Repository navigation
heap uaf in regex #23723
Description
Description
The following code:
<?php
class E { function __toString(){ $GLOBALS['s'] = []; return "aaa"; } }
$s = [ new E() ];
for ($i=0;$i<3000;$i) $s[] = "aaa$i";
$GLOBALS['s'] =& $s;
preg_replace('/a/', 'b', $s); Resulted in this output:
=================================================================
==1==ERROR: AddressSanitizer: heap-use-after-free on address 0xffffacd4f888 at pc 0x000000cbdee0 bp 0xffffc8faf170 sp 0xffffc8faf168
READ of size 4 at 0xffffacd4f888 thread T0
#0 0xcbdedc in _preg_replace_common /src/php-src/ext/pcre/php_pcre.c:2315:3
#1 0xcbcd4c in zflf_preg_replace_3 /src/php-src/ext/pcre/php_pcre.c:2388:2
#2 0x5ec3018 in ZEND_FRAMELESS_ICALL_3_SPEC_HANDLER /src/php-src/Zend/zend_vm_execute.h:3969:3
#3 0x5916d98 in execute_ex /src/php-src/Zend/zend_vm_execute.h:110551:12
#4 0x5919010 in zend_execute /src/php-src/Zend/zend_vm_execute.h:115989:2
#5 0x656733c in zend_execute_script /src/php-src/Zend/zend.c:1977:3
#6 0x4e4e2e0 in php_execute_script_ex /src/php-src/main/main.c:2589:13
#7 0x4e4f358 in php_execute_script /src/php-src/main/main.c:2629:9
#8 0x657a078 in do_cli /src/php-src/sapi/cli/php_cli.c:933:5
#9 0x6574b2c in do_php_cli /src/php-src/sapi/cli/php_cli.c:1346:18
#10 0x6573020 in main /src/php-src/sapi/cli/php_cli_main.c:18:9
#11 0xffffb35a73fc (/lib/aarch64-linux-gnu/libc.so.6+0x273fc)
#12 0xffffb35a74d4 in __libc_start_main (/lib/aarch64-linux-gnu/libc.so.6+0x274d4)
#13 0x48e06c in _start (/src/php-src/sapi/cli/php+0x48e06c)
0xffffacd4f888 is located 8 bytes inside of 56-byte region [0xffffacd4f880,0xffffacd4f8b8)
freed by thread T0 here:
#0 0x4fdc2c in free (/src/php-src/sapi/cli/php+0x4fdc2c)
#1 0x552d670 in __zend_free /src/php-src/Zend/zend_alloc.c:3671:2
#2 0x5537044 in _efree /src/php-src/Zend/zend_alloc.c:2888:3
#3 0x6096d6c in zend_array_destroy /src/php-src/Zend/zend_hash.c:1881:2
#4 0x6510268 in rc_dtor_func /src/php-src/Zend/zend_variables.c:56:2
#5 0x5f5b8bc in zend_assign_to_variable /src/php-src/Zend/zend_execute.h:184:4
#6 0x59baa38 in ZEND_ASSIGN_SPEC_VAR_CONST_RETVAL_UNUSED_HANDLER /src/php-src/Zend/zend_vm_execute.h:25473:11
#7 0x5916d98 in execute_ex /src/php-src/Zend/zend_vm_execute.h:110551:12
#8 0x58b0d6c in zend_call_function /src/php-src/Zend/zend_execute_API.c:1038:3
#9 0x58b7134 in zend_call_known_function_ex /src/php-src/Zend/zend_execute_API.c:1136:23
#10 0x63f4870 in zend_call_known_function /src/php-src/Zend/zend_API.h:870:2
#11 0x63f4818 in zend_call_known_instance_method /src/php-src/Zend/zend_API.h:898:2
#12 0x63ae794 in zend_call_known_instance_method_with_0_params /src/php-src/Zend/zend_API.h:904:2
#13 0x63f1144 in zend_std_cast_object_tostring /src/php-src/Zend/zend_object_handlers.c:2589:5
#14 0x64541f4 in __zval_get_string_func /src/php-src/Zend/zend_operators.c:1154:8
#15 0x6453778 in zval_get_string_func /src/php-src/Zend/zend_operators.c:1175:9
#16 0xcd1160 in zval_get_tmp_string /src/php-src/Zend/zend_operators.h:355:17
#17 0xcbe268 in _preg_replace_common /src/php-src/ext/pcre/php_pcre.c:2318:37
