php / php/php-src

Heap use-after-free in lazy proxy __get() property access (ReflectionClass::initializeLazyObject())

Offen
#20,519 2 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen

Dieses Issue hat noch niemand übernommen.

Bug Category: Engine Status: Verified
Vorherrschende Sprache
C
Sterne
40.4k
Forks
8.1k
Ø Merge
2 T. 13 Std.
Gemergte PRs (30 T.)
96

Beschreibung

Description

The following code:

<?php
#[AllowDynamicProperties]
class RealInstance {
    public $_;
    public function __get($name) {
        global $obj;
        $x[!0] =$$a = false;
        foreach ($obj as&$val) {
            $obj->bMr > 42;
        }
        $arr=$obj->foo??= $obj->fooa[] =&$$a; 
        $$$x[ ! 0] =$$obj->$foo ??= var_dump($obj->$name);
    }
}
$rc = new ReflectionClass(RealInstance::class);
$obj = $rc->newLazyProxy(function () {
    return new RealInstance;
});
$real = $rc->initializeLazyObject($obj);
var_dump($real->prop);

Command:

USE_ZEND_ALLOC=0 ./php-src/sapi/cli/php poc.php

Resulted in this output:

=================================================================
==2210185==ERROR: AddressSanitizer: heap-use-after-free on address 0x60600001d5a0 at pc 0x5654191cd29e bp 0x7ffe5e50df50 sp 0x7ffe5e50df48
READ of size 4 at 0x60600001d5a0 thread T0
    #0 0x5654191cd29d in zend_gc_addref /path/to/php-src/Zend/zend_types.h:1354:9
    #1 0x56541940d713 in zval_addref_p /path/to/php-src/Zend/zend_types.h:1403:9
    #2 0x56541942ec8a in zend_fetch_var_address_helper_SPEC_CV_UNUSED /path/to/php-src/Zend/zend_vm_execute.h:51147:3
    #3 0x5654192f7c9e in ZEND_FETCH_R_SPEC_CV_UNUSED_HANDLER /path/to/php-src/Zend/zend_vm_execute.h:51156:2
    #4 0x5654191de5a2 in execute_ex /path/to/php-src/Zend/zend_vm_execute.h:116212:12
    #5 0x5654191b8bde in zend_call_function /path/to/php-src/Zend/zend_execute_API.c:1014:3
    #6 0x5654191bade2 in zend_call_known_function /path/to/php-src/Zend/zend_execute_API.c:1108:23
    #7 0x5654195819fa in zend_call_known_instance_method /path/to/php-src/Zend/zend_API.h:860:2
    #8 0x565419571de1 in zend_call_known_instance_method_with_1_params /path/to/php-src/Zend/zend_API.h:872:2
    #9 0x56541956e735 in zend_std_call_getter /path/to/php-src/Zend/zend_object_handlers.c:242:2
    #10 0x56541956c925 in zend_std_read_property /path/to/php-src/Zend/zend_object_handlers.c:929:4
    #11 0x56541941e6eb in zend_fetch_property_address /path/to/php-src/Zend/zend_execute.c:3617:9
    #12 0x56541930f66b in ZEND_FETCH_OBJ_W_SPEC_CV_CONST_HANDLER /path/to/php-src/Zend/zend_vm_execute.h:44238:2
    #13 0x5654191de5a2 in execute_ex /path/to/php-src/Zend/zend_vm_execute.h:116212:12
    #14 0x5654191b8bde in zend_call_function /path/to/php-src/Zend/zend_execute_API.c:1014:3
    #15 0x5654191bade2 in zend_call_known_function /path/to/php-src/Zend/zend_execute_API.c:1108:23
    #16 0x5654195819fa in zend_call_known_instance_method /path/to/php-src/Zend/zend_API.h:860:2
    #17 0x565419571de1 in zend_call_known_instance_method_with_1_params /path/to/php-src/Zend/zend_API.h:872:2
    #18 0x56541956e735 in zend_std_call_getter /path/to/php-src/Zend/zend_object_handlers.c:242:2
    #19 0x56541956c925 in zend_std_read_property /path/to/php-src/Zend/zend_object_handlers.c:929:4
    #20 0x56541931efe7 in ZEND_FETCH_OBJ_IS_SPEC_CV_CONST_HANDLER /path/to/php-src/Zend/zend_vm_execute.h:44369:12
    #21 0x5654191de5a2 in execute_ex /path/to/php-src/Zend/zend_vm_execute.h:116212:12
    #22 0x5654191b8bde in zend_call_function /path/to/php-src/Zend/zend_execute_API.c:1014:3
    #23 0x5654191bade2 in zend_call_known_function /path/to/php-src/Zend/zend_execute_API.c:1108:23
    #24 0x5654195819fa in zend_call_known_instance_method /path/to/php-src/Zend/zend_API.h:860:2
    #25 0x565419571de1 in zend_call_known_instance_method_with_1_params /path/to/php-src/Zend/zend_API.h:872:2
    #26 0x56541956e735 in zend_std_call_getter /path/to/php-src/Zend/zend_object_handlers.c:242:2
    #27 0x56541956c925 in zend_std_read_property /path/to/php-src/Zend/zend_object_handlers.c:929:4
    #28 0x565419432a92 in ZEND_FETCH_OBJ_R_SPEC_CV_CONST_INLINE_HANDLER /path/to/php-src/Zend/zend_vm_execute.h:44194:12
    #29 0x56541930739c in ZEND_FETCH_OBJ_R_SPEC_CV_CONST_HANDLER /path/to/php-src/Zend/zend_vm_execute.h:44225:2
    #30 0x5654191de5a2 in execute_ex /path/to/php-src/Zend/zend_vm_execute.h:116212:12
    #31 0x5654191b8bde in zend_call_function /path/to/php-src/Zend/zend_execute_API.c:1014:3
    #32 0x5654191bade2 in zend_call_known_function /path/to/php-src/Zend/zend_execute_API.c:1108:23
    #33 0x5654195819fa in zend_call_known_instance_method /path/to/php-src/Zend/zend_API.h:860:2
    #34 0x565419571de1 in zend_call_known_instance_method_with_1_params /path/to/php-src/Zend/zend_API.h:872:2
    #35 0x56541956e735 in zend_std_call_getter /path/to/php-src/Zend/zend_object_handlers.c:242:2
    #36 0x56541956c925 in zend_std_read_property /path/to/php-src/Zend/zend_object_handlers.c:929:4
    #37 0x565419432a92 in ZEND_FETCH_OBJ_R_SPEC_CV_CONST_INLINE_HANDLER /path/to/php-src/Zend/zend_vm_execute.h:44194:12
    #38 0x56541930739c in ZEND_FETCH_OBJ_R_SPEC_CV_CONST_HANDLER /path/to/php-src/Zend/zend_vm_execute.h:44225:2
    #39 0x5654191de5a2 in execute_ex /path/to/php-src/Zend/zend_vm_execute.h:116212:12
    #40 0x5654191deea7 in zend_execute /path/to/php-src/Zend/zend_vm_execute.h:121924:2
    #41 0x56541960d130 in zend_execute_script /path/to/php-src/Zend/zend.c:1975:3
    #42 0x565418e14026 in php_execute_script_ex /path/to/php-src/main/main.c:2645:13
    #43 0x565418e14528 in php_execute_script /path/to/php-src/main/main.c:2685:9
    #44 0x565419614fe2 in do_cli /path/to/php-src/sapi/cli/php_cli.c:951:5
    #45 0x565419611f3c in main /path/to/php-src/sapi/cli/php_cli.c:1362:18
    #46 0x7f581b482d8f  (/lib/x86_64-linux-gnu/libc.so.6+0x29d8f) (BuildId: 4f7b0c955c3d81d7cac1501a2498b69d1d82bfe7)
    #47 0x7f581b482e3f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e3f) (BuildId: 4f7b0c955c3d81d7cac1501a2498b69d1d82bfe7)
    #48 0x565417e01d64 in _start (/path/to/php-src/sapi/cli/php+0x601d64) (BuildId: 2f4d58726259e316f2962e15de07f4156fac78bc)

