heap-use-after-free / double free of __call trampoline when cloning CurlHandle

未關閉
  • 哪裡不對？
#25,263 0 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視

維護者通常 1 天內回覆

還沒有人認領這個 Issue。

評估

難度
4/5
預估耗時
3-5 天
新手友好度
44/100
Issue 類型
缺陷
描述清晰度
基本清楚
活躍度
活躍
技術堆疊
c, php
領域
backend

研究方向

Start with ext/curl/interface.c at php_curl_set_callable_handler and curl_free_obj, then follow the zend_fcc_addref and zend_release_fcall_info_cache calls shown in the stack trace. Reproduce with the supplied PHP snippet and USE_ZEND_ALLOC=0; trace how cloning the CurlHandle affects ownership of the callback trampoline. Done when the reproducer no longer reports use-after-free or double free.

由索引模型根據 Issue 內容生成。

描述

Bug Status: Needs Triage
Description

The following code:

<?php
class T {
    public function __call($name, $args) { return 0; }
}
$ch = curl_init();
curl_setopt($ch, CURLOPT_READFUNCTION, [new T, "trampoline"]);
$ch2 = clone $ch;
unset($ch2);

Resulted in this output:

==3132581==ERROR: AddressSanitizer: heap-use-after-free on address 0x61100003a244 at pc 0x000005c38622 bp 0x7ffcb81c5330 sp 0x7ffcb81c5328
READ of size 4 at 0x61100003a244 thread T0
    #0 0x5c38621 in zend_release_fcall_info_cache Zend/zend_API.c:3845:34
    #1 0xf3a0f8 in zend_fcc_dtor Zend/zend_API.h:849:2
    #2 0xee92e3 in curl_free_obj ext/curl/interface.c:2893:3
    #3 0x6a17dba in zend_objects_store_del Zend/zend_objects_API.c:193:4
    #4 0x6b401c7 in rc_dtor_func Zend/zend_variables.c:56:2
    #5 0x6b4044e in i_zval_ptr_dtor Zend/zend_variables.h:44:4
    #6 0x6b40204 in zval_ptr_dtor Zend/zend_variables.c:83:2
    #7 0x6715a96 in _zend_hash_del_el_ex Zend/zend_hash.c:1721:3
    #8 0x6713283 in _zend_hash_del_el Zend/zend_hash.c:1748:2
    #9 0x672b3ae in zend_hash_reverse_apply Zend/zend_hash.c:2470:5
    #10 0x5f23c57 in shutdown_destructors Zend/zend_execute_API.c:262:4
    #11 0x6b8bdf2 in zend_call_destructors Zend/zend.c:1353:3
    #12 0x54fcbcb in php_request_shutdown main/main.c:1969:3
    #13 0x6bafcd4 in do_cli sapi/cli/php_cli.c:1160:3
    ...

0x61100003a244 is located 4 bytes inside of 256-byte region [0x61100003a240,0x61100003a340)

freed by thread T0 here:
    #0 0x681162 in free (sapi/cli/php+0x681162)
    #1 0x5bb3cc3 in __zend_free Zend/zend_alloc.c:4108:2
    #2 0x5bbe3a0 in _efree Zend/zend_alloc.c:3060:3
    #3 0x69f7b84 in zend_free_trampoline Zend/zend_object_handlers.c:1866:3
    #4 0x5c389d1 in zend_release_fcall_info_cache Zend/zend_API.c:3849:3
    #5 0xf3a0f8 in zend_fcc_dtor Zend/zend_API.h:849:2
    #6 0xee92e3 in curl_free_obj ext/curl/interface.c:2893:3
    #7 0x6a17dba in zend_objects_store_del Zend/zend_objects_API.c:193:4
    ...

previously allocated by thread T0 here:
    #0 0x6813cd in malloc (sapi/cli/php+0x6813cd)
    #1 0x5bbf153 in __zend_malloc Zend/zend_alloc.c:4079:14
    #2 0x5bbe188 in _emalloc Zend/zend_alloc.c:3050:10
    #3 0xf3137c in zend_fcc_addref Zend/zend_API.h:822:41
    #4 0xf32180 in php_curl_set_callable_handler ext/curl/interface.c:1682:2
    #5 0xefdf4e in _php_curl_setopt ext/curl/interface.c:1722:3
    #6 0xefb685 in zif_curl_setopt ext/curl/interface.c:2396:2
    #7 0x63f0b1a in ZEND_DO_ICALL_SPEC_RETVAL_UNUSED_HANDLER Zend/zend_vm_execute.h:1323:2
    ...

SUMMARY: AddressSanitizer: heap-use-after-free Zend/zend_API.c:3845:34 in zend_release_fcall_info_cache

To reproduce: USE_ZEND_ALLOC=0 ./sapi/cli/php test.php

I remember USE_ZEND_ALLOC=0 bugs are not common, shall I still report these bugs?

PHP Version
nightly
Operating System

No response

主要語言
C
星號
41.8k
分支
8.5k
平均合併
2 天 12 小時
30 天內合併 PR
137

環境準備

  • 沒有 Dockerfile 或 Docker Compose 檔案
  • 沒有 Pull Request 範本
  • 閱讀貢獻指南

從這裡開始

  1. 先讀完整個 Issue，再讀專案的貢獻指南。
  2. 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
  3. Fork 儲存庫，在一個分支上完成修改。
  4. 送出 Pull Request，並在描述裡引用這個 Issue 編號。

php/php-src 的其他 Issue

查看 php/php-src 的全部 Issue

相似的 Issue

更多 C Issue

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。