heap-use-after-free / double free of __call trampoline when cloning CurlHandle

Aberta
  • Algo errado?
#25,263 0 comentários 0 reações 0 responsáveis Ver no GitHub

Mantenedores costumam responder em até 1 dia

Ninguém assumiu esta issue ainda.

Avaliação

Dificuldade
4/5
Tempo estimado
3-5 dias
Facilidade para iniciantes
44/100
Tipo de issue
Bug
Clareza
Razoavelmente clara
Status de atividade
Ativa
Stack de tecnologia
c, php
Domínio
backend

Direção de pesquisa

Start with ext/curl/interface.c at php_curl_set_callable_handler and curl_free_obj, then follow the zend_fcc_addref and zend_release_fcall_info_cache calls shown in the stack trace. Reproduce with the supplied PHP snippet and USE_ZEND_ALLOC=0; trace how cloning the CurlHandle affects ownership of the callback trampoline. Done when the reproducer no longer reports use-after-free or double free.

Escrita pelo modelo de indexação a partir do texto da issue.

Descrição

Bug Status: Needs Triage
Description

The following code:

<?php
class T {
    public function __call($name, $args) { return 0; }
}
$ch = curl_init();
curl_setopt($ch, CURLOPT_READFUNCTION, [new T, "trampoline"]);
$ch2 = clone $ch;
unset($ch2);

Resulted in this output:

==3132581==ERROR: AddressSanitizer: heap-use-after-free on address 0x61100003a244 at pc 0x000005c38622 bp 0x7ffcb81c5330 sp 0x7ffcb81c5328
READ of size 4 at 0x61100003a244 thread T0
    #0 0x5c38621 in zend_release_fcall_info_cache Zend/zend_API.c:3845:34
    #1 0xf3a0f8 in zend_fcc_dtor Zend/zend_API.h:849:2
    #2 0xee92e3 in curl_free_obj ext/curl/interface.c:2893:3
    #3 0x6a17dba in zend_objects_store_del Zend/zend_objects_API.c:193:4
    #4 0x6b401c7 in rc_dtor_func Zend/zend_variables.c:56:2
    #5 0x6b4044e in i_zval_ptr_dtor Zend/zend_variables.h:44:4
    #6 0x6b40204 in zval_ptr_dtor Zend/zend_variables.c:83:2
    #7 0x6715a96 in _zend_hash_del_el_ex Zend/zend_hash.c:1721:3
    #8 0x6713283 in _zend_hash_del_el Zend/zend_hash.c:1748:2
    #9 0x672b3ae in zend_hash_reverse_apply Zend/zend_hash.c:2470:5
    #10 0x5f23c57 in shutdown_destructors Zend/zend_execute_API.c:262:4
    #11 0x6b8bdf2 in zend_call_destructors Zend/zend.c:1353:3
    #12 0x54fcbcb in php_request_shutdown main/main.c:1969:3
    #13 0x6bafcd4 in do_cli sapi/cli/php_cli.c:1160:3
    ...

0x61100003a244 is located 4 bytes inside of 256-byte region [0x61100003a240,0x61100003a340)

freed by thread T0 here:
    #0 0x681162 in free (sapi/cli/php+0x681162)
    #1 0x5bb3cc3 in __zend_free Zend/zend_alloc.c:4108:2
    #2 0x5bbe3a0 in _efree Zend/zend_alloc.c:3060:3
    #3 0x69f7b84 in zend_free_trampoline Zend/zend_object_handlers.c:1866:3
    #4 0x5c389d1 in zend_release_fcall_info_cache Zend/zend_API.c:3849:3
    #5 0xf3a0f8 in zend_fcc_dtor Zend/zend_API.h:849:2
    #6 0xee92e3 in curl_free_obj ext/curl/interface.c:2893:3
    #7 0x6a17dba in zend_objects_store_del Zend/zend_objects_API.c:193:4
    ...

previously allocated by thread T0 here:
    #0 0x6813cd in malloc (sapi/cli/php+0x6813cd)
    #1 0x5bbf153 in __zend_malloc Zend/zend_alloc.c:4079:14
    #2 0x5bbe188 in _emalloc Zend/zend_alloc.c:3050:10
    #3 0xf3137c in zend_fcc_addref Zend/zend_API.h:822:41
    #4 0xf32180 in php_curl_set_callable_handler ext/curl/interface.c:1682:2
    #5 0xefdf4e in _php_curl_setopt ext/curl/interface.c:1722:3
    #6 0xefb685 in zif_curl_setopt ext/curl/interface.c:2396:2
    #7 0x63f0b1a in ZEND_DO_ICALL_SPEC_RETVAL_UNUSED_HANDLER Zend/zend_vm_execute.h:1323:2
    ...

SUMMARY: AddressSanitizer: heap-use-after-free Zend/zend_API.c:3845:34 in zend_release_fcall_info_cache

To reproduce: USE_ZEND_ALLOC=0 ./sapi/cli/php test.php

I remember USE_ZEND_ALLOC=0 bugs are not common, shall I still report these bugs?

PHP Version
nightly
Operating System

No response

Linguagem predominante
C
Estrelas
41.8k
Forks
8.5k
Merge médio
2d 12h
PRs com merge (30d)
137

Preparar o ambiente

Primeiros passos

  1. Leia a issue inteira e depois o guia de contribuição do projeto.
  2. Comente na issue dizendo que vai assumir — evita que duas pessoas façam o mesmo trabalho.
  3. Faça um fork do repositório e trabalhe em uma branch.
  4. Abra um pull request que referencie o número da issue.

Mais de php/php-src

Todas as issues de php/php-src

Issues semelhantes

Mais issues de C

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.