[php-src] Issue #10346: Potential crash in enum tryFrom() with observers

From: Date: Mon, 16 Jan 2023 17:42:01 +0000
Subject: [php-src] Issue #10346: Potential crash in enum tryFrom() with observers
Groups: php.bugs 
Request: Send a blank email to php-bugs+get-243465@lists.php.net to get a copy of this message
Issue: https://github.com/php/php-src/issues/10346 Author: rioderelfte ### Description When zend observers are enabled, calling the tryFrom() method of enums might cause a crash. I was not yet able to create a small test case which actually does crash. However address sanitizer reports an issue for this test: ```phpt --TEST-- Observer: enum tryFrom() --EXTENSIONS-- zend_test --INI-- zend_test.observer.enabled=1 zend_test.observer.observe_all=1 --FILE-- <?php enum Card : string { case HEART = 'H'; } var_dump(Card::tryFrom('H')); ?> --EXPECTF-- <!-- init '%s' --> <file '%s'> <!-- init Card::tryFrom() --> <Card::tryFrom> </Card::tryFrom> <!-- init var_dump() --> <var_dump> enum(Card::HEART) </var_dump> </file '%s'> ``` On the current PHP 8.2 branch (commit 757e269b89930fc51406fcdf25c17b200db5fc9e) I get the following output when running that test with address sanitizer on a Mac: ``` <!-- init '/Users/florian/projects/php/php-src/ext/zend_test/tests/observer_enum_01.php' --> <file '/Users/florian/projects/php/php-src/ext/zend_test/tests/observer_enum_01.php'> AddressSanitizer:DEADLYSIGNAL ================================================================= ==2220==ERROR: AddressSanitizer: BUS on unknown address (pc 0x000108208150 bp 0x00016d1bf6d0 sp 0x00016d1bf570 T0) ==2220==The signal is caused by a UNKNOWN memory access. ==2220==Hint: this fault was caused by a dereference of a high value address (see register values below). Disassemble the provided pc to learn which register was used. #0 0x108208150 (<unknown module>) #1 0x103ad09a0 in zend_observer_fcall_begin zend_observer.c:258 #2 0x103888018 in ZEND_DO_FCALL_SPEC_OBSERVER_HANDLER zend_vm_execute.h:2058 #3 0x1037acb6c in execute_ex zend_vm_execute.h:55811 #4 0x1037ad468 in zend_execute zend_vm_execute.h:60384 #5 0x1036f6f70 in zend_execute_scripts zend.c:1780 #6 0x1034fb868 in php_execute_script main.c:2540 #7 0x103cb34c0 in do_cli php_cli.c:964 #8 0x103cb1260 in main php_cli.c:1333 #9 0x18e00fe4c (<unknown module>) ==2220==Register values: x[0] = 0x000000010820b110 x[1] = 0x000000010820b110 x[2] = 0x000000010825d3c0 x[3] = 0x0000000000000001 x[4] = 0x000000010828e000 x[5] = 0x0000000000000000 x[6] = 0x74735f7465735f5f x[7] = 0x0000000000000000 x[8] = 0x0000000108208150 x[9] = 0x0000000108208120 x[10] = 0x0000000000000001 x[11] = 0x000000010820b110 x[12] = 0x000000016d1bf748 x[13] = 0x000000016d1bf740 x[14] = 0x000000016d1bda80 x[15] = 0x0000000000000000 x[16] = 0x000000018e367c00 x[17] = 0x0000000104de85e0 x[18] = 0x0000000000000000 x[19] = 0x000000016d1bf780 x[20] = 0x0000000103cb095c x[21] = 0x00000001049a9c50 x[22] = 0x000000016d1c1d70 x[23] = 0x000000018e085000 x[24] = 0x00000001e9f0c3c0 x[25] = 0x0000000000000000 x[26] = 0x0000000000000000 x[27] = 0x0000000000000000 x[28] = 0x0000000000000000 fp = 0x000000016d1bf6d0 lr = 0x0000000103ad07f8 sp = 0x000000016d1bf570 AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: BUS (<unknown module>) ==2220==ABORTING Termsig=6 ``` The handler pointer of the tryFrom() method seems not to be properly initialized as NULL, so zend_observer_fcall_install is never called for that method: https://github.com/php/php-src/blob/8dabbda8bc2479db499e355e021561c75c2e59e1/Zend/zend_observer.c#L228-L230 ### PHP Version PHP 8.2.1 ### Operating System Mac OS 13.0.1

« previous php.bugs (#243465) next »