Side effects during zend_assign_to_typed_ref_ex() may modify the reference being assigned to #20318
Description
Description
First reported by @iluuu1994 in #15961 (comment).
The following code:
class C { public mixed $prop1; public ?string $prop2; public function __toString() { unset($this->prop1); unset($this->prop2); return 'bar'; } } function test() { $c = new C(); $c->prop1 = 'foo'; $c->prop1 = &$c->prop2; $c->prop1 = $c; var_dump($c); } test();Results in a use-after-free:
==2046482==ERROR: AddressSanitizer: heap-use-after-free on address 0x7ba84ae17f28 at pc 0x000001ec6c7a bp 0x7ffc1e84ef70 sp 0x7ffc1e84ef68 READ of size 8 at 0x7ba84ae17f28 thread T0 #0 0x000001ec6c79 in zend_verify_ref_assignable_zval Zend/zend_execute.c:3972 #1 0x000001ec7c85 in zend_assign_to_typed_ref_ex Zend/zend_execute.c:4048 #2 0x00000235f3a6 in zend_assign_to_variable_ex Zend/zend_execute.h:198 #3 0x00000236c5cb in zend_std_write_property Zend/zend_object_handlers.c:1108 #4 0x000002126976 in ZEND_ASSIGN_OBJ_SPEC_CV_CONST_OP_DATA_CV_HANDLER Zend/zend_vm_execute.h:44861 #5 0x0000021c4a2c in execute_ex Zend/zend_vm_execute.h:120524 #6 0x0000021c9900 in zend_execute Zend/zend_vm_execute.h:121476 #7 0x00000243e999 in zend_execute_script Zend/zend.c:1977 #8 0x00000199551f in php_execute_script_ex main/main.c:2640 #9 0x000001995a49 in php_execute_script main/main.c:2680 #10 0x00000244707e in do_cli sapi/cli/php_cli.c:951 #11 0x00000244a9b4 in main sapi/cli/php_cli.c:1362 #12 0x7f684c011574 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 #13 0x7f684c011627 in __libc_start_main_impl ../csu/libc-start.c:360 #14 0x000000402eb4 in _start (sapi/cli/php+0x402eb4) (BuildId: b4e601b8ae67ff842acabff31f3d1f47e0a6dd3b) There are multiple issues:
First, variable_ptr may be freed or turned to a non-reference by coercion side effects during the zend_verify_ref_assignable_zval() call here:
Line 4048 in 292e0c2
Then, effects may modify the reference type list while it's being iterated by zend_verify_ref_assignable_zval(), which results in UAFs or invalid typing (as some types may be skipped).
PHP Version
PHP 8.3 Operating System
No response