php / php/php-src

Heap use-after-free in lazy proxy __get() property access (ReflectionClass::initializeLazyObject())

オープン
#20,519 コメント 2 件 リアクション 0 件 担当者 0 名 GitHub で見る

まだ誰も着手していません。

Bug Category: Engine Status: Verified
主要言語
C
スター
40.4k
フォーク
8.1k
平均マージ
2日 13時間
マージ済み PR（30日）
96

説明

Description

The following code:

<?php
#[AllowDynamicProperties]
class RealInstance {
    public $_;
    public function __get($name) {
        global $obj;
        $x[!0] =$$a = false;
        foreach ($obj as&$val) {
            $obj->bMr > 42;
        }
        $arr=$obj->foo??= $obj->fooa[] =&$$a; 
        $$$x[ ! 0] =$$obj->$foo ??= var_dump($obj->$name);
    }
}
$rc = new ReflectionClass(RealInstance::class);
$obj = $rc->newLazyProxy(function () {
    return new RealInstance;
});
$real = $rc->initializeLazyObject($obj);
var_dump($real->prop);

Command:

USE_ZEND_ALLOC=0 ./php-src/sapi/cli/php poc.php

Resulted in this output:

=================================================================
==2210185==ERROR: AddressSanitizer: heap-use-after-free on address 0x60600001d5a0 at pc 0x5654191cd29e bp 0x7ffe5e50df50 sp 0x7ffe5e50df48
READ of size 4 at 0x60600001d5a0 thread T0
    #0 0x5654191cd29d in zend_gc_addref /path/to/php-src/Zend/zend_types.h:1354:9
    #1 0x56541940d713 in zval_addref_p /path/to/php-src/Zend/zend_types.h:1403:9
    #2 0x56541942ec8a in zend_fetch_var_address_helper_SPEC_CV_UNUSED /path/to/php-src/Zend/zend_vm_execute.h:51147:3
    #3 0x5654192f7c9e in ZEND_FETCH_R_SPEC_CV_UNUSED_HANDLER /path/to/php-src/Zend/zend_vm_execute.h:51156:2
    #4 0x5654191de5a2 in execute_ex /path/to/php-src/Zend/zend_vm_execute.h:116212:12
    #5 0x5654191b8bde in zend_call_function /path/to/php-src/Zend/zend_execute_API.c:1014:3
    #6 0x5654191bade2 in zend_call_known_function /path/to/php-src/Zend/zend_execute_API.c:1108:23
    #7 0x5654195819fa in zend_call_known_instance_method /path/to/php-src/Zend/zend_API.h:860:2
    #8 0x565419571de1 in zend_call_known_instance_method_with_1_params /path/to/php-src/Zend/zend_API.h:872:2
    #9 0x56541956e735 in zend_std_call_getter /path/to/php-src/Zend/zend_object_handlers.c:242:2
    #10 0x56541956c925 in zend_std_read_property /path/to/php-src/Zend/zend_object_handlers.c:929:4
    #11 0x56541941e6eb in zend_fetch_property_address /path/to/php-src/Zend/zend_execute.c:3617:9
    #12 0x56541930f66b in ZEND_FETCH_OBJ_W_SPEC_CV_CONST_HANDLER /path/to/php-src/Zend/zend_vm_execute.h:44238:2
    #13 0x5654191de5a2 in execute_ex /path/to/php-src/Zend/zend_vm_execute.h:116212:12
    #14 0x5654191b8bde in zend_call_function /path/to/php-src/Zend/zend_execute_API.c:1014:3
    #15 0x5654191bade2 in zend_call_known_function /path/to/php-src/Zend/zend_execute_API.c:1108:23
    #16 0x5654195819fa in zend_call_known_instance_method /path/to/php-src/Zend/zend_API.h:860:2
    #17 0x565419571de1 in zend_call_known_instance_method_with_1_params /path/to/php-src/Zend/zend_API.h:872:2
    #18 0x56541956e735 in zend_std_call_getter /path/to/php-src/Zend/zend_object_handlers.c:242:2
    #19 0x56541956c925 in zend_std_read_property /path/to/php-src/Zend/zend_object_handlers.c:929:4
    #20 0x56541931efe7 in ZEND_FETCH_OBJ_IS_SPEC_CV_CONST_HANDLER /path/to/php-src/Zend/zend_vm_execute.h:44369:12
    #21 0x5654191de5a2 in execute_ex /path/to/php-src/Zend/zend_vm_execute.h:116212:12
    #22 0x5654191b8bde in zend_call_function /path/to/php-src/Zend/zend_execute_API.c:1014:3
    #23 0x5654191bade2 in zend_call_known_function /path/to/php-src/Zend/zend_execute_API.c:1108:23
    #24 0x5654195819fa in zend_call_known_instance_method /path/to/php-src/Zend/zend_API.h:860:2
    #25 0x565419571de1 in zend_call_known_instance_method_with_1_params /path/to/php-src/Zend/zend_API.h:872:2
    #26 0x56541956e735 in zend_std_call_getter /path/to/php-src/Zend/zend_object_handlers.c:242:2
    #27 0x56541956c925 in zend_std_read_property /path/to/php-src/Zend/zend_object_handlers.c:929:4
    #28 0x565419432a92 in ZEND_FETCH_OBJ_R_SPEC_CV_CONST_INLINE_HANDLER /path/to/php-src/Zend/zend_vm_execute.h:44194:12
    #29 0x56541930739c in ZEND_FETCH_OBJ_R_SPEC_CV_CONST_HANDLER /path/to/php-src/Zend/zend_vm_execute.h:44225:2
    #30 0x5654191de5a2 in execute_ex /path/to/php-src/Zend/zend_vm_execute.h:116212:12
    #31 0x5654191b8bde in zend_call_function /path/to/php-src/Zend/zend_execute_API.c:1014:3
    #32 0x5654191bade2 in zend_call_known_function /path/to/php-src/Zend/zend_execute_API.c:1108:23
    #33 0x5654195819fa in zend_call_known_instance_method /path/to/php-src/Zend/zend_API.h:860:2
    #34 0x565419571de1 in zend_call_known_instance_method_with_1_params /path/to/php-src/Zend/zend_API.h:872:2
    #35 0x56541956e735 in zend_std_call_getter /path/to/php-src/Zend/zend_object_handlers.c:242:2
    #36 0x56541956c925 in zend_std_read_property /path/to/php-src/Zend/zend_object_handlers.c:929:4
    #37 0x565419432a92 in ZEND_FETCH_OBJ_R_SPEC_CV_CONST_INLINE_HANDLER /path/to/php-src/Zend/zend_vm_execute.h:44194:12
    #38 0x56541930739c in ZEND_FETCH_OBJ_R_SPEC_CV_CONST_HANDLER /path/to/php-src/Zend/zend_vm_execute.h:44225:2
    #39 0x5654191de5a2 in execute_ex /path/to/php-src/Zend/zend_vm_execute.h:116212:12
    #40 0x5654191deea7 in zend_execute /path/to/php-src/Zend/zend_vm_execute.h:121924:2
    #41 0x56541960d130 in zend_execute_script /path/to/php-src/Zend/zend.c:1975:3
    #42 0x565418e14026 in php_execute_script_ex /path/to/php-src/main/main.c:2645:13
    #43 0x565418e14528 in php_execute_script /path/to/php-src/main/main.c:2685:9
    #44 0x565419614fe2 in do_cli /path/to/php-src/sapi/cli/php_cli.c:951:5
    #45 0x565419611f3c in main /path/to/php-src/sapi/cli/php_cli.c:1362:18
    #46 0x7f581b482d8f  (/lib/x86_64-linux-gnu/libc.so.6+0x29d8f) (BuildId: 4f7b0c955c3d81d7cac1501a2498b69d1d82bfe7)
    #47 0x7f581b482e3f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e3f) (BuildId: 4f7b0c955c3d81d7cac1501a2498b69d1d82bfe7)
    #48 0x565417e01d64 in _start (/path/to/php-src/sapi/cli/php+0x601d64) (BuildId: 2f4d58726259e316f2962e15de07f4156fac78bc)

