UAF in array_splice

Description

The following code:

<?php
function resize_arr() {
    global $arr;
    for ($i = 0; $i < 10; $i++) {
        $arr[$i] = $i;
    }
}

class C {
    function __destruct() {
        resize_arr();
        return "3";
    }
}

$arr = ["a" => "1", "3" => new C, "2" => "2"];

array_splice($arr, 1, 2);

Resulted in this output:

==1989996==ERROR: AddressSanitizer: heap-use-after-free on address 0x61200002d9c8 at pc 0x557ef6a96fa9 bp 0x7ffc86af56c0 sp 0x7ffc86af56b8
READ of size 1 at 0x61200002d9c8 thread T0
    #0 0x557ef6a96fa8 in zval_get_type /tmp/php-asan/Zend/zend_types.h:650:18
    #1 0x557ef6ace736 in php_splice /tmp/php-asan/ext/standard/array.c:3457:9
    #2 0x557ef6acd4a0 in zif_array_splice /tmp/php-asan/ext/standard/array.c:3831:2
    #3 0x557ef734ebc2 in ZEND_DO_ICALL_SPEC_RETVAL_UNUSED_HANDLER /tmp/php-asan/Zend/zend_vm_execute.h:1299:2
    #4 0x557ef71b183d in execute_ex /tmp/php-asan/Zend/zend_vm_execute.h:58565:7
    #5 0x557ef71b2067 in zend_execute /tmp/php-asan/Zend/zend_vm_execute.h:64217:2
    #6 0x557ef75e6860 in zend_execute_script /tmp/php-asan/Zend/zend.c:1932:3
    #7 0x557ef6e04d2b in php_execute_script_ex /tmp/php-asan/main/main.c:2574:13
    #8 0x557ef6e05228 in php_execute_script /tmp/php-asan/main/main.c:2614:9
    #9 0x557ef75ee309 in do_cli /tmp/php-asan/sapi/cli/php_cli.c:935:5
    #10 0x557ef75eb32c in main /tmp/php-asan/sapi/cli/php_cli.c:1310:18
    #11 0x7fd70f229d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #12 0x7fd70f229e3f in __libc_start_main csu/../csu/libc-start.c:392:3
    #13 0x557ef6002de4 in _start (/workspaces/TriFuzz/targets/php-asan/bin/php+0x402de4)

0x61200002d9c8 is located 136 bytes inside of 320-byte region [0x61200002d940,0x61200002da80)
freed by thread T0 here:
    #0 0x557ef6087702 in free /opt/llvm-15-build/llvm-15.x/final/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3
    #1 0x557ef70418a3 in __zend_free /tmp/php-asan/Zend/zend_alloc.c:3308:2
    #2 0x557ef7045774 in _efree /tmp/php-asan/Zend/zend_alloc.c:2747:3
    #3 0x557ef746fed8 in zend_hash_do_resize /tmp/php-asan/Zend/zend_hash.c:1321:3
    #4 0x557ef745a240 in _zend_hash_index_add_or_update_i /tmp/php-asan/Zend/zend_hash.c:1168:3
    #5 0x557ef745a8f5 in zend_hash_index_lookup /tmp/php-asan/Zend/zend_hash.c:1236:9
    #6 0x557ef73ee1c5 in zend_fetch_dimension_address_inner /tmp/php-asan/Zend/zend_execute.c:2698:4
    #7 0x557ef73f92ce in zend_fetch_dimension_address_inner_W /tmp/php-asan/Zend/zend_execute.c:2755:9
    #8 0x557ef72171f8 in ZEND_ASSIGN_DIM_SPEC_CV_CV_OP_DATA_CV_HANDLER /tmp/php-asan/Zend/zend_vm_execute.h:53879:20
    #9 0x557ef71b183d in execute_ex /tmp/php-asan/Zend/zend_vm_execute.h:58565:7
    #10 0x557ef718d1ac in zend_call_function /tmp/php-asan/Zend/zend_execute_API.c:996:3
    #11 0x557ef718f3b2 in zend_call_known_function /tmp/php-asan/Zend/zend_execute_API.c:1090:23
    #12 0x557ef7564aca in zend_call_known_instance_method /tmp/php-asan/Zend/zend_API.h:860:2
    #13 0x557ef7562e6b in zend_call_known_instance_method_with_0_params /tmp/php-asan/Zend/zend_API.h:866:2
    #14 0x557ef7562b31 in zend_objects_destroy_object /tmp/php-asan/Zend/zend_objects.c:194:3
    #15 0x557ef75608a2 in zend_objects_store_del /tmp/php-asan/Zend/zend_objects_API.c:179:4
    #16 0x557ef75c75b6 in rc_dtor_func /tmp/php-asan/Zend/zend_variables.c:57:2
    #17 0x557ef75c76a4 in i_zval_ptr_dtor /tmp/php-asan/Zend/zend_variables.h:45:4
    #18 0x557ef75c75f4 in zval_ptr_dtor /tmp/php-asan/Zend/zend_variables.c:84:2
    #19 0x557ef745d919 in _zend_hash_del_el_ex /tmp/php-asan/Zend/zend_hash.c:1487:3
    #20 0x557ef745c9ea in _zend_hash_del_el /tmp/php-asan/Zend/zend_hash.c:1514:2
    #21 0x557ef745c6c5 in zend_hash_del_bucket /tmp/php-asan/Zend/zend_hash.c:1531:2
    #22 0x557ef6ace769 in php_splice /tmp/php-asan/ext/standard/array.c:3459:5
    #23 0x557ef6acd4a0 in zif_array_splice /tmp/php-asan/ext/standard/array.c:3831:2
    #24 0x557ef734ebc2 in ZEND_DO_ICALL_SPEC_RETVAL_UNUSED_HANDLER /tmp/php-asan/Zend/zend_vm_execute.h:1299:2
    #25 0x557ef71b183d in execute_ex /tmp/php-asan/Zend/zend_vm_execute.h:58565:7
    #26 0x557ef71b2067 in zend_execute /tmp/php-asan/Zend/zend_vm_execute.h:64217:2
    #27 0x557ef75e6860 in zend_execute_script /tmp/php-asan/Zend/zend.c:1932:3
    #28 0x557ef6e04d2b in php_execute_script_ex /tmp/php-asan/main/main.c:2574:13
    #29 0x557ef6e05228 in php_execute_script /tmp/php-asan/main/main.c:2614:9

previously allocated by thread T0 here:
    #0 0x557ef60879ae in malloc /opt/llvm-15-build/llvm-15.x/final/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3
    #1 0x557ef7045ce3 in __zend_malloc /tmp/php-asan/Zend/zend_alloc.c:3280:14
    #2 0x557ef7045670 in _emalloc /tmp/php-asan/Zend/zend_alloc.c:2737:10
    #3 0x557ef744b5bf in zend_hash_real_init_mixed_ex /tmp/php-asan/Zend/zend_hash.c:177:10
    #4 0x557ef744b3f7 in zend_hash_real_init_mixed /tmp/php-asan/Zend/zend_hash.c:343:2
    #5 0x557ef72b1c48 in ZEND_INIT_ARRAY_SPEC_CONST_CONST_HANDLER /tmp/php-asan/Zend/zend_vm_execute.h:7770:4
    #6 0x557ef71b183d in execute_ex /tmp/php-asan/Zend/zend_vm_execute.h:58565:7
    #7 0x557ef71b2067 in zend_execute /tmp/php-asan/Zend/zend_vm_execute.h:64217:2
    #8 0x557ef75e6860 in zend_execute_script /tmp/php-asan/Zend/zend.c:1932:3
    #9 0x557ef6e04d2b in php_execute_script_ex /tmp/php-asan/main/main.c:2574:13
    #10 0x557ef6e05228 in php_execute_script /tmp/php-asan/main/main.c:2614:9
    #11 0x557ef75ee309 in do_cli /tmp/php-asan/sapi/cli/php_cli.c:935:5
    #12 0x557ef75eb32c in main /tmp/php-asan/sapi/cli/php_cli.c:1310:18
    #13 0x7fd70f229d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16

SUMMARY: AddressSanitizer: heap-use-after-free /tmp/php-asan/Zend/zend_types.h:650:18 in zval_get_type
Shadow bytes around the buggy address:
  0x0c247fffdae0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c247fffdaf0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c247fffdb00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c247fffdb10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c247fffdb20: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
=>0x0c247fffdb30: fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd fd fd
  0x0c247fffdb40: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c247fffdb50: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c247fffdb60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c247fffdb70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c247fffdb80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==1989996==ABORTING

Requires USE_ZEND_ALLOC=0

PHP Version

PHP 8.5.0-dev

Operating System

No response

I'm closing as duplicate of #16648; while a different function, the root cause is the same.

I would probably keep this open. I don't think there's a shared code-path where this could be solved in a general way, so this will likely need two separate fixes.

Merge branch 'PHP-8.3' into PHP-8.4

Merge branch 'PHP-8.4'

Fix GH-16649: Avoid UAF when using array_splice

Navigation Menu

Repository navigation

UAF in array_splice #16649

Description

PHP Version

Operating System

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

UAF in array_splice #16649

Description

Description

PHP Version

Operating System

Activity

cmb69 commented on Oct 30, 2024

iluuu1994 commented on Oct 31, 2024

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions