sqlite segv
Author: djarflukaCreated Sep 17, 2026Updated Sep 17, 2026
LabelsBugExtension: sqlite3Status: Verified
Description
The following code:
<?php
$db = new SQLite3(':memory:');
$db->createFunction('evil', function () {
global $stmt;
$stmt->close();
return 1;
});
$stmt = $db->prepare("SELECT evil()");
$res = $stmt->execute();Resulted in this output (truncated):
==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000063 ... READ
#0 sqlite3ApiExit (libsqlite3.so.0+0x912b4)
#1 sqlite3_step (libsqlite3.so.0+0xe1fb0)
#2 zim_SQLite3Stmt_execute ext/sqlite3/sqlite3.c:1901:16PHP Version
8.6.0-devOperating System
Ubuntu 22.04
Source: php/php-src