UAF in array_splice

[chibinz]

Description

The following code:

<?php
function resize_arr() {
    global $arr;
    for ($i = 0; $i < 10; $i++) {
        $arr[$i] = $i;
    }
}

class C {
    function __destruct() {
        resize_arr();
        return "3";
    }
}

$arr = ["a" => "1", "3" => new C, "2" => "2"];

array_splice($arr, 1, 2);

Resulted in this output:

==1989996==ERROR: AddressSanitizer: heap-use-after-free on address 0x61200002d9c8 at pc 0x557ef6a96fa9 bp 0x7ffc86af56c0 sp 0x7ffc86af56b8
READ of size 1 at 0x61200002d9c8 thread T0
    #0 0x557ef6a96fa8 in zval_get_type /tmp/php-asan/Zend/zend_types.h:650:18
    #1 0x557ef6ace736 in php_splice /tmp/php-asan/ext/standard/array.c:3457:9
    #2 0x557ef6acd4a0 in zif_array_splice /tmp/php-asan/ext/standard/array.c:3831:2
    #3 0x557ef734ebc2 in ZEND_DO_ICALL_SPEC_RETVAL_UNUSED_HANDLER /tmp/php-asan/Zend/zend_vm_execute.h:1299:2
    #4 0x557ef71b183d in execute_ex /tmp/php-asan/Zend/zend_vm_execute.h:58565:7
    #5 0x557ef71b2067 in zend_execute /tmp/php-asan/Zend/zend_vm_execute.h:64217:2
    #6 0x557ef75e6860 in zend_execute_script /tmp/php-asan/Zend/zend.c:1932:3
    #7 0x557ef6e04d2b in php_execute_script_ex /tmp/php-asan/main/main.c:2574:13
    #8 0x557ef6e05228 in php_execute_script /tmp/php-asan/main/main.c:2614:9
    #9 0x557ef75ee309 in do_cli /tmp/php-asan/sapi/cli/php_cli.c:935:5
    #10 0x557ef75eb32c in main /tmp/php-asan/sapi/cli/php_cli.c:1310:18
    #11 0x7fd70f229d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #12 0x7fd70f229e3f in __libc_start_main csu/../csu/libc-start.c:392:3
    #13 0x557ef6002de4 in _start (/workspaces/TriFuzz/targets/php-asan/bin/php+0x402de4)

0x61200002d9c8 is located 136 bytes inside of 320-byte region [0x61200002d940,0x61200002da80)
freed by thread T0 here:
    #0 0x557ef6087702 in free /opt/llvm-15-build/llvm-15.x/final/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3
    #1 0x557ef70418a3 in __zend_free /tmp/php-asan/Zend/zend_alloc.c:3308:2
    #2 0x557ef7045774 in _efree /tmp/php-asan/Zend/zend_alloc.c:2747:3
    #3 0x557ef746fed8 in zend_hash_do_resize /tmp/php-asan/Zend/zend_hash.c:1321:3
    #4 0x557ef745a240 in _zend_hash_index_add_or_update_i /tmp/php-asan/Zend/zend_hash.c:1168:3
    #5 0x557ef745a8f5 in zend_hash_index_lookup /tmp/php-asan/Zend/zend_hash.c:1236:9
    #6 0x557ef73ee1c5 in zend_fetch_dimension_address_inner /tmp/php-asan/Zend/zend_execute.c:2698:4
    #7 0x557ef73f92ce in zend_fetch_dimension_address_inner_W /tmp/php-asan/Zend/zend_execute.c:2755:9
    #8 0x557ef72171f8 in ZEND_ASSIGN_DIM_SPEC_CV_CV_OP_DATA_CV_HANDLER /tmp/php-asan/Zend/zend_vm_execute.h:53879:20
    #9 0x557ef71b183d in execute_ex /tmp/php-asan/Zend/zend_vm_execute.h:58565:7
    #10 0x557ef718d1ac in zend_call_function /tmp/php-asan/Zend/zend_execute_API.c:996:3
    #11 0x557ef718f3b2 in zend_call_known_function /tmp/php-asan/Zend/zend_execute_API.c:1090:23
    #12 0x557ef7564aca in zend_call_known_instance_method /tmp/php-asan/Zend/zend_API.h:860:2
    #13 0x557ef7562e6b in zend_call_known_instance_method_with_0_params /tmp/php-asan/Zend/zend_API.h:866:2
    #14 0x557ef7562b31 in zend_objects_destroy_object /tmp/php-asan/Zend/zend_objects.c:194:3
    #15 0x557ef75608a2 in zend_objects_store_del /tmp/php-asan/Zend/zend_objects_API.c:179:4
    #16 0x557ef75c75b6 in rc_dtor_func /tmp/php-asan/Zend/zend_variables.c:57:2
    #17 0x557ef75c76a4 in i_zval_ptr_dtor /tmp/php-asan/Zend/zend_variables.h:45:4
    #18 0x557ef75c75f4 in zval_ptr_dtor /tmp/php-asan/Zend/zend_variables.c:84:2
    #19 0x557ef745d919 in _zend_hash_del_el_ex /tmp/php-asan/Zend/zend_hash.c:1487:3
    #20 0x557ef745c9ea in _zend_hash_del_el /tmp/php-asan/Zend/zend_hash.c:1514:2
    #21 0x557ef745c6c5 in zend_hash_del_bucket /tmp/php-asan/Zend/zend_hash.c:1531:2
    #22 0x557ef6ace769 in php_splice /tmp/php-asan/ext/standard/array.c:3459:5
    #23 0x557ef6acd4a0 in zif_array_splice /tmp/php-asan/ext/standard/array.c:3831:2
    #24 0x557ef734ebc2 in ZEND_DO_ICALL_SPEC_RETVAL_UNUSED_HANDLER /tmp/php-asan/Zend/zend_vm_execute.h:1299:2
    #25 0x557ef71b183d in execute_ex /tmp/php-asan/Zend/zend_vm_execute.h:58565:7
    #26 0x557ef71b2067 in zend_execute /tmp/php-asan/Zend/zend_vm_execute.h:64217:2
    #27 0x557ef75e6860 in zend_execute_script /tmp/php-asan/Zend/zend.c:1932:3
    #28 0x557ef6e04d2b in php_execute_script_ex /tmp/php-asan/main/main.c:2574:13
    #29 0x557ef6e05228 in php_execute_script /tmp/php-asan/main/main.c:2614:9

previously allocated by thread T0 here:
    #0 0x557ef60879ae in malloc /opt/llvm-15-build/llvm-15.x/final/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3
    #1 0x557ef7045ce3 in __zend_malloc /tmp/php-asan/Zend/zend_alloc.c:3280:14
    #2 0x557ef7045670 in _emalloc /tmp/php-asan/Zend/zend_alloc.c:2737:10
    #3 0x557ef744b5bf in zend_hash_real_init_mixed_ex /tmp/php-asan/Zend/zend_hash.c:177:10
    #4 0x557ef744b3f7 in zend_hash_real_init_mixed /tmp/php-asan/Zend/zend_hash.c:343:2
    #5 0x557ef72b1c48 in ZEND_INIT_ARRAY_SPEC_CONST_CONST_HANDLER /tmp/php-asan/Zend/zend_vm_execute.h:7770:4
    #6 0x557ef71b183d in execute_ex /tmp/php-asan/Zend/zend_vm_execute.h:58565:7
    #7 0x557ef71b2067 in zend_execute /tmp/php-asan/Zend/zend_vm_execute.h:64217:2
    #8 0x557ef75e6860 in zend_execute_script /tmp/php-asan/Zend/zend.c:1932:3
    #9 0x557ef6e04d2b in php_execute_script_ex /tmp/php-asan/main/main.c:2574:13
    #10 0x557ef6e05228 in php_execute_script /tmp/php-asan/main/main.c:2614:9
    #11 0x557ef75ee309 in do_cli /tmp/php-asan/sapi/cli/php_cli.c:935:5
    #12 0x557ef75eb32c in main /tmp/php-asan/sapi/cli/php_cli.c:1310:18
    #13 0x7fd70f229d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16

SUMMARY: AddressSanitizer: heap-use-after-free /tmp/php-asan/Zend/zend_types.h:650:18 in zval_get_type
Shadow bytes around the buggy address:
  0x0c247fffdae0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c247fffdaf0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c247fffdb00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c247fffdb10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c247fffdb20: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
=>0x0c247fffdb30: fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd fd fd
  0x0c247fffdb40: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c247fffdb50: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c247fffdb60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c247fffdb70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c247fffdb80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==1989996==ABORTING

Requires USE_ZEND_ALLOC=0

PHP Version

PHP 8.5.0-dev

Operating System

No response

[cmb69]

I'm closing as duplicate of #16648; while a different function, the root cause is the same.

[iluuu1994]

I would probably keep this open. I don't think there's a shared code-path where this could be solved in a general way, so this will likely need two separate fixes.