Heap-use-after-free in zend_array_count at Zend/zend_hash.c

Kiểm tra Zend/zend_hash.c quanh dòng 478 và tái hiện script PHP được cung cấp với cấu hình build AddressSanitizer đã được ghi rõ. Hoàn thành khi trình tái hiện không còn báo cáo heap-use-after-free trong zend_array_count.

Description

The following code:

<?php
class Foo {
    public function __destruct() {
        $a[0] =&$a;
        $a =   $this->$$a =   $this->#destruct() {
            $a = unserialize(serialize($GLOBALS));
        }
    }

$c = new Foo();
for($cnt=0;$cnt<6;$cnt++) {
    $a = unserialize(serialize($GLOBALS));
    $a.= unserialize(serialize($GLOBALS));
    $a = unserialize(serialize($GLOBALS));
}

Resulted in this output:

SUMMARY: AddressSanitizer: heap-use-after-free php-src/Zend/zend_hash.c:478:6 in zend_array_count
Shadow bytes around the buggy address:
  0x0c0c7fffe490: 00 00 00 00 00 00 00 fa fa fa fa fa 00 00 00 00
  0x0c0c7fffe4a0: 00 00 00 fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x0c0c7fffe4b0: fa fa fa fa 00 00 00 00 00 00 00 fa fa fa fa fa
  0x0c0c7fffe4c0: fd fd fd fd fd fd fd fa fa fa fa fa fd fd fd fd
  0x0c0c7fffe4d0: fd fd fd fd fa fa fa fa 00 00 00 00 00 00 00 fa
=>0x0c0c7fffe4e0: fa fa fa fa fd[fd]fd fd fd fd fd fa fa fa fa fa
  0x0c0c7fffe4f0: fd fd fd fd fd fd fd fa fa fa fa fa fd fd fd fd
  0x0c0c7fffe500: fd fd fd fd fa fa fa fa fd fd fd fd fd fd fd fd
  0x0c0c7fffe510: fa fa fa fa fd fd fd fd fd fd fd fa fa fa fa fa
  0x0c0c7fffe520: fd fd fd fd fd fd fd fa fa fa fa fa fd fd fd fd
  0x0c0c7fffe530: fd fd fd fd fa fa fa fa fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==3046755==ABORTING

Commit:

9cd367362da5442861f30d3b41e967d641b90cbd

Build configuration:

CC="clang" CXX="clang++" CFLAGS="-fsanitize=address -g -O0" CXXFLAGS="-fsanitize=address -g -O0" ./configure --enable-debug --enable-address-sanitizer --disable-shared --with-pic

Thanks a lot for finding this bug with the help of @vi3tL0u1s

PHP Version

PHP 8.6.0-dev (cli) (built: Nov 14 2025 10:37:56) (NTS DEBUG)
Copyright (c) The PHP Group
Zend Engine v4.6.0-dev, Copyright (c) Zend Technologies
    with Zend OPcache v8.6.0-dev, Copyright (c), by Zend Technologies

Operating System

Ubuntu 22.04