You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Segfault from ASan: SEGV on unknown address 0x7ffd00000042 #13680
--TEST--
ASan DEADLYSIGNAL SEGV on unknown address
--INI--
error_reporting=E_ALL&~E_DEPRECATED
--FILE--
<?php
class obj implements Serializable {
var $data;
function serialize() {
return serialize($this->data);
}
function unserialize($data) {
session_start();
session_decode($data);
}
}
$inner = 'ryat|a:1:{i:0;a:1:{i:1;';
$exploit = 'a:2:{i:0;C:3:"obj":'.strlen($inner).':{'.$inner.'}i:1;R:4;}';
$data = unserialize($exploit);
for ($i = 0; $i < 5; $i++) {
$v[$i] = 'hi'.$i;
}
var_dump($data);
?>
<?php
enum Foo {
case Bar;
public function __sleep(): array {
}
}
?>
--EXTENSIONS--
session
--EXPECTF--
Warning: session_decode(): Failed to decode session object. Session has been destroyed in %s on line %d
Warning: unserialize(): Error at offset 55 of 56 bytes in %s on line %d
bool(false)
Fatal error: Enum Foo cannot include magic method __sleep in %s on line %d
Resulted in this output:
AddressSanitizer:DEADLYSIGNAL
=================================================================
==491976==ERROR: AddressSanitizer: SEGV on unknown address 0x7ffd00000042 (pc 0x7f26f2481205 bp 0x0000ffffffff sp 0x7ffdf94bc550 T0)
==491976==The signal is caused by a READ memory access.
#0 0x7f26f2481205 in _longjmp (/lib/x86_64-linux-gnu/libc.so.6+0x42205) (BuildId: c289da5071a3399de893d2af81d6a30c62646e1e)
#1 0x565537b6fad8 in _zend_bailout /WorkSpace/php-src/Zend/zend.c:1226:2
#2 0x565536dd1c3f in php_session_decode /WorkSpace/php-src/ext/session/session.c:282:3
#3 0x7f26ed27f59f (<unknown module>)
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/lib/x86_64-linux-gnu/libc.so.6+0x42205) (BuildId: c289da5071a3399de893d2af81d6a30c62646e1e) in _longjmp
Activity
YuanchengJiang commentedon Mar 12, 2024
A simplified code:
To reproduce just
php test.php(asan enabled)ndossche commentedon Mar 12, 2024
Thanks for the report. This is related to session decode changes to prevent writing incomplete sessions. I'll have a look tonight.
Fix phpGH-13680: Segfault with session_decode and compilation error
Fix GH-13680: Segfault with session_decode and compilation error
Merge branch 'PHP-8.2' into PHP-8.3
Merge branch 'PHP-8.3'