Uh oh!
There was an error while loading. Please reload this page.
Meaningful data type for _parameter_reference's "required" field - #15
Meaningful data type for _parameter_reference's "required" field #15paulbarbu wants to merge 2 commits into
Conversation
paulbarbu
commented
Mar 20, 2012
I added that to be consistent with |
paulbarbu
commented
Mar 20, 2012
Done. |
nikic
commented
Mar 20, 2012
paulbarbu
commented
Mar 20, 2012
Oh, you're talking about the indentation? |
dsp
commented
Mar 27, 2012
bump, did anyone look into it yet? |
nikic
commented
Mar 27, 2012
I agree with @smalyshev that a public |
paulbarbu
commented
Mar 27, 2012
Well, OK, but then why From my POV it's an inconsistency Anyway, waiting for advice. |
nikic
commented
Mar 27, 2012
@PaulLik If you want to provide this info for |
paulbarbu
commented
Mar 28, 2012
Oh, it makes sense now. Thank you. [1] I need to add a debug_info field to either I'll update my patch once I get some free time. |
nikic
commented
Mar 28, 2012
@PaulLik For now I'd just remove that part of the change so that the rest can be merged :) The debug handler(s) can always be added later :) |
paulbarbu
commented
Mar 29, 2012
Done. |
paulbarbu
commented
Apr 2, 2012
Bump. |
There was a problem hiding this comment.
What is the purpose of this line?
smalyshev
commented
Apr 3, 2012
I'm not sure I understand - why you moved test 26 into test 25? Was something wrong with test 25? |
paulbarbu
commented
Apr 4, 2012
Hmmm, I must have done something wrong somewhere because when I checked those two tests were the same. Maybe I should close this issue and post a new one with the good commits? |
reeze
commented
Apr 5, 2012
@PaulLik maybe we can rebase this pull branch ? |
There was a problem hiding this comment.
Btw, this could also be replaced by required = (i >= fptr->common.required_num_args) ? 0 : 1;.
There was a problem hiding this comment.
If we want to bikeshed this, the proper suggestion would be required = (i < fptr->common.required_num_args).
…type (zend_bool) for its purpose
paulbarbu
commented
Apr 5, 2012
paulbarbu
commented
Apr 7, 2012
@cataphract Well, come on... |
There was a problem hiding this comment.
why req is created here? doesn't look like it is going anywhere.
raven0034
commented
Nov 9, 2016
is this ever going to get closed? |
php-pulls
commented
Dec 26, 2016
Comment on behalf of pollita at php.net: Updated and merged e52d2b8 |
The following opcodes would be generated:
...
BB1:
0003 JMP BB3
BB2:
0004 INIT_FCALL 1 96 string("chr")
0005 #10.T3 [long] = SR #3.CV0($int) [long] #7.CV2($i) ...
0006 #11.T4 [long] RANGE[0..127] = BW_AND #10.T3 [long] ...
0007 #12.T3 [long] RANGE[128..255] = BW_OR #11.T4 [long] ...
0008 SEND_VAL #12.T3 [long] RANGE[128..255] 1
0009 #13.V3 [ref, rc1, rcn, any] = DO_ICALL
0010 ASSIGN_OP (CONCAT) #6.CV1($out) [rc1, rcn, string]
0011 ADD #7.CV2($i)... int(7) #7.CV2($i) ... -> #15.CV2($i) ...
BB3:
0012 #8.T4 [long] = SR #3.CV0($int) #7.CV2($i) [long, double]
0013 #9.T3 [bool] RANGE[0..1] = IS_SMALLER int(128) #8.T4
0014 JMPNZ #9.T3 [bool] RANGE[0..1] BB2
...
Main changes are:
1. SR opcode covers new path in function zend_jit_long_math_helper().
2. BW_AND and BW_OR opcodes are supported. See macro LONG_OP.
3. Function zend_jit_concat_helper() is added to support ASSIGN_OP
opcode. Speficically, CONCAT and FAST_CONCAT is supported for statements
"$out .= ...".
4. New path is covered in function zend_jit_cmp_long_long() by
IS_SMALLER opcode.
5. New path is covered in macros ZVAL_PTR_DTOR and ZVAL_DTOR_FUNC when
leaving.The following opcodes would be generated:
...
BB1:
0003 JMP BB3
BB2:
0004 INIT_FCALL 1 96 string("chr")
0005 #10.T3 [long] = SR #3.CV0($int) [long] #7.CV2($i) ...
0006 #11.T4 [long] RANGE[0..127] = BW_AND #10.T3 [long] ...
0007 #12.T3 [long] RANGE[128..255] = BW_OR #11.T4 [long] ...