0x60600001d5a0 is located 0 bytes inside of 56-byte region [0x60600001d5a0,0x60600001d5d8)
freed by thread T0 here:
    #0 0x565417e84902 in free (/path/to/php-src/sapi/cli/php+0x684902) (BuildId: 2f4d58726259e316f2962e15de07f4156fac78bc)
    #1 0x56541905e733 in __zend_free /path/to/php-src/Zend/zend_alloc.c:3571:2
    #2 0x5654190628f4 in _efree /path/to/php-src/Zend/zend_alloc.c:2790:3
    #3 0x565419482cfd in zend_array_destroy /path/to/php-src/Zend/zend_hash.c:1879:2
    #4 0x5654195ed396 in rc_dtor_func /path/to/php-src/Zend/zend_variables.c:57:2
    #5 0x56541929aa22 in ZEND_ASSIGN_REF_SPEC_VAR_VAR_HANDLER /path/to/php-src/Zend/zend_vm_execute.h:29787:3
    #6 0x5654191de5a2 in execute_ex /path/to/php-src/Zend/zend_vm_execute.h:116212:12
    #7 0x5654191b8bde in zend_call_function /path/to/php-src/Zend/zend_execute_API.c:1014:3
    #8 0x5654191bade2 in zend_call_known_function /path/to/php-src/Zend/zend_execute_API.c:1108:23
    #9 0x5654195819fa in zend_call_known_instance_method /path/to/php-src/Zend/zend_API.h:860:2
    #10 0x565419571de1 in zend_call_known_instance_method_with_1_params /path/to/php-src/Zend/zend_API.h:872:2
    #11 0x56541956e735 in zend_std_call_getter /path/to/php-src/Zend/zend_object_handlers.c:242:2
    #12 0x56541956c925 in zend_std_read_property /path/to/php-src/Zend/zend_object_handlers.c:929:4
    #13 0x56541941e6eb in zend_fetch_property_address /path/to/php-src/Zend/zend_execute.c:3617:9
    #14 0x56541930f66b in ZEND_FETCH_OBJ_W_SPEC_CV_CONST_HANDLER /path/to/php-src/Zend/zend_vm_execute.h:44238:2
    #15 0x5654191de5a2 in execute_ex /path/to/php-src/Zend/zend_vm_execute.h:116212:12
    #16 0x5654191b8bde in zend_call_function /path/to/php-src/Zend/zend_execute_API.c:1014:3
    #17 0x5654191bade2 in zend_call_known_function /path/to/php-src/Zend/zend_execute_API.c:1108:23
    #18 0x5654195819fa in zend_call_known_instance_method /path/to/php-src/Zend/zend_API.h:860:2
    #19 0x565419571de1 in zend_call_known_instance_method_with_1_params /path/to/php-src/Zend/zend_API.h:872:2
    #20 0x56541956e735 in zend_std_call_getter /path/to/php-src/Zend/zend_object_handlers.c:242:2
    #21 0x56541956c925 in zend_std_read_property /path/to/php-src/Zend/zend_object_handlers.c:929:4
    #22 0x56541931efe7 in ZEND_FETCH_OBJ_IS_SPEC_CV_CONST_HANDLER /path/to/php-src/Zend/zend_vm_execute.h:44369:12
    #23 0x5654191de5a2 in execute_ex /path/to/php-src/Zend/zend_vm_execute.h:116212:12
    #24 0x5654191b8bde in zend_call_function /path/to/php-src/Zend/zend_execute_API.c:1014:3
    #25 0x5654191bade2 in zend_call_known_function /path/to/php-src/Zend/zend_execute_API.c:1108:23
    #26 0x5654195819fa in zend_call_known_instance_method /path/to/php-src/Zend/zend_API.h:860:2
    #27 0x565419571de1 in zend_call_known_instance_method_with_1_params /path/to/php-src/Zend/zend_API.h:872:2
    #28 0x56541956e735 in zend_std_call_getter /path/to/php-src/Zend/zend_object_handlers.c:242:2
    #29 0x56541956c925 in zend_std_read_property /path/to/php-src/Zend/zend_object_handlers.c:929:4