0x60600001d5a0 is located 0 bytes inside of 56-byte region [0x60600001d5a0,0x60600001d5d8)
freed by thread T0 here:
    #0 0x565417e84902 in free (/path/to/php-src/sapi/cli/php+0x684902) (BuildId: 2f4d58726259e316f2962e15de07f4156fac78bc)
    #1 0x56541905e733 in __zend_free /path/to/php-src/Zend/zend_alloc.c:3571:2
    #2 0x5654190628f4 in _efree /path/to/php-src/Zend/zend_alloc.c:2790:3
    #3 0x565419482cfd in zend_array_destroy /path/to/php-src/Zend/zend_hash.c:1879:2
    #4 0x5654195ed396 in rc_dtor_func /path/to/php-src/Zend/zend_variables.c:57:2
    #5 0x56541929aa22 in ZEND_ASSIGN_REF_SPEC_VAR_VAR_HANDLER /path/to/php-src/Zend/zend_vm_execute.h:29787:3
    #6 0x5654191de5a2 in execute_ex /path/to/php-src/Zend/zend_vm_execute.h:116212:12
    #7 0x5654191b8bde in zend_call_function /path/to/php-src/Zend/zend_execute_API.c:1014:3
    #8 0x5654191bade2 in zend_call_known_function /path/to/php-src/Zend/zend_execute_API.c:1108:23
    #9 0x5654195819fa in zend_call_known_instance_method /path/to/php-src/Zend/zend_API.h:860:2
    #10 0x565419571de1 in zend_call_known_instance_method_with_1_params /path/to/php-src/Zend/zend_API.h:872:2
    #11 0x56541956e735 in zend_std_call_getter /path/to/php-src/Zend/zend_object_handlers.c:242:2
    #12 0x56541956c925 in zend_std_read_property /path/to/php-src/Zend/zend_object_handlers.c:929:4
    #13 0x56541941e6eb in zend_fetch_property_address /path/to/php-src/Zend/zend_execute.c:3617:9
    #14 0x56541930f66b in ZEND_FETCH_OBJ_W_SPEC_CV_CONST_HANDLER /path/to/php-src/Zend/zend_vm_execute.h:44238:2
    #15 0x5654191de5a2 in execute_ex /path/to/php-src/Zend/zend_vm_execute.h:116212:12
    #16 0x5654191b8bde in zend_call_function /path/to/php-src/Zend/zend_execute_API.c:1014:3
    #17 0x5654191bade2 in zend_call_known_function /path/to/php-src/Zend/zend_execute_API.c:1108:23
    #18 0x5654195819fa in zend_call_known_instance_method /path/to/php-src/Zend/zend_API.h:860:2
    #19 0x565419571de1 in zend_call_known_instance_method_with_1_params /path/to/php-src/Zend/zend_API.h:872:2
    #20 0x56541956e735 in zend_std_call_getter /path/to/php-src/Zend/zend_object_handlers.c:242:2
    #21 0x56541956c925 in zend_std_read_property /path/to/php-src/Zend/zend_object_handlers.c:929:4
    #22 0x56541931efe7 in ZEND_FETCH_OBJ_IS_SPEC_CV_CONST_HANDLER /path/to/php-src/Zend/zend_vm_execute.h:44369:12
    #23 0x5654191de5a2 in execute_ex /path/to/php-src/Zend/zend_vm_execute.h:116212:12
    #24 0x5654191b8bde in zend_call_function /path/to/php-src/Zend/zend_execute_API.c:1014:3
    #25 0x5654191bade2 in zend_call_known_function /path/to/php-src/Zend/zend_execute_API.c:1108:23
    #26 0x5654195819fa in zend_call_known_instance_method /path/to/php-src/Zend/zend_API.h:860:2
    #27 0x565419571de1 in zend_call_known_instance_method_with_1_params /path/to/php-src/Zend/zend_API.h:872:2
    #28 0x56541956e735 in zend_std_call_getter /path/to/php-src/Zend/zend_object_handlers.c:242:2
    #29 0x56541956c925 in zend_std_read_property /path/to/php-src/Zend/zend_object_handlers.c:929:4

