ext/curl: build_mime_structure_from_hash(): hash iterator dangling after __toString-triggered rehash
維護者通常 1 天內回覆
還沒有人認領這個 Issue。
評估
研究方向
Start in ext/curl/interface.c at the ZEND_HASH_FOREACH loops (lines 1568, 2168, 2399) where POSTFIELDS arrays are iterated. Read poc/01-postfields-rehash/poc.php and run it under AddressSanitizer to reproduce the heap-use-after-free. Fix by adding array separation or modification guards as suggested, then confirm ASan reports no error.
由索引模型根據 Issue 內容生成。
描述
Description
Category: heap-use-after-free READ; CWE-416.
Context: curl_setopt(CURLOPT_POSTFIELDS, $arr) where $arr is a nested
array (['a' => &$sub]) whose inner array is shared with refcount 1, and a
value in the inner array is an object whose __toString() enlarges the
inner array, forcing a rehash while ZEND_HASH_FOREACH iterates it.
Observed: ASan reports heap-use-after-free READ in zval_get_type
(Zend/zend_types.h:685) at build_mime_structure_from_hash
(ext/curl/interface.c:1581), reached from _php_curl_setopt; the freed
320-byte region is the inner array's bucket storage (arData).
Relevant source: ext/curl/interface.c:1568 (ZEND_HASH_FOREACH over the
POSTFIELDS array), :1581 (zval_get_tmp_string invoking __toString);
same unprotected iteration pattern also present at :2168 (slist options)
and :2399 (curl_setopt_array).
Source assessment: the iteration holds no protection against the array
being modified from inside the string conversion callback; the rehash
frees the bucket array the iterator still points into.
Expected: hold a reference/separation on the traversed array, or detect
modification during iteration, as done elsewhere in the engine
(HASH_OF / HASH_PROTECT_RECURSION style guards).
Evidence: asan/CURL-01-postfields-rehash-uaf.asan.txt.
PoC: poc/01-postfields-rehash/poc.php. Note: the inner array must have
refcount 1 (reference-nested) — a top-level array is COW-protected.
CURL-01-postfields-rehash-uaf.asan.txt
PHP Version
Component: ext/curl in php-src master, commit b9ea38ef639f5b9bbb67d27834be9c52b922520b (cloned 2026-10-21).
PHP: 8.7.0-dev (cli), NTS.
Platform: Linux x86-64 (Ubuntu 22.04 container, Docker), libcurl 7.81.
Sanitizer: AddressSanitizer (-fsanitize=address -g -O1).
Configure: --disable-all --enable-cli --with-curl (plus phar/zlib/dom/simplexml/fileinfo/mbstring/sqlite3/openssl/soap/mysqli/pdo/pdo_pgsql/snmp/ftp in the shared image).
Recorded runtime environment:
USE_ZEND_ALLOC=0
ZEND_DONT_UNLOAD_MODULES=1
ASAN_OPTIONS=abort_on_error=0:detect_leaks=0
Operating System
No response
- 主要語言
- C
- 星號
- 41.8k
- 分支
- 8.5k
- 平均合併
- 2 天 12 小時
- 30 天內合併 PR
- 137
環境準備
- 沒有 Dockerfile 或 Docker Compose 檔案
- 沒有 Pull Request 範本
- 閱讀貢獻指南
從這裡開始
- 先讀完整個 Issue，再讀專案的貢獻指南。
- 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
- Fork 儲存庫，在一個分支上完成修改。
- 送出 Pull Request，並在描述裡引用這個 Issue 編號。
php/php-src 的其他 Issue
-
SNMP accepts malformed remote ports可能已有人在做 關聯的 PR 仍在進行中或已合併。 未關閉
難度 2/5 半天 新手友好度 62/100
維護者通常 1 天內回覆
-
Bug Status: Needs Triage
難度 2/5 1-3 小時 新手友好度 64/100
維護者通常 1 天內回覆
-
quoted_printable_encode() produces lines longer than 76 characters for bytes 0xF5 to 0xFF可能已有人在做 關聯的 PR 仍在進行中或已合併。 未關閉
難度 2/5 1-3 小時 新手友好度 76/100
維護者通常 1 天內回覆
-
Bug Status: Needs Triage
難度 2/5 1-3 小時 新手友好度 62/100
維護者通常 1 天內回覆
-
Feature Status: Needs Triage
難度 2/5 1-3 小時 新手友好度 73/100
維護者通常 1 天內回覆
相似的 Issue
-
enhancement good first issue help wanted
難度 2/5 1-3 小時 新手友好度 82/100
-
bug multiplayer status: planned
難度 2/5 1-3 小時 新手友好度 67/100
ChupathingyCE/chupathingyce#851 ·
維護者通常 1 天內回覆
-
bug
難度 2/5 1-3 小時 新手友好度 73/100
HigherOrderCO/Bend#2104 ·
-
research-radar
難度 2/5 1-3 小時 新手友好度 68/100
維護者通常 1 天內回覆
-
good first issue help wanted program
難度 2/5 1-3 小時 新手友好度 83/100
hffgzktbcc-blip/ounce-core#297 ·
維護者通常 1 天內回覆