0008 SEND_VAL #12.T3 [long] RANGE[128..255] 1
0009 #13.V3 [ref, rc1, rcn, any] = DO_ICALL
0010 ASSIGN_OP (CONCAT) #6.CV1($out) [rc1, rcn, string]
0011 ADD #7.CV2($i)... int(7) #7.CV2($i) ... -> #15.CV2($i) ...
BB3:
0012 #8.T4 [long] = SR #3.CV0($int) #7.CV2($i) [long, double]
0013 #9.T3 [bool] RANGE[0..1] = IS_SMALLER int(128) #8.T4
0014 JMPNZ #9.T3 [bool] RANGE[0..1] BB2
...
Main changes are:
1. SR opcode covers new path in function zend_jit_long_math_helper().
2. BW_AND and BW_OR opcodes are supported. See macro LONG_OP.
3. Function zend_jit_concat_helper() is added to support ASSIGN_OP
opcode. Speficically, CONCAT and FAST_CONCAT is supported for statements
"$out .= ...".
4. New path is covered in function zend_jit_cmp_long_long() by
IS_SMALLER opcode.
5. New path is covered in macros ZVAL_PTR_DTOR and ZVAL_DTOR_FUNC when
leaving.PEM_write_bio_PUBKEY() cannot handle a NULL argument: ``` ==10779==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000058 (pc 0x7f426f79db69 bp 0x7fff0ec17940 sp 0x7fff0ec17928 T0) ==10779==The signal is caused by a WRITE memory access. ==10779==Hint: address points to the zero page. #0 0x7f426f79db69 in BIO_up_ref (/lib/x86_64-linux-gnu/libcrypto.so.3+0xedb69) (BuildId: 0698e1ff610cb3c6993dccbd82c1281b1b4c5ade) #1 0x7f426f7a8ac2 (/lib/x86_64-linux-gnu/libcrypto.so.3+0xf8ac2) (BuildId: 0698e1ff610cb3c6993dccbd82c1281b1b4c5ade) #2 0x7f426f87c6f0 (/lib/x86_64-linux-gnu/libcrypto.so.3+0x1cc6f0) (BuildId: 0698e1ff610cb3c6993dccbd82c1281b1b4c5ade) #3 0x7f426f87caa6 in OSSL_ENCODER_to_bio (/lib/x86_64-linux-gnu/libcrypto.so.3+0x1ccaa6) (BuildId: 0698e1ff610cb3c6993dccbd82c1281b1b4c5ade) #4 0x7f426f99dc5e in PEM_write_bio_PUBKEY (/lib/x86_64-linux-gnu/libcrypto.so.3+0x2edc5e) (BuildId: 0698e1ff610cb3c6993dccbd82c1281b1b4c5ade) #5 0x5637ebd00530 in zif_openssl_pkey_get_details /work/php-src/ext/openssl/openssl.c:2308 #6 0x5637ecab7ed2 in zend_test_execute_internal /work/php-src/ext/zend_test/observer.c:306 #7 0x5637ecde024a in ZEND_DO_FCALL_SPEC_RETVAL_USED_HANDLER /work/php-src/Zend/zend_vm_execute.h:2154 #8 0x5637ecf40995 in execute_ex /work/php-src/Zend/zend_vm_execute.h:116519 #9 0x5637ecf558b0 in zend_execute /work/php-src/Zend/zend_vm_execute.h:121962 #10 0x5637ed0ba0ab in zend_execute_script /work/php-src/Zend/zend.c:1980 #11 0x5637ecaec8bb in php_execute_script_ex /work/php-src/main/main.c:2645 #12 0x5637ecaecccb in php_execute_script /work/php-src/main/main.c:2685 #13 0x5637ed0bfc16 in do_cli /work/php-src/sapi/cli/php_cli.c:951 #14 0x5637ed0c21e3 in main /work/php-src/sapi/cli/php_cli.c:1362 #15 0x7f426f3321c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e) #16 0x7f426f33228a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e) #17 0x5637ebc09b34 in _start (/work/php-src/build-dbg-asan/sapi/cli/php+0x609b34) (BuildId: eb0a8e6b6d683fbdf45156dfed4d76f9110252b9) ``` ClosesGH-21015.
