Segfault from ASan: SEGV on unknown address 0x7ffd00000042

[YuanchengJiang]

Description

Given the following phpt file:

--TEST--
ASan DEADLYSIGNAL SEGV on unknown address
--INI--
error_reporting=E_ALL&~E_DEPRECATED
--FILE--
<?php
class obj implements Serializable {
    var $data;
    function serialize() {
        return serialize($this->data);
    }
    function unserialize($data) {
        session_start();
        session_decode($data);
    }
}
$inner = 'ryat|a:1:{i:0;a:1:{i:1;';
$exploit = 'a:2:{i:0;C:3:"obj":'.strlen($inner).':{'.$inner.'}i:1;R:4;}';
$data = unserialize($exploit);
for ($i = 0; $i < 5; $i++) {
    $v[$i] = 'hi'.$i;
}
var_dump($data);
?>
<?php
enum Foo {
    case Bar;
    public function __sleep(): array {
    }
}
?>
--EXTENSIONS--
session
--EXPECTF--
Warning: session_decode(): Failed to decode session object. Session has been destroyed in %s on line %d
Warning: unserialize(): Error at offset 55 of 56 bytes in %s on line %d
bool(false)
Fatal error: Enum Foo cannot include magic method __sleep in %s on line %d

Resulted in this output:

AddressSanitizer:DEADLYSIGNAL
=================================================================
==491976==ERROR: AddressSanitizer: SEGV on unknown address 0x7ffd00000042 (pc 0x7f26f2481205 bp 0x0000ffffffff sp 0x7ffdf94bc550 T0)
==491976==The signal is caused by a READ memory access.
    #0 0x7f26f2481205 in _longjmp (/lib/x86_64-linux-gnu/libc.so.6+0x42205) (BuildId: c289da5071a3399de893d2af81d6a30c62646e1e)
    #1 0x565537b6fad8 in _zend_bailout /WorkSpace/php-src/Zend/zend.c:1226:2
    #2 0x565536dd1c3f in php_session_decode /WorkSpace/php-src/ext/session/session.c:282:3
    #3 0x7f26ed27f59f  (<unknown module>)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/lib/x86_64-linux-gnu/libc.so.6+0x42205) (BuildId: c289da5071a3399de893d2af81d6a30c62646e1e) in _longjmp

PHP Version

PHP 8.4.0-dev

Operating System

ubuntu 22.04

[YuanchengJiang]

A simplified code:

<?php
ob_start();
ini_set("session.serialize_handler", "php_serialize");
session_start();
$result1 = session_decode('foo|s:3:"bar";');
class Test extends DateTime {
    public static function createFromFormat($format, $datetime, $timezone = null): Wrong { }
}
?>

To reproduce just php test.php (asan enabled)

[nielsdos]

Thanks for the report. This is related to session decode changes to prevent writing incomplete sessions. I'll have a look tonight.