Bug #80964 [NEW]: A use after free bug in ext/phar/phar.c

From: lylgood at foxmail dot com Operating system: All PHP version: master-Git-2021-04-18 (Git) Package: *Extensibility Functions Bug Type: Bug Bug description:A use after free bug in ext/phar/phar.c Description: ------------ File: ext/phar/phar.c Bug Function: phar_entry_remove In function phar_entry_remove, idata->phar is assigned to phar at line 419. The idata->phar could be freed at line 430 by calling phar_entry_delref(idata)->phar_archive_delref(idata->phar)->phar_destroy_phar_data(phar). Whereas the freed idata->phar is dereferenced via phar->donotflus at line 433, which causes a use after free bug. Test script: --------------- 419: phar = idata->phar; if (idata->internal_file->fp_refcount < 2) { if (idata->fp && idata->fp != idata->phar->fp && idata->fp != idata->phar->ufp && idata->fp != idata->internal_file->fp) { php_stream_close(idata->fp); } zend_hash_str_del(&idata->phar->manifest, idata->internal_file->filename, idata->internal_file->filename_len); idata->phar->refcount--; efree(idata); } else { idata->internal_file->is_deleted = 1; 430: phar_entry_delref(idata); // idata->phar freed here ! } 433: if (!phar->donotflush) { // use after free here! -- Edit bug report at https://bugs.php.net/bug.php?id=80964&edit=1 -- Fix committed: https://bugs.php.net/fix.php?id=80964&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=80964&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=80964&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=80964&r=needscript Try newer version: https://bugs.php.net/fix.php?id=80964&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=80964&r=support Expected behavior: https://bugs.php.net/fix.php?id=80964&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=80964&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=80964&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=80964&r=globals PHP version support discontinued: https://bugs.php.net/fix.php?id=80964&r=phptooold Daylight Savings: https://bugs.php.net/fix.php?id=80964&r=dst IIS Stability: https://bugs.php.net/fix.php?id=80964&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=80964&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=80964&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=80964&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=80964&r=mysqlcfg