mb_list_encodings() can cause crashes on shutdown

[chongwick]

Description

The following code:

<?php
$v_14545 = chr(246);
$v_14547 = mb_list_encodings();
if ($v_14545) {
        $v_14537 = mb_detect_encoding($v_14545,$v_14547,True);
}

Resulted in this output:

==536652==ERROR: AddressSanitizer: heap-use-after-free on address 0x606000089060 at pc 0x55965b13bfdc bp 0x7ffeda239ee0 sp 0x7ffeda239ed0
READ of size 4 at 0x606000089060 thread T0
 out    #0 0x55965b13bfdb in zend_gc_delref /home/nightly_php/php-src/Zend/zend_types.h:1371
    #1 0x55965b13bfdb in i_zval_ptr_dtor /home/nightly_php/php-src/Zend/zend_variables.h:44
    #2 0x55965b13bfdb in zval_ptr_dtor /home/nightly_php/php-src/Zend/zend_variables.c:84
    #3 0x55965afe74e8 in _zend_hash_del_el_ex /home/nightly_php/php-src/Zend/zend_hash.c:1486
    #4 0x55965afe74e8 in _zend_hash_del_el /home/nightly_php/php-src/Zend/zend_hash.c:1513
    #5 0x55965afe74e8 in zend_hash_graceful_reverse_destroy /home/nightly_php/php-src/Zend/zend_hash.c:2038
    #6 0x55965ac57a5e in zend_shutdown_executor_values /home/nightly_php/php-src/Zend/zend_execute_API.c:285
    #7 0x55965ac5a9f2 in shutdown_executor /home/nightly_php/php-src/Zend/zend_execute_API.c:455
    #8 0x55965b15912a in zend_deactivate /home/nightly_php/php-src/Zend/zend.c:1350
    #9 0x55965a8e41ba in php_request_shutdown /home/nightly_php/php-src/main/main.c:1969
    #10 0x55965b15dff9 in do_cli /home/nightly_php/php-src/sapi/cli/php_cli.c:1159
    #11 0x5596593fa562 in main /home/nightly_php/php-src/sapi/cli/php_cli.c:1363
    #12 0x14793546cd8f  (/lib/x86_64-linux-gnu/libc.so.6+0x29d8f)
    #13 0x14793546ce3f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e3f)
    #14 0x5596593fb8b4 in _start (/home/nightly_php/php-src/sapi/cli/php+0x2f7d8b4)

0x606000089060 is located 0 bytes inside of 56-byte region [0x606000089060,0x606000089098)
freed by thread T0 here:
    #0 0x14793926e537 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:127
    #1 0x559659e21cac in zm_deactivate_mbstring /home/nightly_php/php-src/ext/mbstring/mbstring.c:1164
    #2 0x55965ab3e449 in zend_deactivate_modules /home/nightly_php/php-src/Zend/zend_API.c:3425
    #3 0x55965a8e48ba in php_request_shutdown /home/nightly_php/php-src/main/main.c:1946
    #4 0x55965b15dff9 in do_cli /home/nightly_php/php-src/sapi/cli/php_cli.c:1159
    #5 0x5596593fa562 in main /home/nightly_php/php-src/sapi/cli/php_cli.c:1363
    #6 0x14793546cd8f  (/lib/x86_64-linux-gnu/libc.so.6+0x29d8f)

previously allocated by thread T0 here:
    #0 0x14793926e887 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
    #1 0x55965aafad14 in __zend_malloc /home/nightly_php/php-src/Zend/zend_alloc.c:3518
    #2 0x559659e2e314 in zif_mb_list_encodings /home/nightly_php/php-src/ext/mbstring/mbstring.c:3496
    #3 0x55965af56e18 in ZEND_DO_ICALL_SPEC_RETVAL_USED_HANDLER /home/nightly_php/php-src/Zend/zend_vm_execute.h:1408
    #4 0x55965af56e18 in execute_ex /home/nightly_php/php-src/Zend/zend_vm_execute.h:58921
    #5 0x55965af93eaf in zend_execute /home/nightly_php/php-src/Zend/zend_vm_execute.h:64384
    #6 0x55965b15a34f in zend_execute_script /home/nightly_php/php-src/Zend/zend.c:1943
    #7 0x55965a8e7363 in php_execute_script_ex /home/nightly_php/php-src/main/main.c:2594
    #8 0x55965b16027a in do_cli /home/nightly_php/php-src/sapi/cli/php_cli.c:952
    #9 0x5596593fa562 in main /home/nightly_php/php-src/sapi/cli/php_cli.c:1363
    #10 0x14793546cd8f  (/lib/x86_64-linux-gnu/libc.so.6+0x29d8f)

