Bug #76167 [Opn->Ver]: mbstring may use/efree() pointer from some previous request

Edit report at https://bugs.php.net/bug.php?id=76167&edit=1 ID: 76167 Updated by: cmb@php.net Reported by: cataphract@php.net Summary: mbstring may use/efree() pointer from some previous request -Status: Open +Status: Verified Type: Bug Package: mbstring related Operating System: irrelevant PHP Version: 5.6.35 -Assigned To: +Assigned To: cmb Block user comment: N Private report: N Previous Comments: ------------------------------------------------------------------------ [2018-03-30 11:25:51] cataphract@php.net Description: ------------ mbstring seems to assume that calls to rinit are matched with calls to rshutdown, but this may not be case. In particular, if another extension fails its rinit (after mbstring has run its), either by returning FAILURE or calling zend_error(), then rshutdown will never be called, as PG(modules_activated) will be 0. when mbstring_globals.current_detect_order_list is allocated a pointer, this pointer is freed in rshutdown: PHP_RSHUTDOWN_FUNCTION(mbstring) { const struct mb_overload_def *p; zend_function *orig; if (MBSTRG(current_detect_order_list) != NULL) { efree(MBSTRG(current_detect_order_list)); MBSTRG(current_detect_order_list) = NULL; MBSTRG(current_detect_order_list_size) = 0; } At this point, the pointer stored by current_detect_order_list may not be valid anymore, because it may have come from another request. This is because the per-request initialization of current_detect_order_list is not unconditional: static void php_mb_populate_current_detect_order_list(TSRMLS_D) { const mbfl_encoding **entry = 0; size_t nentries; if (MBSTRG(current_detect_order_list)) { return; } If current_detect_order_list is filled with an invalid pointer from a previous request, it will stay so. php_mb_populate_current_detect_order_list() is called from RINIT. Solution: make php_mb_populate_current_detect_order_list() execute unconditionally. Expected result: ---------------- no crash Actual result: -------------- gdb session (line numbers are for 5.6.31, but it also happens in 5.6.35): Hardware watchpoint 1: *mbstring_globals.current_detect_order_list Breakpoint 2 at 0x7f841794defe: file /tmp/php/ext/mbstring/mbstring.c, line 4620. Breakpoint 3 at 0x7f8421d8350a: file /tmp/php/main/main.c, line 1617. Breakpoint 4 at 0x7f8421d83c16: file /tmp/php/main/main.c, line 1819. Breakpoint 5 at 0x7f84179420bb: file /tmp/php/ext/mbstring/mbstring.c, line 1662. (gdb) c Continuing. Breakpoint 3, php_request_startup () at /tmp/php/main/main.c:1617 1617 { (gdb) Continuing. Breakpoint 2, php_mb_populate_current_detect_order_list () at /tmp/php/ext/mbstring/mbstring.c:4620 4620 const mbfl_encoding **entry = 0; (gdb) Continuing. Hardware watchpoint 1: *mbstring_globals.current_detect_order_list Old value = <unreadable> New value = (const mbfl_encoding *) 0x7f8417c6bb20 <mbfl_encoding_ascii> php_mb_populate_current_detect_order_list () at /tmp/php/ext/mbstring/mbstring.c:4641 4641 MBSTRG(current_detect_order_list_size) = nentries; (gdb) Continuing. Breakpoint 4, php_request_shutdown (dummy=0x0) at /tmp/php/main/main.c:1819 1819 { (gdb) Continuing. Breakpoint 3, php_request_startup () at /tmp/php/main/main.c:1617 1617 { (gdb) Continuing. Breakpoint 2, php_mb_populate_current_detect_order_list () at /tmp/php/ext/mbstring/mbstring.c:4620 4620 const mbfl_encoding **entry = 0; (gdb) Continuing. Hardware watchpoint 1: *mbstring_globals.current_detect_order_list Old value = (const mbfl_encoding *) 0x7f8417c6bb20 <mbfl_encoding_ascii> New value = (const mbfl_encoding *) 0x7f8425baebb0 _array_init (arg=0x7f8425baeb38, size=0, __zend_filename=0x7f8421fd7a4e "/tmp/php/main/php_variables.c", __zend_lineno=630) at /tmp/php/Zend/zend_API.c:1013 1013 _zend_hash_init(Z_ARRVAL_P(arg), size, ZVAL_PTR_DTOR, 0 ZEND_FILE_LINE_RELAY_CC); (gdb) Continuing. Breakpoint 4, php_request_shutdown (dummy=0x0) at /tmp/php/main/main.c:1819 1819 { (gdb) Continuing. Hardware watchpoint 1: *mbstring_globals.current_detect_order_list Old value = (const mbfl_encoding *) 0x7f8425baebb0 New value = (const mbfl_encoding *) 0x5a5a5a5a5a5a5a5a __memset_avx2 () at ../sysdeps/x86_64/multiarch/memset-avx2.S:86 86 ../sysdeps/x86_64/multiarch/memset-avx2.S: No such file or directory. (gdb) Continuing. Breakpoint 3, php_request_startup () at /tmp/php/main/main.c:1617 1617 { (gdb) Continuing. Hardware watchpoint 1: *mbstring_globals.current_detect_order_list Old value = (const mbfl_encoding *) 0x5a5a5a5a5a5a5a5a New value = (const mbfl_encoding *) 0x0 __memset_avx2 () at ../sysdeps/x86_64/multiarch/memset-avx2.S:144 144 ../sysdeps/x86_64/multiarch/memset-avx2.S: No such file or directory. (gdb) Continuing. Breakpoint 2, php_mb_populate_current_detect_order_list () at /tmp/php/ext/mbstring/mbstring.c:4620 4620 const mbfl_encoding **entry = 0; (gdb) Continuing. Breakpoint 4, php_request_shutdown (dummy=0x0) at /tmp/php/main/main.c:1819 1819 { (gdb) Continuing. Breakpoint 5, zm_deactivate_mbstring (type=1, module_number=24) at /tmp/php/ext/mbstring/mbstring.c:1662 1662 { (gdb) Continuing. Program received signal SIGSEGV, Segmentation fault. 0x00007f8421de5a94 in zend_mm_check_ptr (heap=0x55b843b361d0, ptr=0x7f8425baeb38, silent=0, __zend_filename=0x7f8417a50328 "/tmp/php/ext/mbstring/mbstring.c", __zend_lineno=1667, __zend_orig_filename=0x0, __zend_orig_lineno=0) at /tmp/php/Zend/zend_alloc.c:1393 1393 ZEND_MM_PREV_BLOCK(p)->info._size != p->info._prev) { ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=76167&edit=1