-pdo-sqlite --with-webp --with-jpeg --with-freetype --enable-sigchild --with-readline --with-pcre-jit --with-iconv
```

Operating System:
```
Ubuntu 20.04 Host, Docker 0599jiangyc/flowfusion:latest
```

*This bug was found by [fusion-fuzz](https://github.com/fusion-fuzz/fusion-fuzz)*

### PHP Version

```plain
94136cf9bfbab89e072e3f04992c1e16c3a981a1
```

### Operating System

_No response_
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.