Skip to content

Fix use-after-free in write_property when object is released - #10179

Closed
iluuu1994 wants to merge 1 commit into
php:masterfrom
iluuu1994:gh-10169
Closed

iluuu1994 wants to merge 1 commit into
php:masterfrom
iluuu1994:gh-10169

Conversation

@iluuu1994

@iluuu1994 iluuu1994 commented Dec 28, 2022 •

Copy link
Copy Markdown
Member

Fixes GH-10169

This fix does some additional refcounting in write_property (particularly before/after zend_verify_property_type) to detect releasing the object. That's unfortunate because it's not really needed as usually one can't modify local variables of other stack frames. Globals are the exception to this rule.

This fix throws an error when the object gets released. However, it's not completely obvious to me if this is the "correct" behavior. It sounds more intuitive to drop the assignment. However, that is non-trivial as zend_std_write_property must return a pointer to some zval which should contain the assigned value. But as the object is released we can't point into its properties as usual, and allocating a zval would mean that the caller of write_property needs to release it.

So, I wonder if this is something actually worth fixing...

@dstogov dstogov left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This problem have to be fixed and the proposed fix looks right. I would only remove GC recording calls.

Comment thread Zend/zend_object_handlers.c Resolved
Comment thread Zend/zend_object_handlers.c Resolved
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Heap UAF at ZEND_ASSIGN_OBJ_SPEC_CV_CONST_OP_DATA_VAR_HANDLER

3 participants