php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Use-after-free for ??= due to incorrect live-range calculation

Browse Source 
Fixes GHSA-rwp7-7vc6-8477
This commit is contained in:
Ilija Tovilo
2024-11-13 01:41:40 +01:00
committed by Jakub Zelenka
parent acf2f4988a
commit ef2c459941
5 changed files with 82 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
NEWS
View File

@@ -31,6 +31,8 @@ PHP NEWS
`__callStatic` is allowed). (timwolla)
. Fixed bug GH-17797 (zend_test_compile_string crash on invalid
script path). (David Carlier)
. Fixed GHSA-rwp7-7vc6-8477 (Reference counting in php_request_shutdown
causes Use-After-Free). (CVE-2024-11235) (ilutov)
- DOM:
. Fixed bug GH-17847 (xinclude destroys live node). (nielsdos)

26
Zend/tests/ghsa-rwp7-7vc6-8477_001.phpt Normal file
View File

@@ -0,0 +1,26 @@
--TEST--
GHSA-rwp7-7vc6-8477: Use-after-free for ??= due to incorrect live-range calculation
--FILE--
<?php
class Foo {
public function foo() {
return $this;
}
public function __set($name, $value) {
throw new Exception('Hello');
}
}
$foo = new Foo();
try {
$foo->foo()->baz ??= 1;
} catch (Exception $e) {
echo $e->getMessage();
}
?>
--EXPECT--
Hello

24
Zend/tests/ghsa-rwp7-7vc6-8477_002.phpt Normal file
View File

@@ -0,0 +1,24 @@
--TEST--
GHSA-rwp7-7vc6-8477: Use-after-free for ??= due to incorrect live-range calculation
--FILE--
<?php
class Foo {
public int $prop;
public function foo() {
return $this;
}
}
$foo = new Foo();
try {
$foo->foo()->prop ??= 'foo';
} catch (Error $e) {
echo $e->getMessage();
}
?>
--EXPECT--
Cannot assign string to property Foo::$prop of type int

22
Zend/tests/ghsa-rwp7-7vc6-8477_003.phpt Normal file
View File

@@ -0,0 +1,22 @@
--TEST--
GHSA-rwp7-7vc6-8477: Use-after-free for ??= due to incorrect live-range calculation
--FILE--
<?php
class Foo {
public int $prop;
}
function newFoo() {
return new Foo();
}
try {
newFoo()->prop ??= 'foo';
} catch (Error $e) {
echo $e->getMessage();
}
?>
--EXPECT--
Cannot assign string to property Foo::$prop of type int

8
Zend/zend_opcode.c
View File

@@ -922,6 +922,14 @@ static void zend_calc_live_ranges(
opnum--;
opline--;
/* SEPARATE always redeclares its op1. For the purposes of live-ranges,
* its declaration is irrelevant. Don't terminate the current live-range
* to avoid breaking special handling of COPY_TMP. */
if (opline->opcode == ZEND_SEPARATE) {
ZEND_ASSERT(opline->op1.var == opline->result.var);
continue;
}
if ((opline->result_type & (IS_TMP_VAR|IS_VAR)) && !is_fake_def(opline)) {
uint32_t var_num = EX_VAR_TO_NUM(opline->result.var) - var_offset;
/* Defs without uses can occur for two reasons: Either because the result is