#18 0xcbcd4c in zflf_preg_replace_3 /src/php-src/ext/pcre/php_pcre.c:2388:2
#19 0x5ec3018 in ZEND_FRAMELESS_ICALL_3_SPEC_HANDLER /src/php-src/Zend/zend_vm_execute.h:3969:3
#20 0x5916d98 in execute_ex /src/php-src/Zend/zend_vm_execute.h:110551:12
#21 0x5919010 in zend_execute /src/php-src/Zend/zend_vm_execute.h:115989:2
#22 0x656733c in zend_execute_script /src/php-src/Zend/zend.c:1977:3
#23 0x4e4e2e0 in php_execute_script_ex /src/php-src/main/main.c:2589:13
#24 0x4e4f358 in php_execute_script /src/php-src/main/main.c:2629:9
#25 0x657a078 in do_cli /src/php-src/sapi/cli/php_cli.c:933:5
#26 0x6574b2c in do_php_cli /src/php-src/sapi/cli/php_cli.c:1346:18
#27 0x6573020 in main /src/php-src/sapi/cli/php_cli_main.c:18:9
#28 0xffffb35a73fc (/lib/aarch64-linux-gnu/libc.so.6+0x273fc)
#29 0xffffb35a74d4 in __libc_start_main (/lib/aarch64-linux-gnu/libc.so.6+0x274d4)
previously allocated by thread T0 here:
#0 0x4fde8c in malloc (/src/php-src/sapi/cli/php+0x4fde8c)
#1 0x5537948 in __zend_malloc /src/php-src/Zend/zend_alloc.c:3643:14
#2 0x5536dd4 in _emalloc /src/php-src/Zend/zend_alloc.c:2878:10
#3 0x605e8a0 in _zend_new_array /src/php-src/Zend/zend_hash.c:289:18
#4 0x5b825e8 in ZEND_INIT_ARRAY_SPEC_TMP_UNUSED_HANDLER /src/php-src/Zend/zend_vm_execute.h:21842:3
#5 0x5916d98 in execute_ex /src/php-src/Zend/zend_vm_execute.h:110551:12
#6 0x5919010 in zend_execute /src/php-src/Zend/zend_vm_execute.h:115989:2
#7 0x656733c in zend_execute_script /src/php-src/Zend/zend.c:1977:3
#8 0x4e4e2e0 in php_execute_script_ex /src/php-src/main/main.c:2589:13
#9 0x4e4f358 in php_execute_script /src/php-src/main/main.c:2629:9
#10 0x657a078 in do_cli /src/php-src/sapi/cli/php_cli.c:933:5
#11 0x6574b2c in do_php_cli /src/php-src/sapi/cli/php_cli.c:1346:18
#12 0x6573020 in main /src/php-src/sapi/cli/php_cli_main.c:18:9
#13 0xffffb35a73fc (/lib/aarch64-linux-gnu/libc.so.6+0x273fc)
#14 0xffffb35a74d4 in __libc_start_main (/lib/aarch64-linux-gnu/libc.so.6+0x274d4)
#15 0x48e06c in _start (/src/php-src/sapi/cli/php+0x48e06c)
SUMMARY: AddressSanitizer: heap-use-after-free /src/php-src/ext/pcre/php_pcre.c:2315:3 in _preg_replace_common
Shadow bytes around the buggy address:
0x200ff59a9ec0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x200ff59a9ed0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x200ff59a9ee0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x200ff59a9ef0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x200ff59a9f00: fa fa fa fa 00 00 00 00 00 00 00 fa fa fa fa fa
=>0x200ff59a9f10: fd[fd]fd fd fd fd fd fa fa fa fa fa fd fd fd fd
0x200ff59a9f20: fd fd fd fa fa fa fa fa fd fd fd fd fd fd fd fd
0x200ff59a9f30: fa fa fa fa fd fd fd fd fd fd fd fa fa fa fa fa
0x200ff59a9f40: 00 00 00 00 00 00 00 fa fa fa fa fa 00 00 00 00
0x200ff59a9f50: 00 00 00 00 fa fa fa fa 00 00 00 00 00 00 00 fa
0x200ff59a9f60: fa fa fa fa 00 00 00 00 00 00 00 fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==1==ABORTING
USE_ZEND_ALLOC=0
PHP Version
8.6.0-dev
Operating System
Ubuntu 22.04
Activity