mirror of
https://github.com/php/php-src.git
synced 2026-03-24 00:02:20 +01:00
ee0143887d
The problem is that the code is doing `php_output_handler_free` in a loop on the output stack, but prior to freeing the pointer on the stack in `php_output_handler_free` it calls `php_output_handler_dtor` which can run user code that reallocates the stack, resulting in a dangling pointer freed by php_output_handler_free. Furthermore, OG(active) is set when creating a new output handler, but the loop is supposed to clean up all handlers, so OG(active) must be reset as well. Closes GH-20356.
25 lines
610 B
PHP
25 lines
610 B
PHP
--TEST--
|
|
GH-20352 (UAF in php_output_handler_free via re-entrant ob_start() during error deactivation)
|
|
--FILE--
|
|
<?php
|
|
class Test {
|
|
public function __destruct() {
|
|
// Spray output stack
|
|
for ($i = 0; $i < 1000; $i++)
|
|
ob_start(static function() {});
|
|
}
|
|
|
|
public function __invoke($x) {
|
|
// Trigger php_output_deactivate() through forbidden operation
|
|
ob_start('foo');
|
|
return $x;
|
|
}
|
|
}
|
|
|
|
ob_start(new Test, 1);
|
|
|
|
echo "trigger bug";
|
|
?>
|
|
--EXPECTF--
|
|
Fatal error: ob_start(): Cannot use output buffering in output buffering display handlers in %s on line %d
|