SUMMARY: AddressSanitizer: heap-use-after-free /home/nightly_php/php-src/Zend/zend_types.h:1371 in zend_gc_delref
Shadow bytes around the buggy address:
  0x0c0c800091b0: 00 00 00 fa fa fa fa fa fd fd fd fd fd fd fd fa
  0x0c0c800091c0: fa fa fa fa 00 00 00 00 00 00 00 fa fa fa fa fa
  0x0c0c800091d0: fd fd fd fd fd fd fd fa fa fa fa fa 00 00 00 00
  0x0c0c800091e0: 00 00 00 fa fa fa fa fa fd fd fd fd fd fd fd fa
  0x0c0c800091f0: fa fa fa fa 00 00 00 00 00 00 00 fa fa fa fa fa
=>0x0c0c80009200: fd fd fd fd fd fd fd fd fa fa fa fa[fd]fd fd fd
  0x0c0c80009210: fd fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0c80009220: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0c80009230: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0c80009240: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0c80009250: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==536652==ABORTING

But I expected this output instead:

PHP Version

nightly

Operating System

ubuntu 22.04

[devnexen]

Hi @chongwick can t reproduce. can you give more context on how you trigger it (e.g. options given to php cli) ? ./configure options ?

[youkidearitai]

I can't reproduce too. Could you tell me configure option?

[ndossche]

Maintainer tip: whenever you see a report that crashes in the shutdown sequence but cannot reproduce it, it may be because it happens in the fast shutdown path. The fast shutdown is disabled in debug builds (unless the ZEND_ASAN_FORCE_FAST_SHUTDOWN environment variable hack is enabled, this is new on 8.5-dev; beware of the fake memleak messages though).
Anyway, if you want to reproduce this on all branches, use: ./configure --enable-debug-assertions --disable-all --enable-address-sanitizer --enable-mbstring

[ndossche]

On first sight something like this ought to work:

diff --git a/ext/mbstring/mbstring.c b/ext/mbstring/mbstring.c
index f4e50fbd7c8..0c7616564a5 100644
--- a/ext/mbstring/mbstring.c
+++ b/ext/mbstring/mbstring.c
@@ -1160,8 +1160,7 @@ PHP_RSHUTDOWN_FUNCTION(mbstring)
 	MBSTRG(outconv_state) = 0;
 
 	if (MBSTRG(all_encodings_list)) {
-		GC_DELREF(MBSTRG(all_encodings_list));
-		zend_array_destroy(MBSTRG(all_encodings_list));
+		zend_array_release(MBSTRG(all_encodings_list));
 		MBSTRG(all_encodings_list) = NULL;
 	}
 

But I don't have time to check it now.

[youkidearitai]

Hmm, I can't still reproduce it...(Tried x86_64 and Raspberry Pi)
configure option is below:

Configure Command =>  './configure'  '--enable-debug-assertions' '--disable-all' '--enable-address-sanitizer' '--enable-mbstring'

[ndossche]

Did you set the environment variable USE_ZEND_ALLOC=0 ?

[youkidearitai]

@nielsdos Thank you very much. Reproduced it.

$ export USE_ZEND_ALLOC=0
$ sapi/cli/php uaf.php
=================================================================
==1840417==ERROR: AddressSanitizer: heap-use-after-free on address 0x007f9b41a480 at pc 0x00557a062154 bp 0x007fca3db2a0 sp 0x007fca3db2b8
READ of size 4 at 0x007f9b41a480 thread T0
    #0 0x557a062150 in zend_gc_delref /home/tekimen/src/php-src/Zend/zend_types.h:1383
    #1 0x557a062150 in i_zval_ptr_dtor /home/tekimen/src/php-src/Zend/zend_variables.h:44
    #2 0x557a062150 in i_zval_ptr_dtor /home/tekimen/src/php-src/Zend/zend_variables.h:40
    #3 0x557a062150 in zval_ptr_dtor /home/tekimen/src/php-src/Zend/zend_variables.c:84
    #4 0x5579fa5b4c in _zend_hash_del_el_ex /home/tekimen/src/php-src/Zend/zend_hash.c:1486
    #5 0x5579fa5b4c in _zend_hash_del_el /home/tekimen/src/php-src/Zend/zend_hash.c:1513
    #6 0x5579fa5b4c in zend_hash_graceful_reverse_destroy /home/tekimen/src/php-src/Zend/zend_hash.c:2038
    #7 0x5579e162c4 in zend_shutdown_executor_values /home/tekimen/src/php-src/Zend/zend_execute_API.c:285
    #8 0x5579e17be8 in shutdown_executor /home/tekimen/src/php-src/Zend/zend_execute_API.c:455
    #9 0x557a073554 in zend_deactivate /home/tekimen/src/php-src/Zend/zend.c:1350
    #10 0x5579c3d738 in php_request_shutdown /home/tekimen/src/php-src/main/main.c:2011
    #11 0x557a0774a4 in do_cli /home/tekimen/src/php-src/sapi/cli/php_cli.c:1159
    #12 0x55794a13ec in main /home/tekimen/src/php-src/sapi/cli/php_cli.c:1363
    #13 0x7f9e42773c in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #14 0x7f9e427814 in __libc_start_main_impl ../csu/libc-start.c:360
    #15 0x55794a16ac in _start (/home/tekimen/src/php-src/sapi/cli/php+0x4016ac)

