Heap-use-after-free in zend_array_count at Zend/zend_hash.c

Description

The following code:

<?php
class Foo {
    public function __destruct() {
        $a[0] =&$a;
        $a =   $this->$$a =   $this->#destruct() {
            $a = unserialize(serialize($GLOBALS));
        }
    }

$c = new Foo();
for($cnt=0;$cnt<6;$cnt++) {
    $a = unserialize(serialize($GLOBALS));
    $a.= unserialize(serialize($GLOBALS));
    $a = unserialize(serialize($GLOBALS));
}

Resulted in this output:

SUMMARY: AddressSanitizer: heap-use-after-free php-src/Zend/zend_hash.c:478:6 in zend_array_count
Shadow bytes around the buggy address:
  0x0c0c7fffe490: 00 00 00 00 00 00 00 fa fa fa fa fa 00 00 00 00
  0x0c0c7fffe4a0: 00 00 00 fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x0c0c7fffe4b0: fa fa fa fa 00 00 00 00 00 00 00 fa fa fa fa fa
  0x0c0c7fffe4c0: fd fd fd fd fd fd fd fa fa fa fa fa fd fd fd fd
  0x0c0c7fffe4d0: fd fd fd fd fa fa fa fa 00 00 00 00 00 00 00 fa
=>0x0c0c7fffe4e0: fa fa fa fa fd[fd]fd fd fd fd fd fa fa fa fa fa
  0x0c0c7fffe4f0: fd fd fd fd fd fd fd fa fa fa fa fa fd fd fd fd
  0x0c0c7fffe500: fd fd fd fd fa fa fa fa fd fd fd fd fd fd fd fd
  0x0c0c7fffe510: fa fa fa fa fd fd fd fd fd fd fd fa fa fa fa fa
  0x0c0c7fffe520: fd fd fd fd fd fd fd fa fa fa fa fa fd fd fd fd
  0x0c0c7fffe530: fd fd fd fd fa fa fa fa fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==3046755==ABORTING

Commit:

9cd367362da5442861f30d3b41e967d641b90cbd

Build configuration:

CC="clang" CXX="clang++" CFLAGS="-fsanitize=address -g -O0" CXXFLAGS="-fsanitize=address -g -O0" ./configure --enable-debug --enable-address-sanitizer --disable-shared --with-pic

Thanks a lot for finding this bug with the help of @vi3tL0u1s

PHP Version

PHP 8.6.0-dev (cli) (built: Nov 14 2025 10:37:56) (NTS DEBUG)
Copyright (c) The PHP Group
Zend Engine v4.6.0-dev, Copyright (c) Zend Technologies
    with Zend OPcache v8.6.0-dev, Copyright (c), by Zend Technologies

Operating System

Ubuntu 22.04

Untersuche Zend/zend_hash.c in der Nähe von Zeile 478 und führe das bereitgestellte PHP-Skript mit der dokumentierten AddressSanitizer-Build-Konfiguration erneut aus. Abgeschlossen ist die Aufgabe, wenn der Reproducer in zend_array_count nicht mehr über einen heap-use-after-free berichtet.