Bug #80966 [Opn->Fbk]: A potential use after free bug in ext/standard/browscap.c

Edit report at https://bugs.php.net/bug.php?id=80966&edit=1 ID: 80966 Updated by: cmb@php.net Reported by: lylgood at foxmail dot com Summary: A potential use after free bug in ext/standard/browscap.c -Status: Open +Status: Feedback Type: Bug Package: *Extensibility Functions Operating System: All PHP Version: master-Git-2021-04-18 (Git) -Assigned To: +Assigned To: cmb Block user comment: N Private report: N New Comment: That code looks correct to me, since the pattern is copied, so needs to be released if interning fails. Could you come up with a reproduce script showing the use-after-free? Previous Comments: ------------------------------------------------------------------------ [2021-04-18 07:32:45] lylgood at foxmail dot com Description: ------------ File: ext/standard/browscap.c Bug Function: php_browscap_parser_cb In function php_browscap_parser_cb, pattern is re-assigned by pattern = zend_new_interned_string() at line 368. Then if ZSTR_IS_INTERNED(pattern) is false, pattern will be freed via zend_string_release(pattern) at line 372. But after that, pattern is still used at line 378 by zend_hash_update_ptr(bdata->htab, pattern, entry), which is a use after free bug. Test script: --------------- if (persistent) { 368: pattern = zend_new_interned_string(zend_string_copy(pattern)); if (ZSTR_IS_INTERNED(pattern)) { Z_TYPE_FLAGS_P(arg1) = 0; } else { 372: zend_string_release(pattern); //pattern could be freed ! } } ... 378: zend_hash_update_ptr(bdata->htab, pattern, entry);//freed pattern is used ! ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=80966&edit=1