Assertion `!(zval_get_type(&(*(property))) == 10)' failed.

[Changochen]

Description

The following code:

<?php
class a extends ArrayIterator
{
    public ?b $nint;
}
function c($f, $d)
{
    try {
        $f->$d;
    } catch (e) {
    }
}
function g($f, $d)
{
    try {
        $f->$d = &$b;
    } catch (e) {
    }
}
$f = new a();
g($f, "nint");
c($f, "nint");

Resulted in this output:

php_asan/Zend/zend_execute.c:953: _Bool i_zend_check_property_type(const zend_property_info *, zval *, _Bool): Assertion `!(zval_get_type(&(*(property))) == 10)' failed.

Build config:

./configure --disable-all --enable-address-sanitizer --disable-phpdbg --disable-cgi --with-pic --enable-debug-assertions
make -j
./sapi/cli/php -f poc.php

PHP Version

PHP 8.3.0-dev

Operating System

No response

[nielsdos]

I can confirm this crashes on 8.1 and higher.
Simplified reproducer:

<?php
class a extends ArrayIterator
{
    public ?int $property;
}
$f = new a();
$f->property = &$b;
$f->property;

EDIT:

I added a patch below which seems sensible to me, but I'm not 100% sure since this is quite unknown territory for me.
We're already using ZVAL_COPY_DEREF in the non-debug code, so I thought we might need to do the dereference too for the property validation in debug code, as the i_zend_check_property_type function asserts that we're not using a ref.

diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index d869116c33..b0104bc436 100644
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -2122,7 +2122,11 @@ ZEND_VM_C_LABEL(fetch_obj_r_fast_copy):
 		retval = zobj->handlers->read_property(zobj, name, BP_VAR_R, cache_slot, EX_VAR(opline->result.var));
 #if ZEND_DEBUG
 		if (!EG(exception) && zobj->handlers->read_property != zend_std_read_property) {
-			zend_verify_internal_read_property_type(zobj, name, retval);
+			zval *val = retval;
+			if (Z_OPT_ISREF_P(retval)) {
+				val = Z_REFVAL_P(retval);
+			}
+			zend_verify_internal_read_property_type(zobj, name, val);
 		}
 #endif
 

If it look sensible to the maintainers I'll make a PR

[Girgias]

Does this only happen because it extends an internal class, or is this a more general issue? If the former, changing the VM seems like the wrong fix and possibly fixing the write_property object handler spl_array_write_property() (and maybe need an audit of other such overwrite) needs to be fixed.

[nielsdos]

This only happens because it's an internal class yes, because that debug path is for internal classes.
The reason I suggested modifying the VM is because the VM later (in the non-debug path) does: ZVAL_COPY_DEREF(EX_VAR(opline->result.var), retval);. So the VM already takes into account that retval could be a REF in non-debug code, but the debug code path does not.