Stack buffer overflow error found by AddressSanitizer

[pfustc]

Description

We found below stack buffer overflow error by address sanitizer while running Symfony tests. It can be reproduced with PHP master on both x86 and AArch64.

AddressSanitizer: stack-buffer-overflow /tmp/php-src/Zend/zend_alloc.c:1291 in zend_mm_alloc_small_slow

To reproduce, follow below scripts.

• Checkout and build PHP master with address sanitizer

cd /tmp
git clone git@github.com:php/php-src.git
cd php-src
bash buildconf -f
bash configure --enable-address-sanitizer --enable-debug --enable-bcmath \
  --enable-calendar --enable-dba --enable-exif --enable-fpm --enable-ftp \
  --enable-gd --enable-intl --enable-mbstring --enable-option-checking=fatal \
  --enable-pcntl --enable-phpdbg --enable-shmop --enable-soap --enable-sockets \
  --enable-sysvmsg --enable-sysvsem --enable-xmlreader --enable-zend-test
make -j 10

• Install Symfony and run the VarDumper test

cd /tmp
git clone https://github.com/symfony/symfony.git
cd symfony
composer install
php ./phpunit install
/tmp/php-src/sapi/cli/php ./phpunit src/Symfony/Component/VarDumper

Full error message

==703762==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7f6c8b1fffa0 at pc 0x558d19e3103e bp 0x7fff5e085710 sp 0x7fff5e085700
WRITE of size 8 at 0x7f6c8b1fffa0 thread T0
    #0 0x558d19e3103d in zend_mm_alloc_small_slow /tmp/php-src/Zend/zend_alloc.c:1291
    #1 0x558d19e31226 in zend_mm_alloc_small /tmp/php-src/Zend/zend_alloc.c:1315
    #2 0x558d19e3164c in zend_mm_alloc_heap /tmp/php-src/Zend/zend_alloc.c:1383
    #3 0x558d19e38321 in _emalloc /tmp/php-src/Zend/zend_alloc.c:2615
    #4 0x558d19f12c29 in zend_hash_real_init_packed_ex /tmp/php-src/Zend/zend_hash.c:157
    #5 0x558d19f1a757 in _zend_hash_index_add_or_update_i /tmp/php-src/Zend/zend_hash.c:1147
    #6 0x558d19f1af82 in zend_hash_next_index_insert /tmp/php-src/Zend/zend_hash.c:1221
    #7 0x558d19e7d8d4 in zend_try_ct_eval_array /tmp/php-src/Zend/zend_compile.c:8919
    #8 0x558d19e8d164 in zend_eval_const_expr /tmp/php-src/Zend/zend_compile.c:10891
    #9 0x558d19e7ccbf in zend_try_ct_eval_array /tmp/php-src/Zend/zend_compile.c:8826
    #10 0x558d19e84994 in zend_compile_array /tmp/php-src/Zend/zend_compile.c:9700
    #11 0x558d19e8af1e in zend_compile_expr_inner /tmp/php-src/Zend/zend_compile.c:10566
    #12 0x558d19e8b043 in zend_compile_expr /tmp/php-src/Zend/zend_compile.c:10604
    #13 0x558d19e615e9 in zend_compile_return /tmp/php-src/Zend/zend_compile.c:5161
    #14 0x558d19e8a619 in zend_compile_stmt /tmp/php-src/Zend/zend_compile.c:10364
    #15 0x558d19e8a26e in zend_compile_top_stmt /tmp/php-src/Zend/zend_compile.c:10330
    #16 0x558d19e8a053 in zend_compile_top_stmt /tmp/php-src/Zend/zend_compile.c:10316
    #17 0x558d19de6f76 in zend_compile Zend/zend_language_scanner.l:618
    #18 0x558d19de7417 in compile_file Zend/zend_language_scanner.l:653
    #19 0x558d1984dde3 in phar_compile_file /tmp/php-src/ext/phar/phar.c:3349
    #20 0x558d19de7b09 in compile_filename Zend/zend_language_scanner.l:704
    #21 0x558d19f777b4 in zend_include_or_eval /tmp/php-src/Zend/zend_execute.c:4926
    #22 0x558d19fa4026 in ZEND_INCLUDE_OR_EVAL_SPEC_CONST_HANDLER /tmp/php-src/Zend/zend_vm_execute.h:4979
    #23 0x558d1a0de617 in execute_ex /tmp/php-src/Zend/zend_vm_execute.h:57626
    #24 0x558d1a0f0f51 in zend_execute /tmp/php-src/Zend/zend_vm_execute.h:61605
    #25 0x558d19eddbc4 in zend_execute_scripts /tmp/php-src/Zend/zend.c:1881
    #26 0x558d19d58da9 in php_execute_script /tmp/php-src/main/main.c:2501
    #27 0x558d1a2ccfb8 in do_cli /tmp/php-src/sapi/cli/php_cli.c:966
    #28 0x558d1a2cedba in main /tmp/php-src/sapi/cli/php_cli.c:1340
    #29 0x7f6c8fe87d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #30 0x7f6c8fe87e3f in __libc_start_main_impl ../csu/libc-start.c:392
    #31 0x558d19009e44 in _start (/tmp/php-src/sapi/cli/php+0x609e44)

Address 0x7f6c8b1fffa0 is a wild pointer.
SUMMARY: AddressSanitizer: stack-buffer-overflow /tmp/php-src/Zend/zend_alloc.c:1291 in zend_mm_alloc_small_slow
Shadow bytes around the buggy address:
  0x0fee11637fa0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0fee11637fb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1
  0x0fee11637fc0: f1 f1 f1 f1 00 f2 f2 f2 00 00 f2 f2 00 00 00 00
  0x0fee11637fd0: 00 00 00 00 00 00 f3 f3 f3 f3 00 00 00 00 00 00
  0x0fee11637fe0: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 f2 f2
=>0x0fee11637ff0: 00 00 00 00[f3]f3 f3 f3 00 00 00 00 00 00 00 00
  0x0fee11638000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0fee11638010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0fee11638020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0fee11638030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0fee11638040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==703762==ABORTING

PHP Version

PHP master @ a92c2da

Operating System

Ubuntu 22.04

[Girgias]

Can this be reduced? I doubt that so many extensions need to be enabled an this would narrow it down.

But also having what test actually causes this would be helpful.

[pfustc]

Can this be reduced? I doubt that so many extensions need to be enabled an this would narrow it down.
But also having what test actually causes this would be helpful.

I have tried reducing this but the ASAN error does not appear if I enable less extensions or run smaller sets of tests.

I'm not quite familiar with these symfony tests. Could you help reduce it a bit?

[Girgias]

I have never used Symfony, so I won't be able to help.

[pfustc]

Hi @iluuu1994, do you have interest to look at this issue reported by ASAN?

[iluuu1994]

@pfustc I'll have a look today or tomorrow.

[iluuu1994]

See google/sanitizers#1705. I have confirmed this is a false-positive.

[pfustc]

Thanks for confirming this. I think I can close this issue now.