Bug #70182 [Asn]: Mem out-of-bounds write (segfault) in ZEND_ASSIGN_DIV_SPEC_CV_UNUSED_HANDLER

Edit report at https://bugs.php.net/bug.php?id=70182&edit=1 ID: 70182 Updated by: bwoebi@php.net Reported by: hugh at allthethings dot co dot nz Summary: Mem out-of-bounds write (segfault) in ZEND_ASSIGN_DIV_SPEC_CV_UNUSED_HANDLER Status: Assigned Type: Bug Package: Reproducible crash Operating System: Linux PHP Version: master-Git-2015-08-02 (Git) -Assigned To: dmitry +Assigned To: bwoebi Block user comment: N Private report: N New Comment: It depends on what was previously in memory before, so with luck you had a segfault here. Like it was the case with GCC -O3. But it also violates ZEND_ASSERT(Z_TYPE(rv) == IS_INDIRECT); assertion in zend_binary_assign_op_dim_helper. Fixing... Previous Comments: ------------------------------------------------------------------------ [2015-08-02 08:56:11] hugh at allthethings dot co dot nz Also can't reproduce this using clang ------------------------------------------------------------------------ [2015-08-02 08:34:00] hugh at allthethings dot co dot nz Just to note, that I used gcc 4.8.0 and 4.8.4, I can't reproduce this on gcc 4.7.2. ------------------------------------------------------------------------ [2015-08-02 07:52:55] hugh at allthethings dot co dot nz Description: ------------ Found this using afl-fuzz, see http://lcamtuf.coredump.cx/afl/ To reproduce, compile PHP with CFLAGS=-O3, then run ./sapi/cli/php with the test script <?php $a[]/=$a=a?> You should get a segfault. Bisected this crash back to commit 7a01c44ab268820c2365798fde0fe010cf6c5e20 which was the fix for bug #69905 (similar test case). The test case I found needed to have an array with an "assign-and-??" operator (/=, *=, +=, etc), combined with an assign operator, with a character on the RHS of the assignment. ($a[]/=$a=a). Traced the bug to the ZEND_ASSIGN_DIV_SPEC_CV_UNUSED_HANDLER assuming that the zend_fetch_dimension_address_RW method returned as INDIRECT type, but the patch for bug #69905 returned a NULL type (see Zend/zend_vm_execute.h line 33752 of commit 9f395b9e761a4d714e22366a63e9640cee461bd4). The assert is probably the reason why I needed -O3 in CFLAGS. Created a patch that applies cleanly to master, and makes no change in the "make test" run after recompilation. Test script: --------------- <?php $a[]/=$a=a?> Expected result: ---------------- Fatal error: Uncaught Error: [] operator not supported for strings in /root/php-crash-tmin:1 Stack trace: #0 {main} thrown in /root/php-crash-tmin on line 1 Actual result: -------------- (gdb) bt #0 zend_binary_assign_op_dim_helper_SPEC_CV_UNUSED (binary_op=<optimized out>) at /root/php-src/Zend/zend_vm_execute.h:33769 #1 ZEND_ASSIGN_DIV_SPEC_CV_UNUSED_HANDLER () at /root/php-src/Zend/zend_vm_execute.h:33860 #2 0x00000000006221fb in execute_ex (ex=<optimized out>) at /root/php-src/Zend/zend_vm_execute.h:406 #3 0x000000000067f4e9 in zend_execute (op_array=0x7ffff70690e0, return_value=0x90, return_value@entry=0x7ffff7014030) at /root/php-src/Zend/zend_vm_execute.h:450 #4 0x00000000005d9ea8 in zend_execute_scripts (type=type@entry=8, retval=0x7ffff7014030, retval@entry=0x0, file_count=file_count@entry=3) at /root/php-src/Zend/zend.c:1404 #5 0x00000000005678d0 in php_execute_script (primary_file=primary_file@entry=0x7fffffffd630) at /root/php-src/main/main.c:2475 #6 0x0000000000680c6b in do_cli (argc=2, argv=0xa8d780) at /root/php-src/sapi/cli/php_cli.c:971 #7 0x000000000041ed80 in main (argc=2, argv=0xa8d780) at /root/php-src/sapi/cli/php_cli.c:1338 (gdb) i r rax 0x4 4 rbx 0x700000009 30064771081 rcx 0x4 4 rdx 0x7ffff7073050 140737337831504 rsi 0x90 144 rdi 0x7ffff7073000 140737337831424 rbp 0x7ffff70140c0 0x7ffff70140c0 rsp 0x7fffffffb160 0x7fffffffb160 r8 0x200 512 r9 0x0 0 r10 0xac6390 11297680 r11 0x7ffff7476870 140737342040176 r12 0x7ffff70140c0 140737337442496 r13 0x0 0 r14 0x7ffff7014030 140737337442352 r15 0x7ffff70720e0 140737337827552 rip 0x670755 0x670755 <ZEND_ASSIGN_DIV_SPEC_CV_UNUSED_HANDLER+133> eflags 0x10206 [ PF IF RF ] cs 0x33 51 ss 0x2b 43 ds 0x0 0 es 0x0 0 fs 0x0 0 gs 0x0 0 (gdb) x/i $rip => 0x670755 <ZEND_ASSIGN_DIV_SPEC_CV_UNUSED_HANDLER+133>: movzbl 0x9(%rbx),%ecx ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=70182&edit=1