Description
Originally reported by @f9j2n6nd8k-eng.
The following code:
<?php
class Evil {
public function __serialize(): array {
global $dll;
unset($dll[0]); // frees the current element while var.c:991 iterates its array
return [];
}
}
$dll = new SplDoublyLinkedList();
$dll->push([new Evil(), "pad1", "pad2"]);
$dll->push("victim");
echo $dll->serialize(), "\n";Resulted in this output:
==32873==ERROR: AddressSanitizer: heap-use-after-free on address 0x606000039bc8 at pc 0x000100f88ab8 bp 0x00016f85c710 sp 0x00016f85c708
READ of size 4 at 0x606000039bc8 thread T0
#0 0x000100f88ab4 in php_var_serialize_nested_data var.c:991
#1 0x000100f7e854 in php_var_serialize_intern var.c:1307
#2 0x000100f7cf50 in php_var_serialize var.c:1323
...
freed by thread T0 here:
#0 0x0001047d9258 in free+0x7c (libclang_rt.asan_osx_dynamic.dylib:arm64e+0x41258)
#1 0x000100d93234 in zim_SplDoublyLinkedList_offsetUnset spl_dllist.c:796
#2 0x000101324a24 in zend_call_function zend_execute_API.c
...
0x606000039bc8 is located 8 bytes inside of 56-byte region [0x606000039bc0,0x606000039bf8)
PHP Version
Operating System
No response
Reactions are currently unavailable
Description
Originally reported by @f9j2n6nd8k-eng.
The following code:
Resulted in this output:
==32873==ERROR: AddressSanitizer: heap-use-after-free on address 0x606000039bc8 at pc 0x000100f88ab8 bp 0x00016f85c710 sp 0x00016f85c708 READ of size 4 at 0x606000039bc8 thread T0 #0 0x000100f88ab4 in php_var_serialize_nested_data var.c:991 #1 0x000100f7e854 in php_var_serialize_intern var.c:1307 #2 0x000100f7cf50 in php_var_serialize var.c:1323 ... freed by thread T0 here: #0 0x0001047d9258 in free+0x7c (libclang_rt.asan_osx_dynamic.dylib:arm64e+0x41258) #1 0x000100d93234 in zim_SplDoublyLinkedList_offsetUnset spl_dllist.c:796 #2 0x000101324a24 in zend_call_function zend_execute_API.c ... 0x606000039bc8 is located 8 bytes inside of 56-byte region [0x606000039bc0,0x606000039bf8)PHP Version
Operating System
No response