previously allocated by thread T0 here:
    #0 0x565417e84bae in __interceptor_malloc (/path/to/php-src/sapi/cli/php+0x684bae) (BuildId: 2f4d58726259e316f2962e15de07f4156fac78bc)
    #1 0x565419062e63 in __zend_malloc /path/to/php-src/Zend/zend_alloc.c:3543:14
    #2 0x5654190627f0 in _emalloc /path/to/php-src/Zend/zend_alloc.c:2780:10
    #3 0x56541946b587 in _zend_new_array /path/to/php-src/Zend/zend_hash.c:290:18
    #4 0x565419434395 in zend_fetch_dimension_address /path/to/php-src/Zend/zend_execute.c:3003:21
    #5 0x5654194331d3 in zend_fetch_dimension_address_W /path/to/php-src/Zend/zend_execute.c:3042:2
    #6 0x56541930caa2 in ZEND_FETCH_DIM_W_SPEC_VAR_UNUSED_HANDLER /path/to/php-src/Zend/zend_vm_execute.h:29903:2
    #7 0x5654191de5a2 in execute_ex /path/to/php-src/Zend/zend_vm_execute.h:116212:12
    #8 0x5654191b8bde in zend_call_function /path/to/php-src/Zend/zend_execute_API.c:1014:3
    #9 0x5654191bade2 in zend_call_known_function /path/to/php-src/Zend/zend_execute_API.c:1108:23
    #10 0x5654195819fa in zend_call_known_instance_method /path/to/php-src/Zend/zend_API.h:860:2
    #11 0x565419571de1 in zend_call_known_instance_method_with_1_params /path/to/php-src/Zend/zend_API.h:872:2
    #12 0x56541956e735 in zend_std_call_getter /path/to/php-src/Zend/zend_object_handlers.c:242:2
    #13 0x56541956c925 in zend_std_read_property /path/to/php-src/Zend/zend_object_handlers.c:929:4
    #14 0x56541941e6eb in zend_fetch_property_address /path/to/php-src/Zend/zend_execute.c:3617:9
    #15 0x56541930f66b in ZEND_FETCH_OBJ_W_SPEC_CV_CONST_HANDLER /path/to/php-src/Zend/zend_vm_execute.h:44238:2
    #16 0x5654191de5a2 in execute_ex /path/to/php-src/Zend/zend_vm_execute.h:116212:12
    #17 0x5654191b8bde in zend_call_function /path/to/php-src/Zend/zend_execute_API.c:1014:3
    #18 0x5654191bade2 in zend_call_known_function /path/to/php-src/Zend/zend_execute_API.c:1108:23
    #19 0x5654195819fa in zend_call_known_instance_method /path/to/php-src/Zend/zend_API.h:860:2
    #20 0x565419571de1 in zend_call_known_instance_method_with_1_params /path/to/php-src/Zend/zend_API.h:872:2
    #21 0x56541956e735 in zend_std_call_getter /path/to/php-src/Zend/zend_object_handlers.c:242:2
    #22 0x56541956c925 in zend_std_read_property /path/to/php-src/Zend/zend_object_handlers.c:929:4
    #23 0x56541931efe7 in ZEND_FETCH_OBJ_IS_SPEC_CV_CONST_HANDLER /path/to/php-src/Zend/zend_vm_execute.h:44369:12
    #24 0x5654191de5a2 in execute_ex /path/to/php-src/Zend/zend_vm_execute.h:116212:12
    #25 0x5654191b8bde in zend_call_function /path/to/php-src/Zend/zend_execute_API.c:1014:3
    #26 0x5654191bade2 in zend_call_known_function /path/to/php-src/Zend/zend_execute_API.c:1108:23
    #27 0x5654195819fa in zend_call_known_instance_method /path/to/php-src/Zend/zend_API.h:860:2
    #28 0x565419571de1 in zend_call_known_instance_method_with_1_params /path/to/php-src/Zend/zend_API.h:872:2
    #29 0x56541956e735 in zend_std_call_getter /path/to/php-src/Zend/zend_object_handlers.c:242:2

