[php-src] Issue #10581: Heap use after free when converting exception to string.
| From: | Changochen | Date: | Tue, 14 Feb 2023 02:17:27 +0000 |
| Subject: | [php-src] Issue #10581: Heap use after free when converting exception to string. | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-243725@lists.php.net to get a copy of this message | ||
Issue: https://github.com/php/php-src/issues/10581
Author: Changochen
### Description
The following code:
```php
<?php
class a
{
function b()
{
return function () {};
}
function __destruct()
{
k;
}
}
$e = function ($c) {
yield;
};
$e = $e((new a())->b());
foreach ($e as $d);
```
Resulted in this output:
```
USE_TRACKED_ALLOC=1 USE_ZEND_ALLOC=0 ../php-src/asan/sapi/cli/php -f ./poc.php
=================================================================
==25494==ERROR: AddressSanitizer: heap-use-after-free on address 0x613000000218 at pc 0x555555fac8bd
bp 0x7fffffff96c0 sp 0x7fffffff96b0
READ of size 8 at 0x613000000218 thread T0
#0 0x555555fac8bc in _build_trace_args php-src/Zend/zend_exceptions.c:507
#1 0x555555fac8bc in _build_trace_string php-src/Zend/zend_exceptions.c:566
#2 0x555555fac8bc in zend_trace_to_string php-src/Zend/zend_exceptions.c:592
#3 0x555555fad60a in zim_Exception_getTraceAsString php-src/Zend/zend_exceptions.c:621
#4 0x555555d54402 in zend_call_function php-src/Zend/zend_execute_API.c:951
#5 0x555555fa8c09 in zim_Exception___toString php-src/Zend/zend_exceptions.c:666
#6 0x555555d54402 in zend_call_function php-src/Zend/zend_execute_API.c:951
#7 0x555555d566b2 in zend_call_known_function php-src/Zend/zend_execute_API.c:1032
#8 0x5555557f6677 in zend_call_known_instance_method php-src/Zend/zend_API.h:845
#9 0x5555557f6677 in zend_call_known_instance_method_with_0_params php-src/Zend/zend_API.h:851
#10 0x5555557f6677 in zend_exception_error php-src/Zend/zend_exceptions.c:899
#11 0x555555d85da0 in zend_execute_scripts php-src/Zend/zend.c:1852
#12 0x555555c56db8 in php_execute_script php-src/main/main.c:2481
#13 0x5555561111b0 in do_cli php-src/sapi/cli/php_cli.c:964
#14 0x555555811756 in main php-src/sapi/cli/php_cli.c:1333
#15 0x7ffff6089c86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21c86)
#16 0x555555811f49 in _start ( php-src/asan/sapi/cli/php+0x2bdf49)
```
Without
USE_TRACKED_ALLOC=1 USE_ZEND_ALLOC=0 php will exit without crashing.
### PHP Version
PHP 8.3.0-dev
### Operating System
_No response_