This function returns -1 on failure. Not checking this causes a segfault if `cert_name` is still NULL, i.e. if the failure happens on the first iteration. If the failure happens on the second iteration, we get a use-after-free. NULL deref example: ``` ==189347==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f961f6f379d bp 0x7ffdc44afed0 sp 0x7ffdc44af658 T0) ==189347==The signal is caused by a READ memory access. ==189347==Hint: address points to the zero page. #0 0x7f961f6f379d (/lib/x86_64-linux-gnu/libc.so.6+0x18b79d) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e) #1 0x7f9620217826 in strlen ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:389 #2 0x560faa92d119 in php_openssl_matches_san_list /work/php-src/ext/openssl/xp_ssl.c:478 #3 0x560faa92e912 in php_openssl_apply_peer_verification_policy /work/php-src/ext/openssl/xp_ssl.c:636 #4 0x560faa93565b in php_openssl_enable_crypto /work/php-src/ext/openssl/xp_ssl.c:1893 #5 0x560faa939c86 in php_openssl_sockop_set_option /work/php-src/ext/openssl/xp_ssl.c:2516 #6 0x560fab74c610 in _php_stream_set_option /work/php-src/main/streams/streams.c:1466 #7 0x560fab7557c1 in php_stream_xport_crypto_enable /work/php-src/main/streams/transports.c:387 #8 0x560faa939f29 in php_openssl_sockop_set_option /work/php-src/ext/openssl/xp_ssl.c:2541 #9 0x560fab74c610 in _php_stream_set_option /work/php-src/main/streams/streams.c:1466 #10 0x560fab754655 in php_stream_xport_connect /work/php-src/main/streams/transports.c:248 #11 0x560fab75365d in _php_stream_xport_create /work/php-src/main/streams/transports.c:145 #12 0x560fab54d725 in zif_stream_socket_client /work/php-src/ext/standard/streamsfuncs.c:158 #13 0x560fab6b7ed2 in zend_test_execute_internal /work/php-src/ext/zend_test/observer.c:306 #14 0x560fab9e024a in ZEND_DO_FCALL_SPEC_RETVAL_USED_HANDLER /work/php-src/Zend/zend_vm_execute.h:2154 #15 0x560fabb40995 in execute_ex /work/php-src/Zend/zend_vm_execute.h:116519 #16 0x560fabb558b0 in zend_execute /work/php-src/Zend/zend_vm_execute.h:121962 #17 0x560fabcba0ab in zend_execute_script /work/php-src/Zend/zend.c:1980 #18 0x560fab6ec8bb in php_execute_script_ex /work/php-src/main/main.c:2645 #19 0x560fab6ecccb in php_execute_script /work/php-src/main/main.c:2685 #20 0x560fabcbfc16 in do_cli /work/php-src/sapi/cli/php_cli.c:951 #21 0x560fabcc21e3 in main /work/php-src/sapi/cli/php_cli.c:1362 #22 0x7f961f5921c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e) #23 0x7f961f59228a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e) #24 0x560faa809b34 in _start (/work/php-src/build-dbg-asan/sapi/cli/php+0x609b34) (BuildId: aa149f943514fff0c491e1f199e30fed0e977f7c) ``` UAF example: ``` ==190632==ERROR: AddressSanitizer: heap-use-after-free on address 0x5020000690f0 at pc 0x7fc2cdb3596f bp 0x7ffce2ed98d0 sp 0x7ffce2ed9078 READ of size 3 at 0x5020000690f0 thread T0 #0 0x7fc2cdb3596e in strlen ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:391 #1 0x558b6eb2d119 in php_openssl_matches_san_list /work/php-src/ext/openssl/xp_ssl.c:478 #2 0x558b6eb2e912 in php_openssl_apply_peer_verification_policy /work/php-src/ext/openssl/xp_ssl.c:636 #3 0x558b6eb3565b in php_openssl_enable_crypto /work/php-src/ext/openssl/xp_ssl.c:1893 #4 0x558b6eb39c86 in php_openssl_sockop_set_option /work/php-src/ext/openssl/xp_ssl.c:2516 #5 0x558b6f94c610 in _php_stream_set_option /work/php-src/main/streams/streams.c:1466 #6 0x558b6f9557c1 in php_stream_xport_crypto_enable /work/php-src/main/streams/transports.c:387 #7 0x558b6eb39f29 in php_openssl_sockop_set_option /work/php-src/ext/openssl/xp_ssl.c:2541 #8 0x558b6f94c610 in _php_stream_set_option /work/php-src/main/streams/streams.c:1466 #9 0x558b6f954655 