SUMMARY: AddressSanitizer: heap-use-after-free /path/to/php-src/Zend/zend_types.h:1354:9 in zend_gc_addref
Shadow bytes around the buggy address:
  0x0c0c7fffba60: 00 00 00 00 00 00 00 fa fa fa fa fa 00 00 00 00
  0x0c0c7fffba70: 00 00 00 fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x0c0c7fffba80: fa fa fa fa 00 00 00 00 00 00 00 fa fa fa fa fa
  0x0c0c7fffba90: 00 00 00 00 00 00 00 fa fa fa fa fa fd fd fd fd
  0x0c0c7fffbaa0: fd fd fd fd fa fa fa fa fd fd fd fd fd fd fd fd
=>0x0c0c7fffbab0: fa fa fa fa[fd]fd fd fd fd fd fd fa fa fa fa fa
  0x0c0c7fffbac0: fd fd fd fd fd fd fd fa fa fa fa fa 00 00 00 00
  0x0c0c7fffbad0: 00 00 00 fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0c7fffbae0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0c7fffbaf0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0c7fffbb00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==2210185==ABORTING

Commit:

d750d30a627a143d88670cf0431d6f42b2c77c4b

Build configuration:

CC="clang" CXX="clang++" CFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" CXXFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" ./configure --enable-debug --enable-address-sanitizer --disable-all --enable-cli
PHP Version
PHP 8.6.0-dev (cli) (built: Nov 18 2025 15:42:17) (NTS DEBUG)
Copyright (c) The PHP Group
Zend Engine v4.6.0-dev, Copyright (c) Zend Technologies
    with Zend OPcache v8.6.0-dev, Copyright (c), by Zend Technologies
Operating System

Ubuntu 22.04

Beitragsleitfaden

Beitragsleitfaden öffnen

Erste Schritte

  1. Lies das ganze Issue und danach den Beitragsleitfaden des Projekts.
  2. Schreib ins Issue, dass du es übernimmst — das erspart doppelte Arbeit.
  3. Forke das Repository und arbeite in einem Branch.
  4. Öffne einen Pull Request, der die Issue-Nummer nennt.

Rechercherichtung

Reproduziere den Bericht mit USE_ZEND_ALLOC=0 und der PHP CLI unter AddressSanitizer und verfolge den Fehler anschließend durch die im Stack Trace genannten Zend-Property-Access- und Getter-Frames. Bestimme den Ownership-Fehler beim __get()-Zugriff des Lazy-Proxy und verifiziere, dass derselbe Reproducer keinen heap-use-after-free mehr meldet.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Bewertung

Tech-Stack
c, php
Bereich
compilers, security
Issue-Typ
Bug
Schwierigkeit
5/5
Geschätzter Aufwand
Über eine Woche
Aktivitätsstatus
Veraltet
Klarheit
Muss geklärt werden
Anfängerfreundlichkeit
20/100

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.