ext/curl: build_mime_structure_from_hash(): hash iterator dangling after __toString-triggered rehash

Ouverte
  • Quelque chose ne va pas ?
#25,096 1 commentaire 0 réactions 0 personnes assignées Voir sur GitHub

Les mainteneurs répondent en général sous 1 jour

Personne n'a encore pris cette issue.

Évaluation

Difficulté
4/5
Temps estimé
3-5 jours
Accessibilité débutants
45/100
Type d'issue
Bug
Clarté
Clairement spécifiée
Activité
Active
Stack technique
c, php
Domaine
backend

Piste de recherche

Start in ext/curl/interface.c at the ZEND_HASH_FOREACH loops (lines 1568, 2168, 2399) where POSTFIELDS arrays are iterated. Read poc/01-postfields-rehash/poc.php and run it under AddressSanitizer to reproduce the heap-use-after-free. Fix by adding array separation or modification guards as suggested, then confirm ASan reports no error.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Description

Bug Status: Needs Triage
Description

Category: heap-use-after-free READ; CWE-416.
Context: curl_setopt(CURLOPT_POSTFIELDS, $arr) where $arr is a nested
array (['a' => &$sub]) whose inner array is shared with refcount 1, and a
value in the inner array is an object whose __toString() enlarges the
inner array, forcing a rehash while ZEND_HASH_FOREACH iterates it.

Observed: ASan reports heap-use-after-free READ in zval_get_type
(Zend/zend_types.h:685) at build_mime_structure_from_hash
(ext/curl/interface.c:1581), reached from _php_curl_setopt; the freed
320-byte region is the inner array's bucket storage (arData).

Relevant source: ext/curl/interface.c:1568 (ZEND_HASH_FOREACH over the
POSTFIELDS array), :1581 (zval_get_tmp_string invoking __toString);
same unprotected iteration pattern also present at :2168 (slist options)
and :2399 (curl_setopt_array).

Source assessment: the iteration holds no protection against the array
being modified from inside the string conversion callback; the rehash
frees the bucket array the iterator still points into.

Expected: hold a reference/separation on the traversed array, or detect
modification during iteration, as done elsewhere in the engine
(HASH_OF / HASH_PROTECT_RECURSION style guards).

Evidence: asan/CURL-01-postfields-rehash-uaf.asan.txt.
PoC: poc/01-postfields-rehash/poc.php. Note: the inner array must have
refcount 1 (reference-nested) — a top-level array is COW-protected.

CURL-01-postfields-rehash-uaf.asan.txt

poc.php

PHP Version
Component: ext/curl in php-src master, commit b9ea38ef639f5b9bbb67d27834be9c52b922520b (cloned 2026-10-21).
PHP: 8.7.0-dev (cli), NTS.
Platform: Linux x86-64 (Ubuntu 22.04 container, Docker), libcurl 7.81.
Sanitizer: AddressSanitizer (-fsanitize=address -g -O1).
Configure: --disable-all --enable-cli --with-curl (plus phar/zlib/dom/simplexml/fileinfo/mbstring/sqlite3/openssl/soap/mysqli/pdo/pdo_pgsql/snmp/ftp in the shared image).

Recorded runtime environment:
  USE_ZEND_ALLOC=0
  ZEND_DONT_UNLOAD_MODULES=1
  ASAN_OPTIONS=abort_on_error=0:detect_leaks=0
Operating System

No response

Langage dominant
C
Étoiles
41.8k
Forks
8.5k
Merge moyen
2 j 12 h
PR mergées (30 j)
137

Préparer son environnement

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Autres issues de php/php-src

Toutes les issues de php/php-src

Issues similaires

Plus d'issues C

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.