mirror of
https://github.com/php/php-src.git
synced 2026-03-24 00:02:20 +01:00
27ed48c0be
* Fix use-after-free in FE_FREE with GC interaction When FE_FREE with ZEND_FREE_ON_RETURN frees the loop variable during an early return from a foreach loop, the live range for the loop variable was incorrectly extending past the FE_FREE to the normal loop end. This caused GC to access the already-freed loop variable when it ran after the RETURN opcode, resulting in use-after-free. Fix by splitting the ZEND_LIVE_LOOP range when an FE_FREE with ZEND_FREE_ON_RETURN is encountered: - One range covers the early return path up to the FE_FREE - A separate range covers the normal loop end FE_FREE - Multiple early returns create multiple separate ranges * Split the live-ranges of loop variables againb0af9ac733removed the live-range splitting of foreach variables, however it only added handling to ZEND_HANDLE_EXCEPTION. This was sort-of elegant, until it was realized in8258b7731bthat it would leak the return variable, requiring some more special handling. At some point we added live tmpvar rooting in52cf7ab8a2, but this did not take into account already freed loop variables, which also might happen during ZEND_RETURN, which cannot be trivially accounted for, without even more complicated handling in zend_gc_*_tmpvars() functions. This commit also proposes a simpler way of tracking the loop end in loopvar freeing ops: handle it directly during live range computation rather than during compilation, eliminating the need for opcache to handle it specifically. Further, opcache was using live_ranges in its basic block computation in the past, which it no longer does. Thus this complication is no longer necessary and this approach should be actually simpler now. Closes #20766. Signed-off-by: Bob Weinand <bobwei9@hotmail.com> --------- Signed-off-by: Bob Weinand <bobwei9@hotmail.com> Co-authored-by: Gustavo Lopes <mail@geleia.net>
30 lines
746 B
PHP
30 lines
746 B
PHP
--TEST--
|
|
GC 048: FE_FREE should mark variable as UNDEF to prevent use-after-free during GC
|
|
--FILE--
|
|
<?php
|
|
// FE_FREE frees the iterator but doesn't set zval to UNDEF
|
|
// When GC runs during RETURN, zend_gc_remove_root_tmpvars() may access freed memory
|
|
|
|
function test_foreach_early_return(string $s): object {
|
|
foreach ((array) $s as $v) {
|
|
$obj = new stdClass;
|
|
// in the early return, the VAR for the cast result is still live
|
|
return $obj; // the return may trigger GC
|
|
}
|
|
}
|
|
|
|
for ($i = 0; $i < 100000; $i++) {
|
|
// create cyclic garbage to fill GC buffer
|
|
$a = new stdClass;
|
|
$b = new stdClass;
|
|
$a->ref = $b;
|
|
$b->ref = $a;
|
|
|
|
$result = test_foreach_early_return("x");
|
|
}
|
|
|
|
echo "OK\n";
|
|
?>
|
|
--EXPECT--
|
|
OK
|