Closed
Description
Description
Given the following phpt file:
--TEST--
ASan DEADLYSIGNAL SEGV on unknown address
--INI--
error_reporting=E_ALL&~E_DEPRECATED
--FILE--
<?php
class obj implements Serializable {
var $data;
function serialize() {
return serialize($this->data);
}
function unserialize($data) {
session_start();
session_decode($data);
}
}
$inner = 'ryat|a:1:{i:0;a:1:{i:1;';
$exploit = 'a:2:{i:0;C:3:"obj":'.strlen($inner).':{'.$inner.'}i:1;R:4;}';
$data = unserialize($exploit);
for ($i = 0; $i < 5; $i++) {
$v[$i] = 'hi'.$i;
}
var_dump($data);
?>
<?php
enum Foo {
case Bar;
public function __sleep(): array {
}
}
?>
--EXTENSIONS--
session
--EXPECTF--
Warning: session_decode(): Failed to decode session object. Session has been destroyed in %s on line %d
Warning: unserialize(): Error at offset 55 of 56 bytes in %s on line %d
bool(false)
Fatal error: Enum Foo cannot include magic method __sleep in %s on line %d
Resulted in this output:
AddressSanitizer:DEADLYSIGNAL
=================================================================
==491976==ERROR: AddressSanitizer: SEGV on unknown address 0x7ffd00000042 (pc 0x7f26f2481205 bp 0x0000ffffffff sp 0x7ffdf94bc550 T0)
==491976==The signal is caused by a READ memory access.
#0 0x7f26f2481205 in _longjmp (/lib/x86_64-linux-gnu/libc.so.6+0x42205) (BuildId: c289da5071a3399de893d2af81d6a30c62646e1e)
#1 0x565537b6fad8 in _zend_bailout /WorkSpace/php-src/Zend/zend.c:1226:2
#2 0x565536dd1c3f in php_session_decode /WorkSpace/php-src/ext/session/session.c:282:3
#3 0x7f26ed27f59f (<unknown module>)
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/lib/x86_64-linux-gnu/libc.so.6+0x42205) (BuildId: c289da5071a3399de893d2af81d6a30c62646e1e) in _longjmp
PHP Version
PHP 8.4.0-dev
Operating System
ubuntu 22.04