in php_stream_xport_connect /work/php-src/main/streams/transports.c:248 #10 0x558b6f95365d in _php_stream_xport_create /work/php-src/main/streams/transports.c:145 #11 0x558b6f74d725 in zif_stream_socket_client /work/php-src/ext/standard/streamsfuncs.c:158 #12 0x558b6f8b7ed2 in zend_test_execute_internal /work/php-src/ext/zend_test/observer.c:306 #13 0x558b6fbe024a in ZEND_DO_FCALL_SPEC_RETVAL_USED_HANDLER /work/php-src/Zend/zend_vm_execute.h:2154 #14 0x558b6fd40995 in execute_ex /work/php-src/Zend/zend_vm_execute.h:116519 #15 0x558b6fd558b0 in zend_execute /work/php-src/Zend/zend_vm_execute.h:121962 #16 0x558b6feba0ab in zend_execute_script /work/php-src/Zend/zend.c:1980 #17 0x558b6f8ec8bb in php_execute_script_ex /work/php-src/main/main.c:2645 #18 0x558b6f8ecccb in php_execute_script /work/php-src/main/main.c:2685 #19 0x558b6febfc16 in do_cli /work/php-src/sapi/cli/php_cli.c:951 #20 0x558b6fec21e3 in main /work/php-src/sapi/cli/php_cli.c:1362 #21 0x7fc2cceb01c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e) #22 0x7fc2cceb028a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e) #23 0x558b6ea09b34 in _start (/work/php-src/build-dbg-asan/sapi/cli/php+0x609b34) (BuildId: aa149f943514fff0c491e1f199e30fed0e977f7c) 0x5020000690f0 is located 0 bytes inside of 9-byte region [0x5020000690f0,0x5020000690f9) freed by thread T0 here: #0 0x7fc2cdbb44d8 in free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:52 #1 0x558b6eb2d2fa in php_openssl_matches_san_list /work/php-src/ext/openssl/xp_ssl.c:496 #2 0x558b6eb2e912 in php_openssl_apply_peer_verification_policy /work/php-src/ext/openssl/xp_ssl.c:636 #3 0x558b6eb3565b in php_openssl_enable_crypto /work/php-src/ext/openssl/xp_ssl.c:1893 #4 0x558b6eb39c86 in php_openssl_sockop_set_option /work/php-src/ext/openssl/xp_ssl.c:2516 #5 0x558b6f94c610 in _php_stream_set_option /work/php-src/main/streams/streams.c:1466 #6 0x558b6f9557c1 in php_stream_xport_crypto_enable /work/php-src/main/streams/transports.c:387 #7 0x558b6eb39f29 in php_openssl_sockop_set_option /work/php-src/ext/openssl/xp_ssl.c:2541 #8 0x558b6f94c610 in _php_stream_set_option /work/php-src/main/streams/streams.c:1466 #9 0x558b6f954655 in php_stream_xport_connect /work/php-src/main/streams/transports.c:248 #10 0x558b6f95365d in _php_stream_xport_create /work/php-src/main/streams/transports.c:145 #11 0x558b6f74d725 in zif_stream_socket_client /work/php-src/ext/standard/streamsfuncs.c:158 #12 0x558b6f8b7ed2 in zend_test_execute_internal /work/php-src/ext/zend_test/observer.c:306 #13 0x558b6fbe024a in ZEND_DO_FCALL_SPEC_RETVAL_USED_HANDLER /work/php-src/Zend/zend_vm_execute.h:2154 #14 0x558b6fd40995 in execute_ex /work/php-src/Zend/zend_vm_execute.h:116519 #15 0x558b6fd558b0 in zend_execute /work/php-src/Zend/zend_vm_execute.h:121962 #16 0x558b6feba0ab in zend_execute_script /work/php-src/Zend/zend.c:1980 #17 0x558b6f8ec8bb in php_execute_script_ex /work/php-src/main/main.c:2645 #18 0x558b6f8ecccb in php_execute_script /work/php-src/main/main.c:2685 #19 0x558b6febfc16 in do_cli /work/php-src/sapi/cli/php_cli.c:951 #20 0x558b6fec21e3 in main /work/php-src/sapi/cli/php_cli.c:1362 #21 0x7fc2cceb01c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e) #22 0x7fc2cceb028a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e) #23 0x558b6ea09b34 in _start (/work/php-src/build-dbg-asan/sapi/cli/php+0x609b34) (BuildId: aa149f943514fff0c491e1f199e30fed0e977f7c) previously allocated by thread T0 here: #0 0x7fc2cdbb59c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69 #1 0x7fc2cd2faeab in ASN1_mbstring_ncopy (/lib/x86_64-linux-gnu/libcrypto.so.3+0xcceab) (BuildId: 0698e1ff610cb3c6993dccbd82c1281b1b4c5ade) #2 