Skip to content

Null pointer deref in observer API when calling cases() method on preloaded enum #17715

Description

@TimWolla

Description

The following code:

test5.php

<?php

spl_autoload_register(static function ($class) {
	if ($class === 'MyEnum') {
		require_once(__DIR__ . '/preload.php');
	}
});

var_dump(MyEnum::cases());

preload.php

<?php

enum MyEnum
{
	case Foo;
}

executed as:

sapi/cli/php -d zend_extension=$(pwd)/modules/opcache.so -d opcache.enable_cli=1 -d opcache.preload=$(pwd)/preload.php -d zend_test.observer.enabled=1 -d zend_test.observer.observe_all=1 test5.php 

Resulted in this output:

<!-- init 'php-src/preload.php' -->
<file 'php-src/preload.php'>
</file 'php-src/preload.php'>
<!-- init 'php-src/test5.php' -->
<file 'php-src/test5.php'>
  <!-- init spl_autoload_register() -->
  <spl_autoload_register>
  </spl_autoload_register>
Zend/zend_observer.h:108:82: runtime error: applying zero offset to null pointer
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior Zend/zend_observer.h:108:82 in 
Zend/zend_observer.h:92:9: runtime error: load of null pointer of type 'zend_observer_fcall_begin_handler' (aka 'void (*)(struct _zend_execute_data *)')
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior Zend/zend_observer.h:92:9 in 
AddressSanitizer:DEADLYSIGNAL
=================================================================
==511299==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x55c2312b95f7 bp 0x7fff01e61950 sp 0x7fff01e61940 T0)
==511299==The signal is caused by a READ memory access.
==511299==Hint: address points to the zero page.
    #0 0x55c2312b95f7 in zend_observer_handler_is_unobserved php-src/Zend/zend_observer.h:92:18
    #1 0x55c2312b9571 in zend_observer_fcall_has_no_observers php-src/Zend/zend_observer.h:109:9
    #2 0x55c2312b8d30 in zend_observer_fcall_begin_specialized php-src/Zend/zend_observer.h:115:7
    #3 0x55c230ecc1a7 in ZEND_DO_FCALL_SPEC_OBSERVER_HANDLER php-src/Zend/zend_vm_execute.h:2153:3
    #4 0x55c230c29d87 in execute_ex php-src/Zend/zend_vm_execute.h:58595:7
    #5 0x55c230c2afa2 in zend_execute php-src/Zend/zend_vm_execute.h:64247:2
    #6 0x55c2317528e8 in zend_execute_script php-src/Zend/zend.c:1943:3
    #7 0x55c2302e1ae6 in php_execute_script_ex php-src/main/main.c:2584:13
    #8 0x55c2302e2388 in php_execute_script php-src/main/main.c:2624:9
    #9 0x55c23176103a in do_cli php-src/sapi/cli/php_cli.c:946:5
    #10 0x55c23175ca32 in main php-src/sapi/cli/php_cli.c:1346:18
    #11 0x7f4cd2a2a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #12 0x7f4cd2a2a28a in __libc_start_main csu/../csu/libc-start.c:360:3
    #13 0x55c22e403374 in _start (php-src/sapi/cli/php+0x1c03374) (BuildId: 3ddbca74c8670516864203a517f20c02cff6881a)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV php-src/Zend/zend_observer.h:92:18 in zend_observer_handler_is_unobserved
==511299==ABORTING

But I expected this output instead:

<!-- init 'php-src/test5.php' -->
<file 'php-src/test5.php'>
  <!-- init spl_autoload_register() -->
  <spl_autoload_register>
  </spl_autoload_register>
  <!-- init MyEnum::cases() -->
  <MyEnum::cases>
  </MyEnum::cases>
  <!-- init var_dump() -->
  <var_dump>
array(1) {
  [0]=>
  enum(MyEnum::Foo)
}
  </var_dump>
</file 'php-src/test5.php'>

PHP Version

git master

Operating System

No response

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions