View Issue Details

IDProjectCategoryView StatusLast Update
0001091XdebugUncategorizedpublic2021-04-14 16:10
Reporterhakon Assigned To 
PrioritynormalSeveritymajorReproducibilityalways
Status closedResolutionno change required 
OSLinux 
Product Version2.2.6 
Summary0001091: Memory corruption when throwing a message that overrides the 'message' property
Description

If a class extending Exception declares a $message property, throwing it causes use-after-free issues leading to memory corruption and random segfaults.

Steps To Reproduce

$ php --version
PHP 5.6.3 (cli) (built: Nov 25 2014 21:45:05)
Copyright (c) 1997-2014 The PHP Group
Zend Engine v2.6.0, Copyright (c) 1998-2014 Zend Technologies
with Xdebug v2.2.6, Copyright (c) 2002-2014, by Derick Rethans

$ cat test_message.php
<?php

class Foo extends \Exception {
public $message;
}

try {
throw new Foo();
} catch (Exception $foo) {
}

$ USE_ZEND_ALLOC=0 valgrind sapi/cli/php test_message.php

==10603== Memcheck, a memory error detector
==10603== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al.
==10603== Using Valgrind-3.10.0 and LibVEX; rerun with -h for copyright info
==10603== Command: sapi/cli/php test_message.php
==10603==
==10603== Invalid read of size 4
==10603== at 0x71580E: zval_delref_p (zend.h:411)
==10603== by 0x71580E: i_zval_ptr_dtor (zend_execute.h:76)
==10603== by 0x71580E: _zval_ptr_dtor (zend_execute_API.c:427)
==10603== by 0x71B676: destroy_zend_class (zend_opcode.c:283)
==10603== by 0x73C3C2: i_zend_hash_bucket_delete (zend_hash.c:182)
==10603== by 0x73C3C2: zend_hash_bucket_delete (zend_hash.c:192)
==10603== by 0x73E2FA: zend_hash_reverse_apply (zend_hash.c:733)
==10603== by 0x7153C0: shutdown_executor (zend_execute_API.c:303)
==10603== by 0x72BC77: zend_deactivate (zend.c:963)
==10603== by 0x69EB81: php_request_shutdown (main.c:1884)
==10603== by 0x84BE73: do_cli (php_cli.c:1177)
==10603== by 0x84C567: main (php_cli.c:1378)
==10603== Address 0x113f8850 is 16 bytes inside a block of size 32 free'd
==10603== at 0x4C2B200: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==10603== by 0x6F4B02: _efree (zend_alloc.c:2437)
==10603== by 0x71586E: i_zval_ptr_dtor (zend_execute.h:80)
==10603== by 0x71586E: _zval_ptr_dtor (zend_execute_API.c:427)
==10603== by 0x73DC39: zend_hash_destroy (zend_hash.c:548)
==10603== by 0x75E857: zend_object_std_dtor (zend_objects.c:44)
==10603== by 0x75ECC4: zend_objects_free_object_storage (zend_objects.c:137)
==10603== by 0x768A90: zend_objects_store_del_ref_by_handle_ex (zend_objects_API.c:226)
==10603== by 0x768789: zend_objects_store_del_ref (zend_objects_API.c:178)
==10603== by 0x7299BD: _zval_dtor_func (zend_variables.c:57)
==10603== by 0x715862: _zval_dtor (zend_variables.h:35)
==10603== by 0x715862: i_zval_ptr_dtor (zend_execute.h:79)
==10603== by 0x715862: _zval_ptr_dtor (zend_execute_API.c:427)
==10603== by 0x73C3C2: i_zend_hash_bucket_delete (zend_hash.c:182)
==10603== by 0x73C3C2: zend_hash_bucket_delete (zend_hash.c:192)
==10603== by 0x73E2FA: zend_hash_reverse_apply (zend_hash.c:733)

TagsNo tags attached.
Operating SystemArch Linux
PHP Version5.6.0-5.6.4

Activities

derick

2014-11-28 11:33

administrator   ~0002918

Just letting you know that I can reproduce this... no clue about a fix though (yet)!

derick

2016-11-29 23:51

administrator   ~0003852

I can reproduce this with PHP 5.5 and 5.6, but not with 7.0 or 7.1.

derick

2021-03-17 09:39

administrator   ~0005772

Is this issue still relevant to you?

derick

2021-04-14 16:10

administrator   ~0005846

Closing this, as it is missing requested feedback.