0x7fc2cd2fb2e5 in ASN1_mbstring_copy (/lib/x86_64-linux-gnu/libcrypto.so.3+0xcd2e5) (BuildId: 0698e1ff610cb3c6993dccbd82c1281b1b4c5ade) #3 0x7fc2cd2fe2a5 in ASN1_STRING_to_UTF8 (/lib/x86_64-linux-gnu/libcrypto.so.3+0xd02a5) (BuildId: 0698e1ff610cb3c6993dccbd82c1281b1b4c5ade) #4 0x558b6eb2d0a8 in php_openssl_matches_san_list /work/php-src/ext/openssl/xp_ssl.c:477 #5 0x558b6eb2e912 in php_openssl_apply_peer_verification_policy /work/php-src/ext/openssl/xp_ssl.c:636 #6 0x558b6eb3565b in php_openssl_enable_crypto /work/php-src/ext/openssl/xp_ssl.c:1893 #7 0x558b6eb39c86 in php_openssl_sockop_set_option /work/php-src/ext/openssl/xp_ssl.c:2516 #8 0x558b6f94c610 in _php_stream_set_option /work/php-src/main/streams/streams.c:1466 #9 0x558b6f9557c1 in php_stream_xport_crypto_enable /work/php-src/main/streams/transports.c:387 #10 0x558b6eb39f29 in php_openssl_sockop_set_option /work/php-src/ext/openssl/xp_ssl.c:2541 #11 0x558b6f94c610 in _php_stream_set_option /work/php-src/main/streams/streams.c:1466 #12 0x558b6f954655 in php_stream_xport_connect /work/php-src/main/streams/transports.c:248 #13 0x558b6f95365d in _php_stream_xport_create /work/php-src/main/streams/transports.c:145 #14 0x558b6f74d725 in zif_stream_socket_client /work/php-src/ext/standard/streamsfuncs.c:158 #15 0x558b6f8b7ed2 in zend_test_execute_internal /work/php-src/ext/zend_test/observer.c:306 #16 0x558b6fbe024a in ZEND_DO_FCALL_SPEC_RETVAL_USED_HANDLER /work/php-src/Zend/zend_vm_execute.h:2154 #17 0x558b6fd40995 in execute_ex /work/php-src/Zend/zend_vm_execute.h:116519 #18 0x558b6fd558b0 in zend_execute /work/php-src/Zend/zend_vm_execute.h:121962 #19 0x558b6feba0ab in zend_execute_script /work/php-src/Zend/zend.c:1980 #20 0x558b6f8ec8bb in php_execute_script_ex /work/php-src/main/main.c:2645 #21 0x558b6f8ecccb in php_execute_script /work/php-src/main/main.c:2685 #22 0x558b6febfc16 in do_cli /work/php-src/sapi/cli/php_cli.c:951 #23 0x558b6fec21e3 in main /work/php-src/sapi/cli/php_cli.c:1362 #24 0x7fc2cceb01c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e) #25 0x7fc2cceb028a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e) #26 0x558b6ea09b34 in _start (/work/php-src/build-dbg-asan/sapi/cli/php+0x609b34) (BuildId: aa149f943514fff0c491e1f199e30fed0e977f7c) ``` ClosesGH-21017.
Leak report: ``` Direct leak of 24 byte(s) in 1 object(s) allocated from: #0 0x7f97cf4cb340 in calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:77 #1 0x7f97cef66106 in BN_new bn/bn_lib.c:75 #2 0x7f97cef6006c in bn_bin2bn_cbs bn/bn_convert.c:151 #3 0x7f97cef60853 in BN_bin2bn bn/bn_convert.c:206 #4 0x56229112465b in php_openssl_pkey_init_dh_data /work/php-src/ext/openssl/openssl_backend_v1.c:208 #5 0x5622911248be in php_openssl_pkey_init_dh /work/php-src/ext/openssl/openssl_backend_v1.c:246 #6 0x5622910fe1d7 in zif_openssl_pkey_new /work/php-src/ext/openssl/openssl.c:2051 #7 0x562291eb44e5 in zend_test_execute_internal /work/php-src/ext/zend_test/observer.c:306 #8 0x5622921dc85a in ZEND_DO_FCALL_SPEC_RETVAL_USED_HANDLER /work/php-src/Zend/zend_vm_execute.h:2154 #9 0x56229233cfa5 in execute_ex /work/php-src/Zend/zend_vm_execute.h:116519 #10 0x562292351ec0 in zend_execute /work/php-src/Zend/zend_vm_execute.h:121962 #11 0x5622924b60cc in zend_execute_script /work/php-src/Zend/zend.c:1980 #12 0x562291ee8ecb in php_execute_script_ex /work/php-src/main/main.c:2645 #13 0x562291ee92db in php_execute_script /work/php-src/main/main.c:2685 #14 0x5622924bbc37 in do_cli /work/php-src/sapi/cli/php_cli.c:951 #15 0x5622924be204 in main /work/php-src/sapi/cli/php_cli.c:1362 #16 0x7f97ceb301c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e) #17 0x7f97ceb3028a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e) #18 0x562291009db4 in _start (/work/php-src/build-dbg-asan/sapi/cli/php+0x609db4) (BuildId: 5cc444a6a9fc1a486ea698e72366c16bd5472605) ... etc ... ```