previously allocated by thread T0 here:
    #0 0x565417e84bae in __interceptor_malloc (/path/to/php-src/sapi/cli/php+0x684bae) (BuildId: 2f4d58726259e316f2962e15de07f4156fac78bc)
    #1 0x565419062e63 in __zend_malloc /path/to/php-src/Zend/zend_alloc.c:3543:14
    #2 0x5654190627f0 in _emalloc /path/to/php-src/Zend/zend_alloc.c:2780:10
    #3 0x56541946b587 in _zend_new_array /path/to/php-src/Zend/zend_hash.c:290:18
    #4 0x565419434395 in zend_fetch_dimension_address /path/to/php-src/Zend/zend_execute.c:3003:21
    #5 0x5654194331d3 in zend_fetch_dimension_address_W /path/to/php-src/Zend/zend_execute.c:3042:2
    #6 0x56541930caa2 in ZEND_FETCH_DIM_W_SPEC_VAR_UNUSED_HANDLER /path/to/php-src/Zend/zend_vm_execute.h:29903:2
    #7 0x5654191de5a2 in execute_ex /path/to/php-src/Zend/zend_vm_execute.h:116212:12
    #8 0x5654191b8bde in zend_call_function /path/to/php-src/Zend/zend_execute_API.c:1014:3
    #9 0x5654191bade2 in zend_call_known_function /path/to/php-src/Zend/zend_execute_API.c:1108:23
    #10 0x5654195819fa in zend_call_known_instance_method /path/to/php-src/Zend/zend_API.h:860:2
    #11 0x565419571de1 in zend_call_known_instance_method_with_1_params /path/to/php-src/Zend/zend_API.h:872:2
    #12 0x56541956e735 in zend_std_call_getter /path/to/php-src/Zend/zend_object_handlers.c:242:2
    #13 0x56541956c925 in zend_std_read_property /path/to/php-src/Zend/zend_object_handlers.c:929:4
    #14 0x56541941e6eb in zend_fetch_property_address /path/to/php-src/Zend/zend_execute.c:3617:9
    #15 0x56541930f66b in ZEND_FETCH_OBJ_W_SPEC_CV_CONST_HANDLER /path/to/php-src/Zend/zend_vm_execute.h:44238:2
    #16 0x5654191de5a2 in execute_ex /path/to/php-src/Zend/zend_vm_execute.h:116212:12
    #17 0x5654191b8bde in zend_call_function /path/to/php-src/Zend/zend_execute_API.c:1014:3
    #18 0x5654191bade2 in zend_call_known_function /path/to/php-src/Zend/zend_execute_API.c:1108:23
    #19 0x5654195819fa in zend_call_known_instance_method /path/to/php-src/Zend/zend_API.h:860:2
    #20 0x565419571de1 in zend_call_known_instance_method_with_1_params /path/to/php-src/Zend/zend_API.h:872:2
    #21 0x56541956e735 in zend_std_call_getter /path/to/php-src/Zend/zend_object_handlers.c:242:2
    #22 0x56541956c925 in zend_std_read_property /path/to/php-src/Zend/zend_object_handlers.c:929:4
    #23 0x56541931efe7 in ZEND_FETCH_OBJ_IS_SPEC_CV_CONST_HANDLER /path/to/php-src/Zend/zend_vm_execute.h:44369:12
    #24 0x5654191de5a2 in execute_ex /path/to/php-src/Zend/zend_vm_execute.h:116212:12
    #25 0x5654191b8bde in zend_call_function /path/to/php-src/Zend/zend_execute_API.c:1014:3
    #26 0x5654191bade2 in zend_call_known_function /path/to/php-src/Zend/zend_execute_API.c:1108:23
    #27 0x5654195819fa in zend_call_known_instance_method /path/to/php-src/Zend/zend_API.h:860:2
    #28 0x565419571de1 in zend_call_known_instance_method_with_1_params /path/to/php-src/Zend/zend_API.h:872:2
    #29 0x56541956e735 in zend_std_call_getter /path/to/php-src/Zend/zend_object_handlers.c:242:2

