Bug #72162 [Opn->Csd]: use-after-free - error_reporting

Edit report at https://bugs.php.net/bug.php?id=72162&edit=1 ID: 72162 Updated by: laruence@php.net Reported by: shm@php.net Summary: use-after-free - error_reporting -Status: Open +Status: Closed Type: Bug Package: Reproducible crash PHP Version: 7.0.6 Block user comment: N Private report: N New Comment: Automatic comment on behalf of laruence@gmail.com Revision: http://git.php.net/?p=php-src.git;a=commit;h=9191862121411858036b0d2a06c3a99229c8bd24 Log: Fixed bug #72162 (use-after-free - error_reporting) Previous Comments: ------------------------------------------------------------------------ [2016-05-04 21:10:02] shm@php.net Description: ------------ Use after free condition can be triggered by simple script attached below. It's caused by call zend_string_release(): #1 0xea66f0 in _efree /home/shm/src/php-7.0.6/Zend/zend_alloc.c:2461 #2 0xf72839 in zend_string_release /home/shm/src/php-7.0.6/Zend/zend_string.h:271 #3 0xf773cc in zif_error_reporting /home/shm/src/php-7.0.6/Zend/zend_builtin_functions.c:730 in error_reporting function in case when DateTimeImmutable is supplied to the function. This can be turned in code execution. Test script: --------------- <?php error_reporting(1); $var11 = date_create_immutable(); $var16 = error_reporting($var11); Expected result: ---------------- Use-After-Free condition is avoided. Actual result: -------------- $ ./php error_reporting.php ================================================================= ==15187== ERROR: AddressSanitizer: heap-use-after-free on address 0x600600023235 at pc 0xf89a78 bp 0x7fff001c2ec0 sp 0x7fff001c2eb8 READ of size 1 at 0x600600023235 thread T0 #0 0xf89a77 in zend_string_release /home/shm/src/php-7.0.6/Zend/zend_string.h:269 #1 0xf8a1e5 in zend_restore_ini_entry_cb /home/shm/src/php-7.0.6/Zend/zend_ini.c:67 #2 0xf8a3b2 in zend_restore_ini_entry_wrapper /home/shm/src/php-7.0.6/Zend/zend_ini.c:82 #3 0xf697b9 in zend_hash_apply /home/shm/src/php-7.0.6/Zend/zend_hash.c:1534 #4 0xf8a6bf in zend_ini_deactivate /home/shm/src/php-7.0.6/Zend/zend_ini.c:142 #5 0xf2ed59 in zend_deactivate /home/shm/src/php-7.0.6/Zend/zend.c:970 #6 0xdbe28b in php_request_shutdown /home/shm/src/php-7.0.6/main/main.c:1833 #7 0x1149049 in do_cli /home/shm/src/php-7.0.6/sapi/cli/php_cli.c:1141 #8 0x114a6ed in main /home/shm/src/php-7.0.6/sapi/cli/php_cli.c:1344 #9 0x7fe19e111ec4 (/lib/x86_64-linux-gnu/libc.so.6+0x21ec4) #10 0x4247a8 in _start (/home/shm/src/php-7.0.6/sapi/cli/php+0x4247a8) 0x600600023235 is located 5 bytes inside of 32-byte region [0x600600023230,0x600600023250) freed by thread T0 here: #0 0x7fe19ef6533a (/usr/lib/x86_64-linux-gnu/libasan.so.0+0x1533a) #1 0xea66f0 in _efree /home/shm/src/php-7.0.6/Zend/zend_alloc.c:2461 #2 0xf72839 in zend_string_release /home/shm/src/php-7.0.6/Zend/zend_string.h:271 #3 0xf773cc in zif_error_reporting /home/shm/src/php-7.0.6/Zend/zend_builtin_functions.c:730 #4 0x101ced6 in ZEND_DO_ICALL_SPEC_HANDLER /home/shm/src/php-7.0.6/Zend/zend_vm_execute.h:586 #5 0x101bf4f in execute_ex /home/shm/src/php-7.0.6/Zend/zend_vm_execute.h:414 #6 0x101c1aa in zend_execute /home/shm/src/php-7.0.6/Zend/zend_vm_execute.h:458 #7 0xf31538 in zend_execute_scripts /home/shm/src/php-7.0.6/Zend/zend.c:1427 #8 0xdc0d02 in php_execute_script /home/shm/src/php-7.0.6/main/main.c:2494 #9 0x1148111 in do_cli /home/shm/src/php-7.0.6/sapi/cli/php_cli.c:974 #10 0x114a6ed in main /home/shm/src/php-7.0.6/sapi/cli/php_cli.c:1344 #11 0x7fe19e111ec4 (/lib/x86_64-linux-gnu/libc.so.6+0x21ec4) previously allocated by thread T0 here: #0 0x7fe19ef6541a (/usr/lib/x86_64-linux-gnu/libasan.so.0+0x1541a) #1 0xea6520 in _emalloc /home/shm/src/php-7.0.6/Zend/zend_alloc.c:2446 #2 0xf04758 in zend_string_alloc /home/shm/src/php-7.0.6/Zend/zend_string.h:121 #3 0xf04859 in zend_string_init /home/shm/src/php-7.0.6/Zend/zend_string.h:157 #4 0xf249e3 in zend_long_to_str /home/shm/src/php-7.0.6/Zend/zend_operators.c:2746 #5 0xf0c4a2 in _zval_get_string_func /home/shm/src/php-7.0.6/Zend/zend_operators.c:830 #6 0xf73187 in _zval_get_string /home/shm/src/php-7.0.6/Zend/zend_operators.h:266 #7 0xf773d8 in zif_error_reporting /home/shm/src/php-7.0.6/Zend/zend_builtin_functions.c:733 #8 0x101ced6 in ZEND_DO_ICALL_SPEC_HANDLER /home/shm/src/php-7.0.6/Zend/zend_vm_execute.h:586 #9 0x101bf4f in execute_ex /home/shm/src/php-7.0.6/Zend/zend_vm_execute.h:414 #10 0x101c1aa in zend_execute /home/shm/src/php-7.0.6/Zend/zend_vm_execute.h:458 #11 0xf31538 in zend_execute_scripts /home/shm/src/php-7.0.6/Zend/zend.c:1427 #12 0xdc0d02 in php_execute_script /home/shm/src/php-7.0.6/main/main.c:2494 #13 0x1148111 in do_cli /home/shm/src/php-7.0.6/sapi/cli/php_cli.c:974 #14 0x114a6ed in main /home/shm/src/php-7.0.6/sapi/cli/php_cli.c:1344 #15 0x7fe19e111ec4 (/lib/x86_64-linux-gnu/libc.so.6+0x21ec4) SUMMARY: AddressSanitizer: heap-use-after-free /home/shm/src/php-7.0.6/Zend/zend_string.h:269 zend_string_release Shadow bytes around the buggy address: 0x0c013fffc5f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c013fffc600: fa fa fa fa fa fa fa fa fa fa 00 00 00 01 fa fa 0x0c013fffc610: fd fd fd fd fa fa fd fd fd fd fa fa fd fd fd fd 0x0c013fffc620: fa fa fd fd fd fd fa fa fd fd fd fd fa fa fd fd 0x0c013fffc630: fd fd fa fa fd fd fd fd fa fa fd fd fd fa fa fa =>0x0c013fffc640: fd fd fd fa fa fa[fd]fd fd fd fa fa 00 00 00 fa 0x0c013fffc650: fa fa fd fd fd fd fa fa 00 00 00 00 fa fa 00 00 0x0c013fffc660: 00 00 fa fa fd fd fd fd fa fa fd fd fd fd fa fa 0x0c013fffc670: fd fd fd fd fa fa fd fd fd fd fa fa fd fd fd fd 0x0c013fffc680: fa fa fd fd fd fd fa fa fd fd fd fa fa fa fd fd 0x0c013fffc690: fd fa fa fa fd fd fd fa fa fa fd fd fd fd fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Heap righ redzone: fb Freed Heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack partial redzone: f4 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 ASan internal: fe ==15187== ABORTING Aborted ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=72162&edit=1