This is observable in LibreSSL. The code is creating 3 big numbers, but if one of them failed to create, then DSA_set0_pqg() will have never executed and there are no references left to the created big numbers, leaking them in the process. E.g.: ``` Direct leak of 24 byte(s) in 1 object(s) allocated from: #0 0x7f4edd402340 in calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:77 #1 0x7f4edce9d106 in BN_new bn/bn_lib.c:75 #2 0x7f4edce9706c in bn_bin2bn_cbs bn/bn_convert.c:151 #3 0x7f4edce97853 in BN_bin2bn bn/bn_convert.c:206 #4 0x5556bd923e1d in php_openssl_pkey_init_dsa_data /work/php-src/ext/openssl/openssl_backend_v1.c:142 #5 0x5556bd92428f in php_openssl_pkey_init_dsa /work/php-src/ext/openssl/openssl_backend_v1.c:186 #6 0x5556bd8fe079 in zif_openssl_pkey_new /work/php-src/ext/openssl/openssl.c:2042 #7 0x5556be6b44e5 in zend_test_execute_internal /work/php-src/ext/zend_test/observer.c:306 #8 0x5556be9dc85a in ZEND_DO_FCALL_SPEC_RETVAL_USED_HANDLER /work/php-src/Zend/zend_vm_execute.h:2154 #9 0x5556beb3cfa5 in execute_ex /work/php-src/Zend/zend_vm_execute.h:116519 #10 0x5556beb51ec0 in zend_execute /work/php-src/Zend/zend_vm_execute.h:121962 #11 0x5556becb60cc in zend_execute_script /work/php-src/Zend/zend.c:1980 #12 0x5556be6e8ecb in php_execute_script_ex /work/php-src/main/main.c:2645 #13 0x5556be6e92db in php_execute_script /work/php-src/main/main.c:2685 #14 0x5556becbbc37 in do_cli /work/php-src/sapi/cli/php_cli.c:951 #15 0x5556becbe204 in main /work/php-src/sapi/cli/php_cli.c:1362 #16 0x7f4edca671c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e) #17 0x7f4edca6728a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e) #18 0x5556bd809db4 in _start (/work/php-src/build-dbg-asan/sapi/cli/php+0x609db4) (BuildId: 5cc444a6a9fc1a486ea698e72366c16bd5472605) ``` ClosesGH-21062.
This causes UB later on when the certificate is passed to another function: ``` /work/php-src/Zend/zend_string.h:191:2: runtime error: null pointer passed as argument 2, which is declared to never be null #0 0x55cfb9407d94 in zend_string_init /work/php-src/Zend/zend_string.h:191 #1 0x55cfb941ceb6 in add_assoc_stringl_ex /work/php-src/Zend/zend_API.c:1986 #2 0x55cfb7f4c16d in add_assoc_stringl /work/php-src/Zend/zend_API.h:579 #3 0x55cfb7f4cccd in php_openssl_add_assoc_asn1_string /work/php-src/ext/openssl/openssl_backend_common.c:113 #4 0x55cfb7f2eb98 in zif_openssl_x509_parse /work/php-src/ext/openssl/openssl.c:1074 #5 0x55cfb9160993 in zend_test_execute_internal /work/php-src/ext/zend_test/observer.c:306 #6 0x55cfb958ee2d in ZEND_DO_FCALL_SPEC_RETVAL_USED_HANDLER /work/php-src/Zend/zend_vm_execute.h:2154 #7 0x55cfb97854bd in execute_ex /work/php-src/Zend/zend_vm_execute.h:116519 #8 0x55cfb9795c96 in zend_execute /work/php-src/Zend/zend_vm_execute.h:121962 #9 0x55cfb99666c6 in zend_execute_script /work/php-src/Zend/zend.c:1980 #10 0x55cfb919583e in php_execute_script_ex /work/php-src/main/main.c:2645 #11 0x55cfb9195b48 in php_execute_script /work/php-src/main/main.c:2685 #12 0x55cfb996bf48 in do_cli /work/php-src/sapi/cli/php_cli.c:951 #13 0x55cfb996e6a1 in main /work/php-src/sapi/cli/php_cli.c:1362 #14 0x7fb0b68301c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e) #15 0x7fb0b683028a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e) #16 0x55cfb7e097d4 in _start (/work/php-src/build-dbg-ubsan/sapi/cli/php+0x14097d4) (BuildId: b2b405964cc047ab6da19abaf92a8899a99e4a47) ``` Furthermore, it also simply does not propagate the error to userland. ClosesGH-21046.
