Repository navigation
Heap-use-after-free in Zend/zend_variables.h #20563
Description
Description
The following code:
class A
{
public string $prop;
}
class B
{
public function __toString()
{
global $a;
$a = null;
return str_repeat('a', 1);
}
}
$a = new A();
try {
$a->prop = new B();
} catch (Error $e) {
echo $e->getMessage(), "\n";
}
$a = new A();
$a->prop = '';
try {
$a->prop.= new B();
} catch (Error $e) {
echo $e->getMessage(), "\n";
}Resulted in this output:
SUMMARY: AddressSanitizer: heap-use-after-free php-src/Zend/zend_variables.h:42:6 in i_zval_ptr_dtor
Shadow bytes around the buggy address:
0x0c0c7fffe4a0: 00 00 00 fa fa fa fa fa 00 00 00 00 00 00 00 fa
0x0c0c7fffe4b0: fa fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa
0x0c0c7fffe4c0: fd fd fd fd fd fd fd fd fa fa fa fa fd fd fd fd
0x0c0c7fffe4d0: fd fd fd fa fa fa fa fa 00 00 00 00 00 00 00 fa
0x0c0c7fffe4e0: fa fa fa fa fd fd fd fd fd fd fd fa fa fa fa fa
=>0x0c0c7fffe4f0: fd fd fd fd fd fd[fd]fa fa fa fa fa fa fa fa fa
0x0c0c7fffe500: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0c7fffe510: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0c7fffe520: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0c7fffe530: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0c7fffe540: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==3961074==ABORTING
Commit:
9cd367362da5442861f30d3b41e967d641b90cbd
Build configuration:
CC="clang" CXX="clang++" CFLAGS="-fsanitize=address -g -O0" CXXFLAGS="-fsanitize=address -g -O0" ./configure --enable-debug --enable-address-sanitizer --disable-shared --with-pic
PHP Version
PHP 8.6.0-dev (cli) (built: Nov 14 2025 10:37:56) (NTS DEBUG)
Copyright (c) The PHP Group
Zend Engine v4.6.0-dev, Copyright (c) Zend Technologies
with Zend OPcache v8.6.0-dev, Copyright (c), by Zend Technologies
Operating System
Ubuntu 22.04
For your information: @vi3tL0u1s
Activity
ndossche commentedon Nov 22, 2025
Duplicate of #20319