Skip to content

SEGV Zend/zend_API.h:2316 dl #17211

Closed
Closed
@YuanchengJiang

Description

@YuanchengJiang

Description

The following code:

<?php
$loaded = dl('dl_test.so');
var_dump(dl_test_test2("World!"));

Resulted in this output:

/home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_API.h:2316:11: runtime error: member access within null pointer of type 'zend_string' (aka 'struct _zend_string')
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_API.h:2316:11

To reproduce:

-d "extension_dir=/home/phpfuzz/WorkSpace/flowfusion/php-src/modules/" -d "zend_test.observer.enabled=1" -d "zend_test.observer.observe_functions=1"

PHP Version

nightly

Operating System

No response

Activity

cmb69

cmb69 commented on Dec 18, 2024

@cmb69
Member

This either has the same root cause as #16811 or #9196, I think.

arnaud-lb

arnaud-lb commented on Dec 19, 2024

@arnaud-lb
Member

What is happening is that after ZEND_SEND_VAL_EX "World!", the arg is overridden here:

*prev_observed_frame(execute_data) = EG(current_observed_frame);

prev_observed_frame() miscomputes the address of the frame because the function doesn't have a temporary to store the previous frame. Normally, we add the temporary in zend_observer_post_startup(), but this is not executed for dl'ed functions:

// Add an observer temporary to store previous observed frames
zend_internal_function *zif;
ZEND_HASH_FOREACH_PTR(CG(function_table), zif) {
++zif->T;
} ZEND_HASH_FOREACH_END();
zend_class_entry *ce;
ZEND_HASH_MAP_FOREACH_PTR(CG(class_table), ce) {
ZEND_HASH_MAP_FOREACH_PTR(&ce->function_table, zif) {
++zif->T;
} ZEND_HASH_FOREACH_END();
} ZEND_HASH_FOREACH_END();

self-assigned this
on Dec 19, 2024
added a commit that references this issue on Dec 20, 2024
6f57993
arnaud-lb

arnaud-lb commented on Dec 20, 2024

@arnaud-lb
Member

Thank you @YuanchengJiang!

added a commit that references this issue on Mar 13, 2025
7c10956
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

    Development

    No branches or pull requests

      Participants

      @arnaud-lb@cmb69@YuanchengJiang

      Issue actions

        SEGV Zend/zend_API.h:2316 dl · Issue #17211 · php/php-src