This can actually fail because internally this function does stack management in internal data structures. Can cause a crash later, e.g.: ``` ==239255==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000008 (pc 0x5652d8f2fe68 bp 0x7ffc99ee8fc0 sp 0x7ffc99ee8ec0 T0) ==239255==The signal is caused by a READ memory access. ==239255==Hint: address points to the zero page. #0 0x5652d8f2fe68 in php_openssl_limit_handshake_reneg /work/php-src/ext/openssl/xp_ssl.c:1080 #1 0x5652d8f306e2 in php_openssl_info_callback /work/php-src/ext/openssl/xp_ssl.c:1137 #2 0x7f45057b84e5 (/lib/x86_64-linux-gnu/libssl.so.3+0x694e5) (BuildId: 5f3b12d47114f9fbdc7765266cd0bb8f1b5ee8fc) #3 0x5652d8f351d9 in php_openssl_enable_crypto /work/php-src/ext/openssl/xp_ssl.c:1850 #4 0x5652d8f39c86 in php_openssl_sockop_set_option /work/php-src/ext/openssl/xp_ssl.c:2516 #5 0x5652d9d4c610 in _php_stream_set_option /work/php-src/main/streams/streams.c:1466 #6 0x5652d9d557c1 in php_stream_xport_crypto_enable /work/php-src/main/streams/transports.c:387 #7 0x5652d8f387be in php_openssl_tcp_sockop_accept /work/php-src/ext/openssl/xp_ssl.c:2279 #8 0x5652d8f39fcd in php_openssl_sockop_set_option /work/php-src/ext/openssl/xp_ssl.c:2551 #9 0x5652d9d4c610 in _php_stream_set_option /work/php-src/main/streams/streams.c:1466 #10 0x5652d9d54d3a in php_stream_xport_accept /work/php-src/main/streams/transports.c:307 #11 0x5652d9b50161 in zif_stream_socket_accept /work/php-src/ext/standard/streamsfuncs.c:298 #12 0x5652d9fdacfb in ZEND_DO_ICALL_SPEC_RETVAL_UNUSED_HANDLER /work/php-src/Zend/zend_vm_execute.h:1355 #13 0x5652da140689 in execute_ex /work/php-src/Zend/zend_vm_execute.h:116469 #14 0x5652da1558b0 in zend_execute /work/php-src/Zend/zend_vm_execute.h:121962 #15 0x5652da2ba0ab in zend_execute_script /work/php-src/Zend/zend.c:1980 #16 0x5652d9cec8bb in php_execute_script_ex /work/php-src/main/main.c:2645 #17 0x5652d9cecccb in php_execute_script /work/php-src/main/main.c:2685 #18 0x5652da2bfc16 in do_cli /work/php-src/sapi/cli/php_cli.c:951 #19 0x5652da2c21e3 in main /work/php-src/sapi/cli/php_cli.c:1362 #20 0x7f4504ebc1c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e) #21 0x7f4504ebc28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e) #22 0x5652d8e09b34 in _start (/work/php-src/build-dbg-asan/sapi/cli/php+0x609b34) (BuildId: aa149f943514fff0c491e1f199e30fed0e977f7c) ``` ClosesGH-21049.
…dict ``` Direct leak of 52 byte(s) in 1 object(s) allocated from: #0 0x7ff90cd2c161 in malloc (/usr/lib/libasan.so.8+0x12c161) (BuildId: ee5fbab73143ab257a66a33afe0f038a4af7a74e) php#1 0x55de10c9a468 in tracked_malloc /work/php-8.4/Zend/zend_alloc.c:2973 php#2 0x55de10c99443 in _emalloc /work/php-8.4/Zend/zend_alloc.c:2740 php#3 0x55de102deb86 in zlib_create_dictionary_string /work/php-8.4/ext/zlib/zlib.c:836 php#4 0x55de102e145a in zif_deflate_init /work/php-8.4/ext/zlib/zlib.c:1144 php#5 0x55de10dcac6c in ZEND_DO_ICALL_SPEC_RETVAL_USED_HANDLER /work/php-8.4/Zend/zend_vm_execute.h:1351 php#6 0x55de10f2d69d in execute_ex /work/php-8.4/Zend/zend_vm_execute.h:58907 php#7 0x55de10f41666 in zend_execute /work/php-8.4/Zend/zend_vm_execute.h:64334 php#8 0x55de110a6cf8 in zend_execute_script /work/php-8.4/Zend/zend.c:1934 php#9 0x55de10af0ddb in php_execute_script_ex /work/php-8.4/main/main.c:2577 php#10 0x55de10af128f in php_execute_script /work/php-8.4/main/main.c:2617 php#11 0x55de110ac5e1 in do_cli /work/php-8.4/sapi/cli/php_cli.c:935 php#12 0x55de110ae592 in main /work/php-8.4/sapi/cli/php_cli.c:1322 php#13 0x7ff90c027740 (/usr/lib/libc.so.6+0x27740) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049) php#14 0x7ff90c027878 in __libc_start_main (/usr/lib/libc.so.6+0x27878) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049) php#15 0x55de10005964 in _start (/work/php-8.4/sapi/cli/php+0x605964) (BuildId: 5f144db4e56ea623e070c56445fb1dfa3f8d085d) SUMMARY: AddressSanitizer: 52 byte(s) leaked in 1 allocation(s). ``` ClosesphpGH-22101.
