Sec Bug->Bug #76410 [Ver]: SIGV in zend_mm_alloc_small

Edit report at https://bugs.php.net/bug.php?id=76410&edit=1 ID: 76410 Updated by: stas@php.net Reported by: daniel dot teuchert at rub dot de Summary: SIGV in zend_mm_alloc_small Status: Verified -Type: Security +Type: Bug Package: Arrays related Operating System: Linux/Ubuntu PHP Version: 7.2.6 Assigned To: dmitry Block user comment: N Private report: Y Previous Comments: ------------------------------------------------------------------------ [2018-06-03 16:10:51] cmb@php.net This does not appear to be particularly related to timezone_abbreviations_list(), since the following test script shows the same UAF issues under valgrind: <?php $b = array_flip(range('a', 'c')); debug_zval_dump($b); // just to check the refcount extract($b); Actually it does not matter how the array is created; it just needs to have the key 'b', and the debug_zval_dump() should show a refcount of 2. Apparently, the bad behavior has been intruced with commit 1f7bf2b[1]. Dmitry, could you please take at look at this issue? [1] <http://git.php.net/?p=php-src.git;a=commit;h=1f7bf2bfd63d94ddf4e28f903c692850232ef798> ------------------------------------------------------------------------ [2018-06-03 11:24:45] daniel dot teuchert at rub dot de Description: ------------ When executing the test script PHP crashes. Test script: --------------- <?php $b = timezone_abbreviations_list(); extract($b); timezone_abbreviations_list(); ?> Actual result: -------------- Backtrace: #0 0x0000000001918d3e in zend_mm_alloc_small (size=0, heap=<optimized out>, bin_num=<optimized out>) at Zend/zend_alloc.c:1273 #1 _emalloc_56 () at Zend/zend_alloc.c:2352 #2 0x0000000001a78a0f in _array_init (arg=0x7fffffff99a0, size=0) at Zend/zend_API.c:1090 #3 0x000000000051c220 in zif_timezone_abbreviations_list (execute_data=<optimized out>, return_value=<optimized out>) at ext/date/php_date.c:4830 #4 0x0000000001ea9d23 in ZEND_DO_ICALL_SPEC_RETVAL_UNUSED_HANDLER (execute_data=<optimized out>) at Zend/zend_vm_execute.h:573 #5 0x0000000001c126d6 in execute_ex (ex=<optimized out>) at Zend/zend_vm_execute.h:59723 #6 0x0000000001c1312f in zend_execute (op_array=<optimized out>, return_value=<optimized out>) at Zend/zend_vm_execute.h:63760 #7 0x0000000001a6678e in zend_execute_scripts (type=-3184, retval=0x0, file_count=<optimized out>) at Zend/zend.c:1496 #8 0x00000000017e108a in php_execute_script (primary_file=0x7fffffffc560) at main/main.c:2590 #9 0x000000000200dba7 in do_cli (argc=<optimized out>, argv=<optimized out>) at sapi/cli/php_cli.c:1011 #10 0x000000000200aa8d in main (argc=<optimized out>, argv=<optimized out>) at sapi/cli/php_cli.c:1404 ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=76410&edit=1