ext/curl: build_mime_structure_from_hash(): hash iterator dangling after __toString-triggered rehash

Aperta
  • Qualcosa non va?
#25,096 1 commento 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
45/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
c, php
Ambito
backend

Direzione di ricerca

Start in ext/curl/interface.c at the ZEND_HASH_FOREACH loops (lines 1568, 2168, 2399) where POSTFIELDS arrays are iterated. Read poc/01-postfields-rehash/poc.php and run it under AddressSanitizer to reproduce the heap-use-after-free. Fix by adding array separation or modification guards as suggested, then confirm ASan reports no error.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Bug Status: Needs Triage
Description

Category: heap-use-after-free READ; CWE-416.
Context: curl_setopt(CURLOPT_POSTFIELDS, $arr) where $arr is a nested
array (['a' => &$sub]) whose inner array is shared with refcount 1, and a
value in the inner array is an object whose __toString() enlarges the
inner array, forcing a rehash while ZEND_HASH_FOREACH iterates it.

Observed: ASan reports heap-use-after-free READ in zval_get_type
(Zend/zend_types.h:685) at build_mime_structure_from_hash
(ext/curl/interface.c:1581), reached from _php_curl_setopt; the freed
320-byte region is the inner array's bucket storage (arData).

Relevant source: ext/curl/interface.c:1568 (ZEND_HASH_FOREACH over the
POSTFIELDS array), :1581 (zval_get_tmp_string invoking __toString);
same unprotected iteration pattern also present at :2168 (slist options)
and :2399 (curl_setopt_array).

Source assessment: the iteration holds no protection against the array
being modified from inside the string conversion callback; the rehash
frees the bucket array the iterator still points into.

Expected: hold a reference/separation on the traversed array, or detect
modification during iteration, as done elsewhere in the engine
(HASH_OF / HASH_PROTECT_RECURSION style guards).

Evidence: asan/CURL-01-postfields-rehash-uaf.asan.txt.
PoC: poc/01-postfields-rehash/poc.php. Note: the inner array must have
refcount 1 (reference-nested) — a top-level array is COW-protected.

CURL-01-postfields-rehash-uaf.asan.txt

poc.php

PHP Version
Component: ext/curl in php-src master, commit b9ea38ef639f5b9bbb67d27834be9c52b922520b (cloned 2026-10-21).
PHP: 8.7.0-dev (cli), NTS.
Platform: Linux x86-64 (Ubuntu 22.04 container, Docker), libcurl 7.81.
Sanitizer: AddressSanitizer (-fsanitize=address -g -O1).
Configure: --disable-all --enable-cli --with-curl (plus phar/zlib/dom/simplexml/fileinfo/mbstring/sqlite3/openssl/soap/mysqli/pdo/pdo_pgsql/snmp/ftp in the shared image).

Recorded runtime environment:
  USE_ZEND_ALLOC=0
  ZEND_DONT_UNLOAD_MODULES=1
  ASAN_OPTIONS=abort_on_error=0:detect_leaks=0
Operating System

No response

Lingua principale
C
Stelle
41.8k
Fork
8.5k
Merge medio
2g 12h
PR unite (30g)
137

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di php/php-src

Tutte le issue di php/php-src

Issue simili

Altre issue su C

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.