0x007f9b41a480 is located 0 bytes inside of 56-byte region [0x007f9b41a480,0x007f9b41a4b8)
freed by thread T0 here:
    #0 0x7f9e7aa5a0 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:52
    #1 0x5579743b74 in zm_deactivate_mbstring /home/tekimen/src/php-src/ext/mbstring/mbstring.c:1164
    #2 0x5579d71530 in zend_deactivate_modules /home/tekimen/src/php-src/Zend/zend_API.c:3425
    #3 0x5579c3dae0 in php_request_shutdown /home/tekimen/src/php-src/main/main.c:1988
    #4 0x557a0774a4 in do_cli /home/tekimen/src/php-src/sapi/cli/php_cli.c:1159
    #5 0x55794a13ec in main /home/tekimen/src/php-src/sapi/cli/php_cli.c:1363
    #6 0x7f9e42773c in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #7 0x7f9e427814 in __libc_start_main_impl ../csu/libc-start.c:360
    #8 0x55794a16ac in _start (/home/tekimen/src/php-src/sapi/cli/php+0x4016ac)

previously allocated by thread T0 here:
    #0 0x7f9e7ab734 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
    #1 0x5579d525c4 in __zend_malloc /home/tekimen/src/php-src/Zend/zend_alloc.c:3561
    #2 0x5579741ba0 in zif_mb_list_encodings /home/tekimen/src/php-src/ext/mbstring/mbstring.c:3496
    #3 0x557948ed34 in ZEND_DO_ICALL_SPEC_RETVAL_USED_HANDLER /home/tekimen/src/php-src/Zend/zend_vm_execute.h:1408
    #4 0x5579f76478 in execute_ex /home/tekimen/src/php-src/Zend/zend_vm_execute.h:58935
    #5 0x5579f78a20 in zend_execute /home/tekimen/src/php-src/Zend/zend_vm_execute.h:64398
    #6 0x557a0740e4 in zend_execute_script /home/tekimen/src/php-src/Zend/zend.c:1976
    #7 0x5579c3f8c0 in php_execute_script_ex /home/tekimen/src/php-src/main/main.c:2634
    #8 0x557a0783f4 in do_cli /home/tekimen/src/php-src/sapi/cli/php_cli.c:952
    #9 0x55794a13ec in main /home/tekimen/src/php-src/sapi/cli/php_cli.c:1363
    #10 0x7f9e42773c in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #11 0x7f9e427814 in __libc_start_main_impl ../csu/libc-start.c:360
    #12 0x55794a16ac in _start (/home/tekimen/src/php-src/sapi/cli/php+0x4016ac)

SUMMARY: AddressSanitizer: heap-use-after-free /home/tekimen/src/php-src/Zend/zend_types.h:1383 in zend_gc_delref
Shadow bytes around the buggy address:
  0x001ff3683440: 00 00 00 00 fa fa fa fa 00 00 00 00 00 00 00 00
  0x001ff3683450: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x001ff3683460: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x001ff3683470: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x001ff3683480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x001ff3683490:[fd]fd fd fd fd fd fd fa fa fa fa fa fd fd fd fd
  0x001ff36834a0: fd fd fd fd fa fa fa fa 00 00 00 00 00 00 00 00
  0x001ff36834b0: fa fa fa fa 00 00 00 00 00 00 00 fa fa fa fa fa
  0x001ff36834c0: 00 00 00 00 00 00 00 fa fa fa fa fa 00 00 00 00
  0x001ff36834d0: 00 00 00 fa fa fa fa fa 00 00 00 00 00 00 00 fa
  0x001ff36834e0: fa fa fa fa 00 00 00 00 00 00 00 fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==1840417==ABORTING