Skip to content

Segfault from ASan: SEGV on unknown address 0x7ffd00000042 #13680

Closed

Description

@YuanchengJiang

Description

Given the following phpt file:

--TEST--
ASan DEADLYSIGNAL SEGV on unknown address
--INI--
error_reporting=E_ALL&~E_DEPRECATED
--FILE--
<?php
class obj implements Serializable {
    var $data;
    function serialize() {
        return serialize($this->data);
    }
    function unserialize($data) {
        session_start();
        session_decode($data);
    }
}
$inner = 'ryat|a:1:{i:0;a:1:{i:1;';
$exploit = 'a:2:{i:0;C:3:"obj":'.strlen($inner).':{'.$inner.'}i:1;R:4;}';
$data = unserialize($exploit);
for ($i = 0; $i < 5; $i++) {
    $v[$i] = 'hi'.$i;
}
var_dump($data);
?>
<?php
enum Foo {
    case Bar;
    public function __sleep(): array {
    }
}
?>
--EXTENSIONS--
session
--EXPECTF--
Warning: session_decode(): Failed to decode session object. Session has been destroyed in %s on line %d
Warning: unserialize(): Error at offset 55 of 56 bytes in %s on line %d
bool(false)
Fatal error: Enum Foo cannot include magic method __sleep in %s on line %d

Resulted in this output:

AddressSanitizer:DEADLYSIGNAL
=================================================================
==491976==ERROR: AddressSanitizer: SEGV on unknown address 0x7ffd00000042 (pc 0x7f26f2481205 bp 0x0000ffffffff sp 0x7ffdf94bc550 T0)
==491976==The signal is caused by a READ memory access.
    #0 0x7f26f2481205 in _longjmp (/lib/x86_64-linux-gnu/libc.so.6+0x42205) (BuildId: c289da5071a3399de893d2af81d6a30c62646e1e)
    #1 0x565537b6fad8 in _zend_bailout /WorkSpace/php-src/Zend/zend.c:1226:2
    #2 0x565536dd1c3f in php_session_decode /WorkSpace/php-src/ext/session/session.c:282:3
    #3 0x7f26ed27f59f  (<unknown module>)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/lib/x86_64-linux-gnu/libc.so.6+0x42205) (BuildId: c289da5071a3399de893d2af81d6a30c62646e1e) in _longjmp

PHP Version

PHP 8.4.0-dev

Operating System

ubuntu 22.04

Activity

  1. YuanchengJiang commented on Mar 12, 2024

    @YuanchengJiang
    Author

    A simplified code:

    <?php
    ob_start();
    ini_set("session.serialize_handler", "php_serialize");
    session_start();
    $result1 = session_decode('foo|s:3:"bar";');
    class Test extends DateTime {
        public static function createFromFormat($format, $datetime, $timezone = null): Wrong { }
    }
    ?>
    

    To reproduce just php test.php (asan enabled)

  2. ndossche commented on Mar 12, 2024

    @ndossche
    Member

    Thanks for the report. This is related to session decode changes to prevent writing incomplete sessions. I'll have a look tonight.

  3. self-assigned this
    on Mar 12, 2024
  4. added a commit that references this issue on Mar 12, 2024
    1ed0e16
  5. added 2 commits that reference this issue on Mar 13, 2024
    6985aff
    b58dc6f
  6. added a commit that references this issue on Mar 13, 2024
    8793f99
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions