Repository navigation
Segmentation fault ext/phar/phar.c #17137
Description
Description
The following code:
<?php
$file = __DIR__ . DIRECTORY_SEPARATOR . 'bug66960.phar';
$phar = new Phar($file);
$phar->decompress();
try {ldap_get_values_len($fname,$fname,$phar);} catch (Exception $e) { echo($e); }Resulted in this output:
=================================================================
==2919611==ERROR: AddressSanitizer: SEGV on unknown address (pc 0x000003b7a9f3 bp 0x7ffcd7e1b600 sp 0x7ffcd7e1b540 T0)
==2919611==The signal is caused by a READ memory access.
==2919611==Hint: this fault was caused by a dereference of a high value address (see register values below). Disassemble the provided pc to learn which register was used.
#0 0x3b7a9f3 in zend_mm_free_heap /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_alloc.c:1528:28
#1 0x3b80758 in _efree /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_alloc.c:2751:2
#2 0x21bc898 in phar_destroy_phar_data /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/phar/phar.c:198:3
#3 0x21bf3b6 in phar_archive_delref /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/phar/phar.c:255:4
#4 0x21a338c in phar_spl_foreign_dtor /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/phar/phar_object.c:1082:3
#5 0x2aa994a in spl_filesystem_object_free_storage /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/spl/spl_directory.c:144:3
#6 0x4baa881 in zend_objects_store_del /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_objects_API.c:194:4
#7 0x4cbb487 in rc_dtor_func /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_variables.c:57:2
#8 0x4cbb70e in i_zval_ptr_dtor /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_variables.h:45:4
#9 0x4cbb4c4 in zval_ptr_dtor /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_variables.c:84:2
#10 0x47f1e21 in _zend_hash_del_el_ex /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_hash.c:1487:3
#11 0x47ef59d in _zend_hash_del_el /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_hash.c:1514:2
#12 0x4808ee4 in zend_hash_reverse_apply /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_hash.c:2230:5
#13 0x3eeae7c in shutdown_destructors /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_execute_API.c:262:4
#14 0x4d03c1b in zend_call_destructors /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend.c:1332:3
#15 0x35151e8 in php_request_shutdown /home/phpfuzz/WorkSpace/flowfusion/php-src/main/main.c:1914:3
#16 0x4d2c957 in do_cli /home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php_cli.c:1109:3
#17 0x4d2380f in main /home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php_cli.c:1313:18
#18 0x7fe732450d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#19 0x7fe732450e3f in __libc_start_main csu/../csu/libc-start.c:392:3
#20 0x605934 in _start (/home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php+0x605934)
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_alloc.c:1528:28 in zend_mm_free_heap
==2919611==ABORTING
To reproduce:
-d "phar.readonly=0"
Dependency: bug66960.phar
PHP Version
nightly
Operating System
ubuntu 22.04
Activity
devnexen commentedon Dec 13, 2024
got different asan report but still crash regardless
AddressSanitizer:DEADLYSIGNAL ================================================================= ==68607==ERROR: AddressSanitizer: SEGV on unknown address 0x000108400000 (pc 0x000181ca3f54 bp 0x00016d3a7d30 sp 0x00016d3a74e0 T0) ==68607==The signal is caused by a READ memory access. #0 0x181ca3f54 in _platform_memmove+0x1a4 (libsystem_platform.dylib:arm64e+0x3f54) #1 0x10414a8dc in zend_inline_hash_func zend_string.h:474 #2 0x10414b1f0 in zend_hash_str_del zend_hash.c:1672 #3 0x10334da1c in phar_archive_delref phar.c:254 #4 0x103340f6c in phar_spl_foreign_dtor phar_object.c:1082 #5 0x103564efc in spl_filesystem_object_free_storage spl_directory.c:144 #6 0x10427e0c0 in zend_objects_store_del zend_objects_API.c:194 #7 0x1042f99c4 in rc_dtor_func zend_variables.c:57 #8 0x1042f9b00 in i_zval_ptr_dtor zend_variables.h:45 #9 0x1042f9a04 in zval_ptr_dtor zend_variables.c:84 #10 0x104149414 in _zend_hash_del_el_ex zend_hash.c:1487 #11 0x1041481b8 in _zend_hash_del_el zend_hash.c:1514 #12 0x104152bf8 in zend_hash_reverse_apply zend_hash.c:2230 #13 0x103e00b70 in shutdown_destructors zend_execute_API.c:262 #14 0x104318524 in zend_call_destructors zend.c:1332 #15 0x1039bfd18 in php_request_shutdown main.c:1914 #16 0x104329a68 in do_cli php_cli.c:1109 #17 0x104325144 in main php_cli.c:1313 #18 0x1818ec270 (<unknown module>) ==68607==Register values: x[0] = 0x000000016d3a7d60 x[1] = 0x0000000108400000 x[2] = 0x0000000000000000 x[3] = 0x000000016d3a7d60 x[4] = 0x0000000000000000 x[5] = 0x0000000000000000 x[6] = 0x0000000000000000 x[7] = 0x0000000000000001 x[8] = 0x000000702da94fac x[9] = 0x0000000000000000 x[10] = 0x000000702da94fac x[11] = 0x000000002da74fac x[12] = 0x000000002da74fac x[13] = 0x0000000000000000 x[14] = 0xf3f3f300f1f1f1f1 x[15] = 0x000000016d3a8d00 x[16] = 0x0000000181ca3db0 x[17] = 0x0000000106db05d0 x[18] = 0x0000000000000000 x[19] = 0x0000000000000008 x[20] = 0x0000000108400000 x[21] = 0x000000016d3a7d60 x[22] = 0x0000000108400000 x[23] = 0x00000001077990a8 x[24] = 0xffffffffffffffc7 x[25] = 0x0000000000000000 x[26] = 0x0000000000000000 x[27] = 0x0000000000000000 x[28] = 0x0000000000000000 fp = 0x000000016d3a7d30 lr = 0x0000000106d599b0 sp = 0x000000016d3a74e0 AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV (libsystem_platform.dylib:arm64e+0x3f54) in _platform_memmove+0x1a4 ==68607==ABORTING zsh: abort sapi/cli/php -d "phar.readonly=0" ~/a.phpndossche commentedon Dec 13, 2024
This is caused by edae243, which really looks like a weird patch honestly, I'll take a look.
cmb69 commentedon Dec 13, 2024
Beat me by a minute. :)
Fix phpGH-17137: Segmentation fault ext/phar/phar.c
Merge branch 'PHP-8.3' into PHP-8.4
Merge branch 'PHP-8.4'
Fix GH-17137: Segmentation fault ext/phar/phar.c