Skip to content

UAF in lexer with encoding translation and heredocs #16630

Closed
Closed
UAF in lexer with encoding translation and heredocs#16630
Assignees
ndossche
Labels
BugCategory: EngineStatus: Verified

Description

@YuanchengJiang
YuanchengJiang
opened on Oct 29, 2024

Description

The following code:

<?php
$data3 = <<<DATA
<meta <meta name="keywords" content="php documentation">
$data4 = <<<DATA
<meta name="author" content="name"
<meta name="keywords" content="php documentation"
DATA;
foreach ($array as $html) {
}

Resulted in this output:

php: /home/phpfuzz/WorkSpace/diffphp/php-src/Zend/zend_execute.c:4341: void i_init_code_execute_data(zend_execute_data *, zend_op_array *, zval *): Assertion `op_array->fn_flags & (1 << 26)' failed.

And JIT 1231:

/Zend/Optimizer/zend_optimizer.c:1187: void zend_revert_pass_two(zend_op_array *): Assertion `(op_array->fn_flags & (1 << 25)) != 0' failed.
Aborted (core dumped)

It can cause segfault:

<?php
$data3 = <<<CODE
<meta <meta name="keywords" content="php documentation">
<meta name="author" content="name"
<meta name="keywords" content="php documentation"
CODE;
foreach ($array as $html) {
}

while it does not segfault in JIT

PHP Version

nightly

Operating System

ubuntu 22.04

Activity

  1. YuanchengJiang
    added
    Bug
    Status: Needs Triage
    on Oct 29, 2024
  2. devnexen
    added
    Category: JIT
    Category: Engine
    Extension: opcache
    on Oct 29, 2024

  3. ndossche commented on Oct 29, 2024

    @ndossche
    ndossche
    on Oct 29, 2024
    Member

    I tried both NTS and ZTS debug builds. Neither the non-JIT nor JIT example reproduces for me.
    I just get:

    Warning: Undefined variable $array in /run/media/niels/MoreData/php-src-multitasking/x.php on line 7
Warning: foreach() argument must be of type array|object, null given in /run/media/niels/MoreData/php-src-multitasking/x.php on line 7

    Can you share the exact commit you tried this on, the configure options used, and the run options used please?

  4. ndossche
    added
    Status: Needs Feedback
    and removed
    Status: Needs Triage
    on Oct 29, 2024

  5. YuanchengJiang commented on Oct 30, 2024

    @YuanchengJiang
    YuanchengJiang
    on Oct 30, 2024
    Author

    sorry forgot to append the config.

    -d "zend.multibyte=On" -d "zend.script_encoding=ISO-8859-1" -d "internal_encoding=EUC-JP"

  6. github-actions
    added
    Status: Needs Triage
    and removed
    Status: Needs Feedback
    on Oct 30, 2024

  7. ndossche commented on Oct 30, 2024

    @ndossche
    ndossche
    on Oct 30, 2024
    Member

    That still doesn't reproduce anything for me.
    Is the reproduction code complete? The flag it asserts on makes me think that you're missing something related to closures, or nested functions...

  8. ndossche
    added
    Status: Needs Feedback
    and removed
    Status: Needs Triage
    on Oct 30, 2024

  9. YuanchengJiang commented on Nov 6, 2024

    @YuanchengJiang
    YuanchengJiang
    on Nov 6, 2024
    Author

    For the segv:

    <?php
$data3 = <<<CODE
<meta <meta name="keywords" content="php documentation">
<meta name="author" content="name"
<meta name="keywords" content="php documentation"
CODE;
foreach ($array as $html) {
}

    I just reproduced it in the latest commit. Compile:

    CC="clang-15" CXX="clang++-15" ./configure --enable-debug --enable-address-sanitizer --enable-undefined-sanitizer --enable-re2c-cgoto --enable-fpm --enable-litespeed --enable-phpdbg-debug --enable-zts --enable-bcmath --enable-calendar --enable-dba --enable-dl-test --enable-exif --enable-ftp --enable-gd --enable-gd-jis-conv --enable-mbstring --enable-pcntl --enable-shmop --enable-soap --enable-sockets --enable-sysvmsg --with-zlib --with-bz2 --with-curl --with-enchant --with-ffi --with-gettext --with-gmp --with-mhash --with-ldap --with-libedit --with-readline --with-snmp --with-sodium --with-xsl --with-zip

    Run: ./php-src/sapi/cli/php -d "zend.multibyte=On" -d "zend.script_encoding=ISO-8859-1" -d "internal_encoding=EUC-JP" /tmp/test.php

    Output:

    AddressSanitizer:DEADLYSIGNAL
=================================================================
==70762==ERROR: AddressSanitizer: SEGV on unknown address 0x7fc24a06e400 (pc 0x7fc24a06e400 bp 0x7ffc9f9c4f90 sp 0x7ffc9f9c4ec8 T0)
==70762==The signal is caused by a READ memory access.
==70762==Hint: PC is at a non-executable region. Maybe a wild jump?
    #0 0x7fc24a06e400  (<unknown module>)
    #1 0x56503f6e8f42 in zend_execute /php-src/Zend/zend_vm_execute.h:64217:2
    #2 0x5650403ea701 in zend_execute_script /php-src/Zend/zend.c:1934:3
    #3 0x56503ecf8238 in php_execute_script_ex /php-src/main/main.c:2574:13
    #4 0x56503ecf92f8 in php_execute_script /php-src/main/main.c:2614:9
    #5 0x5650403fde76 in do_cli /php-src/sapi/cli/php_cli.c:938:5
    #6 0x5650403f8544 in main /php-src/sapi/cli/php_cli.c:1313:18
    #7 0x7fc250155d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (<unknown module>) 
==70762==ABORTING

  10. 6 remaining items

  11. ndossche commented on Nov 6, 2024

    @ndossche
    ndossche
    on Nov 6, 2024
    Member

    This reproduces now, thanks.
    This is a lexer bug, unrelated to opcache or JIT.

  12. ndossche
    self-assigned this
    on Nov 6, 2024
  13. ndossche
    changed the title [-]Assertion failure in Zend/zend_execute.c:4341 and Zend/Optimizer/zend_optimizer.c:1187[/-] [+]UAF in lexer with encoding translation and heredocs[/+] on Nov 6, 2024
  14. ndossche
    added a commit that references this issue on Nov 6, 2024

    Fix phpGH-16630: UAF in lexer with encoding translation and heredocs

    472ce8c
  15. ndossche
    linked a pull request that will close this issueFix GH-16630: UAF in lexer with encoding translation and heredocs #16716on Nov 6, 2024
  16. ndossche
    closed this as completedin fc1db70on Nov 18, 2024
  17. ndossche
    added a commit that references this issue on Nov 18, 2024

    Merge branch 'PHP-8.4'

    dd4fc9a
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

BugCategory: EngineStatus: Verified

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions