Bug #80173 [NEW]: Using return value of zend_assign_to_variable() is not safe
From: nikic
Operating system:
PHP version: 7.4.11
Package: Scripting Engine problem
Bug Type: Bug
Bug description:Using return value of zend_assign_to_variable() is not safe
Description:
------------
Reduced from oss-fuzz #25840:
<?php
$a = new stdClass;
$a->a =& $a;
var_dump($a->a = 0);
zend_assign_to_variable() returns variable_ptr, which might be destroyed
by the assignment.
The root cause here is the same as in bug #80100, but the reproducer is
more fundamental.
Probably the only way to address this is to add a separate version of
zend_assign_to_variable() that accepts a zval to copy the value into,
and perform that copy before disposing garbage.
--
Edit bug report at https://bugs.php.net/bug.php?id=80173&edit=1
--
Fix committed: https://bugs.php.net/fix.php?id=80173&r=fixed
Fixed in release: https://bugs.php.net/fix.php?id=80173&r=alreadyfixed
Need backtrace: https://bugs.php.net/fix.php?id=80173&r=needtrace
Need Reproduce Script: https://bugs.php.net/fix.php?id=80173&r=needscript
Try newer version: https://bugs.php.net/fix.php?id=80173&r=oldversion
Not developer issue: https://bugs.php.net/fix.php?id=80173&r=support
Expected behavior: https://bugs.php.net/fix.php?id=80173&r=notwrong
Not enough info: https://bugs.php.net/fix.php?id=80173&r=notenoughinfo
Submitted twice: https://bugs.php.net/fix.php?id=80173&r=submittedtwice
register_globals: https://bugs.php.net/fix.php?id=80173&r=globals
PHP version support discontinued: https://bugs.php.net/fix.php?id=80173&r=phptooold
Daylight Savings: https://bugs.php.net/fix.php?id=80173&r=dst
IIS Stability: https://bugs.php.net/fix.php?id=80173&r=isapi
Install GNU Sed: https://bugs.php.net/fix.php?id=80173&r=gnused
Floating point limitations: https://bugs.php.net/fix.php?id=80173&r=float
No Zend Extensions: https://bugs.php.net/fix.php?id=80173&r=nozend
MySQL Configuration Error: https://bugs.php.net/fix.php?id=80173&r=mysqlcfg
Thread (2 messages)
- nikic@php.net