heap-use-after-free / double free of __call trampoline when cloning CurlHandle

未关闭
  • 哪里不对？
#25,263 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度
4/5
预计耗时
3-5 天
新手友好度
44/100
Issue 类型
缺陷
描述清晰度
基本清楚
活跃度
活跃
技术栈
c, php
领域
backend

调研方向

Start with ext/curl/interface.c at php_curl_set_callable_handler and curl_free_obj, then follow the zend_fcc_addref and zend_release_fcall_info_cache calls shown in the stack trace. Reproduce with the supplied PHP snippet and USE_ZEND_ALLOC=0; trace how cloning the CurlHandle affects ownership of the callback trampoline. Done when the reproducer no longer reports use-after-free or double free.

由索引模型根据 Issue 内容生成。

描述

Bug Status: Needs Triage
Description

The following code:

<?php
class T {
    public function __call($name, $args) { return 0; }
}
$ch = curl_init();
curl_setopt($ch, CURLOPT_READFUNCTION, [new T, "trampoline"]);
$ch2 = clone $ch;
unset($ch2);

Resulted in this output:

==3132581==ERROR: AddressSanitizer: heap-use-after-free on address 0x61100003a244 at pc 0x000005c38622 bp 0x7ffcb81c5330 sp 0x7ffcb81c5328
READ of size 4 at 0x61100003a244 thread T0
    #0 0x5c38621 in zend_release_fcall_info_cache Zend/zend_API.c:3845:34
    #1 0xf3a0f8 in zend_fcc_dtor Zend/zend_API.h:849:2
    #2 0xee92e3 in curl_free_obj ext/curl/interface.c:2893:3
    #3 0x6a17dba in zend_objects_store_del Zend/zend_objects_API.c:193:4
    #4 0x6b401c7 in rc_dtor_func Zend/zend_variables.c:56:2
    #5 0x6b4044e in i_zval_ptr_dtor Zend/zend_variables.h:44:4
    #6 0x6b40204 in zval_ptr_dtor Zend/zend_variables.c:83:2
    #7 0x6715a96 in _zend_hash_del_el_ex Zend/zend_hash.c:1721:3
    #8 0x6713283 in _zend_hash_del_el Zend/zend_hash.c:1748:2
    #9 0x672b3ae in zend_hash_reverse_apply Zend/zend_hash.c:2470:5
    #10 0x5f23c57 in shutdown_destructors Zend/zend_execute_API.c:262:4
    #11 0x6b8bdf2 in zend_call_destructors Zend/zend.c:1353:3
    #12 0x54fcbcb in php_request_shutdown main/main.c:1969:3
    #13 0x6bafcd4 in do_cli sapi/cli/php_cli.c:1160:3
    ...

0x61100003a244 is located 4 bytes inside of 256-byte region [0x61100003a240,0x61100003a340)

freed by thread T0 here:
    #0 0x681162 in free (sapi/cli/php+0x681162)
    #1 0x5bb3cc3 in __zend_free Zend/zend_alloc.c:4108:2
    #2 0x5bbe3a0 in _efree Zend/zend_alloc.c:3060:3
    #3 0x69f7b84 in zend_free_trampoline Zend/zend_object_handlers.c:1866:3
    #4 0x5c389d1 in zend_release_fcall_info_cache Zend/zend_API.c:3849:3
    #5 0xf3a0f8 in zend_fcc_dtor Zend/zend_API.h:849:2
    #6 0xee92e3 in curl_free_obj ext/curl/interface.c:2893:3
    #7 0x6a17dba in zend_objects_store_del Zend/zend_objects_API.c:193:4
    ...

previously allocated by thread T0 here:
    #0 0x6813cd in malloc (sapi/cli/php+0x6813cd)
    #1 0x5bbf153 in __zend_malloc Zend/zend_alloc.c:4079:14
    #2 0x5bbe188 in _emalloc Zend/zend_alloc.c:3050:10
    #3 0xf3137c in zend_fcc_addref Zend/zend_API.h:822:41
    #4 0xf32180 in php_curl_set_callable_handler ext/curl/interface.c:1682:2
    #5 0xefdf4e in _php_curl_setopt ext/curl/interface.c:1722:3
    #6 0xefb685 in zif_curl_setopt ext/curl/interface.c:2396:2
    #7 0x63f0b1a in ZEND_DO_ICALL_SPEC_RETVAL_UNUSED_HANDLER Zend/zend_vm_execute.h:1323:2
    ...

SUMMARY: AddressSanitizer: heap-use-after-free Zend/zend_API.c:3845:34 in zend_release_fcall_info_cache

To reproduce: USE_ZEND_ALLOC=0 ./sapi/cli/php test.php

I remember USE_ZEND_ALLOC=0 bugs are not common, shall I still report these bugs?

PHP Version
nightly
Operating System

No response

主要语言
C
星标
41.8k
派生
8.5k
平均合并
2 天 12 小时
30 天内合并 PR
137

环境准备

  • 没有 Dockerfile 或 Docker Compose 文件
  • 没有 Pull Request 模板
  • 阅读贡献指南

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

php/php-src 的其他 Issue

查看 php/php-src 的全部 Issue

相似的 Issue

更多 C Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。