Skip to content

Segfault caused by a derefernce of a high value address #13695

@YuanchengJiang

Description

@YuanchengJiang

Description

The following code:

<?php
ob_start();
echo "*** Testing session_decode() : error functionality ***\n";
$data = "foo|a:3:{i:0;i:1;i:1;i:2;i:2;i:3;}guff|R:1;blah|R:1;";
for($index = 0; $index < strlen($data); $index++) {
    if(session_status() != PHP_SESSION_ACTIVE) { session_start(); }
    echo "\n-- Iteration $index --\n";
    $encoded = substr($data, 0, $index);
    var_dump(session_decode($encoded));
    var_dump($_SESSION);
};

$file_c = __DIR__ . "file_does_not_exist1";
$file_p = __DIR__ . "file_does_not_exist2";
file_put_contents($file_c, "<?php require '$file_p'; class c extends p {} ?>");
file_put_contents($file_p, '<?php class p { protected $var = ""; } ?>');
require $file_c;
$a = new c();
require $file_c;
?>

Resulted in this output: (asan enabled)

Segmentation fault (core dumped)

or

==1523719==ERROR: AddressSanitizer: SEGV on unknown address (pc 0x7f28d5b0b31e bp 0x65f9f2bee1cf8551 sp 0xece1f2bee1a4f502 T0)
==1523719==The signal is caused by a READ memory access.
==1523719==Hint: this fault was caused by a dereference of a high value address (see register values below).  Disassemble the provided pc to learn which register was used.
AddressSanitizer:DEADLYSIGNAL

PHP Version

PHP 8.4.0-dev

Operating System

ubuntu 22.04

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions