Segmentation fault ext/phar/phar.c

[YuanchengJiang]

Description

The following code:

<?php
$file = __DIR__ . DIRECTORY_SEPARATOR . 'bug66960.phar';
$phar = new Phar($file);
$phar->decompress();
try {ldap_get_values_len($fname,$fname,$phar);} catch (Exception $e) { echo($e); }

Resulted in this output:

=================================================================
==2919611==ERROR: AddressSanitizer: SEGV on unknown address (pc 0x000003b7a9f3 bp 0x7ffcd7e1b600 sp 0x7ffcd7e1b540 T0)
==2919611==The signal is caused by a READ memory access.
==2919611==Hint: this fault was caused by a dereference of a high value address (see register values below).  Disassemble the provided pc to learn which register was used.
    #0 0x3b7a9f3 in zend_mm_free_heap /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_alloc.c:1528:28
    #1 0x3b80758 in _efree /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_alloc.c:2751:2
    #2 0x21bc898 in phar_destroy_phar_data /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/phar/phar.c:198:3
    #3 0x21bf3b6 in phar_archive_delref /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/phar/phar.c:255:4
    #4 0x21a338c in phar_spl_foreign_dtor /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/phar/phar_object.c:1082:3
    #5 0x2aa994a in spl_filesystem_object_free_storage /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/spl/spl_directory.c:144:3
    #6 0x4baa881 in zend_objects_store_del /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_objects_API.c:194:4
    #7 0x4cbb487 in rc_dtor_func /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_variables.c:57:2
    #8 0x4cbb70e in i_zval_ptr_dtor /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_variables.h:45:4
    #9 0x4cbb4c4 in zval_ptr_dtor /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_variables.c:84:2
    #10 0x47f1e21 in _zend_hash_del_el_ex /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_hash.c:1487:3
    #11 0x47ef59d in _zend_hash_del_el /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_hash.c:1514:2
    #12 0x4808ee4 in zend_hash_reverse_apply /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_hash.c:2230:5
    #13 0x3eeae7c in shutdown_destructors /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_execute_API.c:262:4
    #14 0x4d03c1b in zend_call_destructors /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend.c:1332:3
    #15 0x35151e8 in php_request_shutdown /home/phpfuzz/WorkSpace/flowfusion/php-src/main/main.c:1914:3
    #16 0x4d2c957 in do_cli /home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php_cli.c:1109:3
    #17 0x4d2380f in main /home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php_cli.c:1313:18
    #18 0x7fe732450d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #19 0x7fe732450e3f in __libc_start_main csu/../csu/libc-start.c:392:3
    #20 0x605934 in _start (/home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php+0x605934)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_alloc.c:1528:28 in zend_mm_free_heap
==2919611==ABORTING

To reproduce:

-d "phar.readonly=0"

Dependency: bug66960.phar

PHP Version

nightly

Operating System

ubuntu 22.04

[devnexen]

got different asan report but still crash regardless

AddressSanitizer:DEADLYSIGNAL
=================================================================
==68607==ERROR: AddressSanitizer: SEGV on unknown address 0x000108400000 (pc 0x000181ca3f54 bp 0x00016d3a7d30 sp 0x00016d3a74e0 T0)
==68607==The signal is caused by a READ memory access.
    #0 0x181ca3f54 in _platform_memmove+0x1a4 (libsystem_platform.dylib:arm64e+0x3f54)
    #1 0x10414a8dc in zend_inline_hash_func zend_string.h:474
    #2 0x10414b1f0 in zend_hash_str_del zend_hash.c:1672
    #3 0x10334da1c in phar_archive_delref phar.c:254
    #4 0x103340f6c in phar_spl_foreign_dtor phar_object.c:1082
    #5 0x103564efc in spl_filesystem_object_free_storage spl_directory.c:144
    #6 0x10427e0c0 in zend_objects_store_del zend_objects_API.c:194
    #7 0x1042f99c4 in rc_dtor_func zend_variables.c:57
    #8 0x1042f9b00 in i_zval_ptr_dtor zend_variables.h:45
    #9 0x1042f9a04 in zval_ptr_dtor zend_variables.c:84
    #10 0x104149414 in _zend_hash_del_el_ex zend_hash.c:1487
    #11 0x1041481b8 in _zend_hash_del_el zend_hash.c:1514
    #12 0x104152bf8 in zend_hash_reverse_apply zend_hash.c:2230
    #13 0x103e00b70 in shutdown_destructors zend_execute_API.c:262
    #14 0x104318524 in zend_call_destructors zend.c:1332
    #15 0x1039bfd18 in php_request_shutdown main.c:1914
    #16 0x104329a68 in do_cli php_cli.c:1109
    #17 0x104325144 in main php_cli.c:1313
    #18 0x1818ec270  (<unknown module>)

==68607==Register values:
 x[0] = 0x000000016d3a7d60   x[1] = 0x0000000108400000   x[2] = 0x0000000000000000   x[3] = 0x000000016d3a7d60  
 x[4] = 0x0000000000000000   x[5] = 0x0000000000000000   x[6] = 0x0000000000000000   x[7] = 0x0000000000000001  
 x[8] = 0x000000702da94fac   x[9] = 0x0000000000000000  x[10] = 0x000000702da94fac  x[11] = 0x000000002da74fac  
x[12] = 0x000000002da74fac  x[13] = 0x0000000000000000  x[14] = 0xf3f3f300f1f1f1f1  x[15] = 0x000000016d3a8d00  
x[16] = 0x0000000181ca3db0  x[17] = 0x0000000106db05d0  x[18] = 0x0000000000000000  x[19] = 0x0000000000000008  
x[20] = 0x0000000108400000  x[21] = 0x000000016d3a7d60  x[22] = 0x0000000108400000  x[23] = 0x00000001077990a8  
x[24] = 0xffffffffffffffc7  x[25] = 0x0000000000000000  x[26] = 0x0000000000000000  x[27] = 0x0000000000000000  
x[28] = 0x0000000000000000     fp = 0x000000016d3a7d30     lr = 0x0000000106d599b0     sp = 0x000000016d3a74e0  
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (libsystem_platform.dylib:arm64e+0x3f54) in _platform_memmove+0x1a4
==68607==ABORTING
zsh: abort      sapi/cli/php -d "phar.readonly=0" ~/a.php

[nielsdos]

This is caused by edae243, which really looks like a weird patch honestly, I'll take a look.

[cmb69]

Beat me by a minute. :)