Skip to content

Fix use-after-free in write_property when object is released #10179

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 1 commit into from
Closed

Fix use-after-free in write_property when object is released #10179

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
37 changes: 37 additions & 0 deletions Zend/tests/gh10169.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,37 @@
--TEST--
GH-10169: Fix use-after-free when releasing object during property assignment
--FILE--
<?php
class A
{
public string $prop;
}
class B
{
public function __toString()
{
global $a;
$a = null;
return str_repeat('a', 1);
}
}

$a = new A();
try {
$a->prop = new B();
} catch (Error $e) {
echo $e->getMessage(), "\n";
}

$a = new A();
$a->prop = '';
try {
$a->prop = new B();
} catch (Error $e) {
echo $e->getMessage(), "\n";
}

?>
--EXPECT--
Object was released while assigning property A::$prop
Object was released while assigning property A::$prop
6 changes: 6 additions & 0 deletions Zend/zend_execute.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -894,6 +894,12 @@ ZEND_API ZEND_COLD void ZEND_FASTCALL zend_readonly_property_indirect_modificati
ZSTR_VAL(info->ce->name), zend_get_unmangled_property_name(info->name));
}

ZEND_API ZEND_COLD void ZEND_FASTCALL zend_object_released_while_assigning_to_property_error(const zend_property_info *info)
{
zend_throw_error(NULL, "Object was released while assigning property %s::$%s",
ZSTR_VAL(info->ce->name), zend_get_unmangled_property_name(info->name));
}

static const zend_class_entry *resolve_single_class_type(zend_string *name, const zend_class_entry *self_ce) {
if (zend_string_equals_literal_ci(name, "self")) {
return self_ce;
Expand Down
2 changes: 2 additions & 0 deletions Zend/zend_execute.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,6 +82,8 @@ ZEND_API ZEND_COLD void zend_wrong_string_offset_error(void);
ZEND_API ZEND_COLD void ZEND_FASTCALL zend_readonly_property_modification_error(const zend_property_info *info);
ZEND_API ZEND_COLD void ZEND_FASTCALL zend_readonly_property_indirect_modification_error(const zend_property_info *info);

ZEND_API ZEND_COLD void ZEND_FASTCALL zend_object_released_while_assigning_to_property_error(const zend_property_info *info);

ZEND_API bool zend_verify_scalar_type_hint(uint32_t type_mask, zval *arg, bool strict, bool is_internal_arg);
ZEND_API ZEND_COLD void zend_verify_arg_error(
const zend_function *zf, const zend_arg_info *arg_info, uint32_t arg_num, zval *value);
Expand Down
24 changes: 22 additions & 2 deletions Zend/zend_object_handlers.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -818,7 +818,17 @@ ZEND_API zval *zend_std_write_property(zend_object *zobj, zend_string *name, zva
}

ZVAL_COPY_VALUE(&tmp, value);
if (UNEXPECTED(!zend_verify_property_type(prop_info, &tmp, property_uses_strict_types()))) {
// Increase refcount to prevent object from being released in __toString()
GC_ADDREF(zobj);
bool type_matched = zend_verify_property_type(prop_info, &tmp, property_uses_strict_types());
if (UNEXPECTED(GC_DELREF(zobj) == 0)) {
zend_object_released_while_assigning_to_property_error(prop_info);
zend_objects_store_del(zobj);
zval_ptr_dtor(&tmp);
variable_ptr = &EG(error_zval);
goto exit;
}
if (UNEXPECTED(!type_matched)) {
Z_TRY_DELREF_P(value);
variable_ptr = &EG(error_zval);
goto exit;
Expand Down Expand Up @@ -889,7 +899,17 @@ ZEND_API zval *zend_std_write_property(zend_object *zobj, zend_string *name, zva
}

ZVAL_COPY_VALUE(&tmp, value);
if (UNEXPECTED(!zend_verify_property_type(prop_info, &tmp, property_uses_strict_types()))) {
// Increase refcount to prevent object from being released in __toString()
GC_ADDREF(zobj);
bool type_matched = zend_verify_property_type(prop_info, &tmp, property_uses_strict_types());
if (UNEXPECTED(GC_DELREF(zobj) == 0)) {
zend_object_released_while_assigning_to_property_error(prop_info);
zend_objects_store_del(zobj);
zval_ptr_dtor(&tmp);
variable_ptr = &EG(error_zval);
goto exit;
}
if (UNEXPECTED(!type_matched)) {
zval_ptr_dtor(value);
goto exit;
}
Expand Down