[php-src] Issue #24159: sqlite3 UAF

Issue: https://github.com/php/php-src/issues/24159 Author: YuanchengJiang ### Description The following code: ```php <?php try { $db = new SQLite3(':memory:'); $db->exec('CREATE TABLE t (a INTEGER)'); $db->exec('INSERT INTO t VALUES (1)'); $db->createAggregate('agg', function ($context, $rows, $a) use (&$db, &$reported) { if (!$reported) { try { var_dump($db->close()); } catch (Throwable $e) { } } }, function ($context, $rows) { }, 1); $db = $db->prepare('SELECT agg(a) FROM t'); $res = $db->execute(); } catch (\Throwable $_ffl_e) {} ``` Resulted in this output: ``` ================================================================= ==3179922==ERROR: AddressSanitizer: heap-use-after-free on address 0x603000040400 at pc 0x000000dddd1d bp 0x7ffdac372270 sp 0x7ffdac372268 READ of size 1 at 0x603000040400 thread T0 #0 0xdddd1c in zval_get_type /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/Zend/zend_types.h:685:18 #1 0xddd556 in sqlite3_do_callback /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/ext/sqlite3/sqlite3.c:880:23 #2 0xda8f43 in php_sqlite3_callback_step /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/ext/sqlite3/sqlite3.c:912:2 #3 0x7f6b030a8259 in sqlite3VdbeExec (/lib/x86_64-linux-gnu/libsqlite3.so.0+0xde259) #4 0x7f6b030b2a2e in sqlite3_step (/lib/x86_64-linux-gnu/libsqlite3.so.0+0xe8a2e) #5 0xdbd018 in zim_SQLite3Stmt_execute /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/ext/sqlite3/sqlite3.c:1901:16 #6 0x60dd22e in ZEND_DO_FCALL_SPEC_OBSERVER_HANDLER /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/Zend/zend_vm_execute.h:2284:4 #7 0x2fd5067 in zend_jit_trace_execute /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/ext/opcache/jit/zend_jit_vm_helpers.c:1082:12 #8 0x2ffc9e5 in zend_jit_trace_hot_root /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/ext/opcache/jit/zend_jit_trace.c:8204:9 #9 0x2fc3903 in zend_jit_trace_counter_helper /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/ext/opcache/jit/zend_jit_vm_helpers.c:470:7 #10 0x2fc319a in zend_jit_func_trace_helper /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/ext/opcache/jit/zend_jit_vm_helpers.c:506:2 #11 0x5e8e9b7 in execute_ex /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/Zend/zend_vm_execute.h:110583:12 #12 0x5e90bf8 in zend_execute /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/Zend/zend_vm_execute.h:116021:2 #13 0x6ad321c in zend_execute_script /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/Zend/zend.c:1980:3 #14 0x53dd1fd in php_execute_script_ex /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/main/main.c:2590:13 #15 0x53de308 in php_execute_script /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/main/main.c:2630:9 #16 0x6ae5dd2 in do_cli /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/sapi/cli/php_cli.c:941:5 #17 0x6ae058a in do_php_cli /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/sapi/cli/php_cli.c:1354:18 #18 0x6ade991 in main /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/sapi/cli/php_cli_main.c:18:9 #19 0x7f6b0284ad8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16 #20 0x7f6b0284ae3f in __libc_start_main csu/../csu/libc-start.c:392:3 #21 0x605b34 in _start (/home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/sapi/cli/php+0x605b34) 0x603000040400 is located 16 bytes inside of 32-byte region [0x6030000403f0,0x603000040410) freed by thread T0 here: #0 0x680792 in free (/home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/sapi/cli/php+0x680792) #1 0x7f6b03060e91 in sqlite3_free (/lib/x86_64-linux-gnu/libsqlite3.so.0+0x96e91) previously allocated by thread T0 here: #0 0x6809fd in malloc (/home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/sapi/cli/php+0x6809fd) #1 0x7f6b0305c7ea (/lib/x86_64-linux-gnu/libsqlite3.so.0+0x927ea) SUMMARY: AddressSanitizer: heap-use-after-free /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/Zend/zend_types.h:685:18 in zval_get_type Shadow bytes around the buggy address: 0x0c0680000030: 00 00 00 fa fa fa fd fd fd fa fa fa fd fd fd fa 0x0c0680000040: fa fa fd fd fd fa fa fa fd fd fd fa fa fa fd fd 0x0c0680000050: fd fa fa fa fd fd fd fa fa fa fd fd fd fa fa fa 0x0c0680000060: fd fd fd fa fa fa 00 00 00 fa fa fa fd fd fd fd 0x0c0680000070: fa fa fd fd fd fd fa fa fd fd fd fd fa fa fd fd =>0x0c0680000080:[fd]fd fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c0680000090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c06800000a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c06800000b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c06800000c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c06800000d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Shadow gap: cc ==3179922==ABORTING ``` To reproduce: ``` /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/sapi/cli/php ./test.php ``` Commit: ``` 940ff2098ea4cbc1ce711a07df958f7d531e51fa ``` Configurations: ``` CC="clang-12" CXX="clang++-12" CFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" CXXFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" ./configure --enable-debug --enable-address-sanitizer --enable-undefined-sanitizer --enable-re2c-cgoto --enable-fpm --enable-litespeed --enable-phpdbg-debug --enable-zts --enable-bcmath --enable-calendar --enable-dba --enable-dl-test --enable-exif --enable-ftp --enable-gd --enable-gd-jis-conv --enable-mbstring --enable-pcntl --enable-shmop --enable-soap --enable-sockets --enable-sysvmsg --enable-zend-test --with-zlib --with-bz2 --with-curl --with-enchant --with-gettext --with-gmp --with-mhash --with-ldap --with-libedit --with-readline --with-snmp --with-sodium --with-xsl --with-zip --with-mysqli --with-pdo-mysql --with-pdo-pgsql --with-pgsql --with-sqlite3 --with-pdo-sqlite --with-webp --with-jpeg --with-freetype --enable-sigchild --with-readline --with-pcre-jit --with-iconv ``` Operating System: ``` Ubuntu 20.04 Host, Docker 0599jiangyc/flowfusion:latest ``` *This bug was found by [fusion-fuzz](https://github.com/fusion-fuzz/fusion-fuzz)* ### PHP Version ```plain 940ff2098ea4cbc1ce711a07df958f7d531e51fa ``` ### Operating System _No response_