SUMMARY: AddressSanitizer: heap-use-after-free /path/to/php-src/Zend/zend_types.h:1354:9 in zend_gc_addref
Shadow bytes around the buggy address:
  0x0c0c7fffba60: 00 00 00 00 00 00 00 fa fa fa fa fa 00 00 00 00
  0x0c0c7fffba70: 00 00 00 fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x0c0c7fffba80: fa fa fa fa 00 00 00 00 00 00 00 fa fa fa fa fa
  0x0c0c7fffba90: 00 00 00 00 00 00 00 fa fa fa fa fa fd fd fd fd
  0x0c0c7fffbaa0: fd fd fd fd fa fa fa fa fd fd fd fd fd fd fd fd
=>0x0c0c7fffbab0: fa fa fa fa[fd]fd fd fd fd fd fd fa fa fa fa fa
  0x0c0c7fffbac0: fd fd fd fd fd fd fd fa fa fa fa fa 00 00 00 00
  0x0c0c7fffbad0: 00 00 00 fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0c7fffbae0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0c7fffbaf0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0c7fffbb00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==2210185==ABORTING

Commit:

d750d30a627a143d88670cf0431d6f42b2c77c4b

Build configuration:

CC="clang" CXX="clang++" CFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" CXXFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" ./configure --enable-debug --enable-address-sanitizer --disable-all --enable-cli
PHP Version
PHP 8.6.0-dev (cli) (built: Nov 18 2025 15:42:17) (NTS DEBUG)
Copyright (c) The PHP Group
Zend Engine v4.6.0-dev, Copyright (c) Zend Technologies
    with Zend OPcache v8.6.0-dev, Copyright (c), by Zend Technologies
Operating System

Ubuntu 22.04

コントリビューションガイド

コントリビューションガイドを開く

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

調査の方向性

USE_ZEND_ALLOC=0 と AddressSanitizer 下の PHP CLI でレポートを再現し、スタックトレースに示された Zend のプロパティアクセスおよび getter フレームを通じて failure を追跡します。lazy proxy の __get() アクセス周辺の ownership failure を特定し、同じ reproducer で heap-use-after-free が報告されなくなったことを確認します。

索引モデルが issue の本文から書いたものです。

評価

技術スタック
c, php
領域
compilers, security
issue の種類
バグ
難易度
5/5
見積もり時間
1週間以上
活発さ
停滞
明瞭さ
説明が足りない
初心者へのやさしさ
20/100

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。