…reset The code tries to read the context on NULL when `php_stream_xport_crypto_setup` fails because by then `stream` is reset to NULL. This is also UB, so can cause miscompiles. ``` ==1217==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000090 (pc 0x55d829ed3acf bp 0x7fff045f5770 sp 0x7fff045f4df0 T0) ==1217==The signal is caused by a READ memory access. ==1217==Hint: address points to the zero page. #0 0x55d829ed3acf in php_stream_url_wrap_http_ex /work/php-src/ext/standard/http_fopen_wrapper.c:580 #1 0x55d829ed857e in php_stream_url_wrap_http /work/php-src/ext/standard/http_fopen_wrapper.c:1204 #2 0x55d82a15073d in _php_stream_open_wrapper_ex /work/php-src/main/streams/streams.c:2270 #3 0x55d829e78fa6 in zif_file_get_contents /work/php-src/ext/standard/file.c:409 #4 0x55d829bbfe39 in zif_phar_file_get_contents /work/php-src/ext/phar/func_interceptors.c:226 #5 0x55d82a0b7ed2 in zend_test_execute_internal /work/php-src/ext/zend_test/observer.c:306 #6 0x55d82a3e024a in ZEND_DO_FCALL_SPEC_RETVAL_USED_HANDLER /work/php-src/Zend/zend_vm_execute.h:2154 #7 0x55d82a540995 in execute_ex /work/php-src/Zend/zend_vm_execute.h:116519 #8 0x55d82a5558b0 in zend_execute /work/php-src/Zend/zend_vm_execute.h:121962 #9 0x55d82a6ba0ab in zend_execute_script /work/php-src/Zend/zend.c:1980 #10 0x55d82a0ec8bb in php_execute_script_ex /work/php-src/main/main.c:2645 #11 0x55d82a0ecccb in php_execute_script /work/php-src/main/main.c:2685 #12 0x55d82a6bfc16 in do_cli /work/php-src/sapi/cli/php_cli.c:951 #13 0x55d82a6c21e3 in main /work/php-src/sapi/cli/php_cli.c:1362 #14 0x7f9e770491c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e) #15 0x7f9e7704928a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e) #16 0x55d829209b34 in _start (/work/php-src/build-dbg-asan/sapi/cli/php+0x609b34) (BuildId: aa149f943514fff0c491e1f199e30fed0e977f7c) ``` This is a backport of: * 7782b88 * f9519cc * afded3d Co-authored-by: Ilija Tovilo <ilija.tovilo@me.com>
…reset The code tries to read the context on NULL when `php_stream_xport_crypto_setup` fails because by then `stream` is reset to NULL. This is also UB, so can cause miscompiles. ``` ==1217==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000090 (pc 0x55d829ed3acf bp 0x7fff045f5770 sp 0x7fff045f4df0 T0) ==1217==The signal is caused by a READ memory access. ==1217==Hint: address points to the zero page. #0 0x55d829ed3acf in php_stream_url_wrap_http_ex /work/php-src/ext/standard/http_fopen_wrapper.c:580 php#1 0x55d829ed857e in php_stream_url_wrap_http /work/php-src/ext/standard/http_fopen_wrapper.c:1204 php#2 0x55d82a15073d in _php_stream_open_wrapper_ex /work/php-src/main/streams/streams.c:2270 php#3 0x55d829e78fa6 in zif_file_get_contents /work/php-src/ext/standard/file.c:409 php#4 0x55d829bbfe39 in zif_phar_file_get_contents /work/php-src/ext/phar/func_interceptors.c:226 php#5 0x55d82a0b7ed2 in zend_test_execute_internal /work/php-src/ext/zend_test/observer.c:306 php#6 0x55d82a3e024a in ZEND_DO_FCALL_SPEC_RETVAL_USED_HANDLER /work/php-src/Zend/zend_vm_execute.h:2154 php#7 0x55d82a540995 in execute_ex /work/php-src/Zend/zend_vm_execute.h:116519 php#8 0x55d82a5558b0 in zend_execute /work/php-src/Zend/zend_vm_execute.h:121962 php#9 0x55d82a6ba0ab in zend_execute_script /work/php-src/Zend/zend.c:1980 php#10 0x55d82a0ec8bb in php_execute_script_ex /work/php-src/main/main.c:2645 php#11 0x55d82a0ecccb in php_execute_script /work/php-src/main/main.c:2685 php#12 0x55d82a6bfc16 in do_cli /work/php-src/sapi/cli/php_cli.c:951 php#13 0x55d82a6c21e3 in main /work/php-src/sapi/cli/php_cli.c:1362 php#14 0x7f9e770491c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e) php#15 0x7f9e7704928a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e) php#16 0x55d829209b34 in _start (/work/php-src/build-dbg-asan/sapi/cli/php+0x609b34) (BuildId: aa149f943514fff0c491e1f199e30fed0e977f7c) ``` This is a backport of: * 7782b88 * f9519cc * afded3d Co-authored-by: Ilija Tovilo <ilija.tovilo@me.com>
Hi.
The aim of this patch is to fix a problem related to the _parameter_reference
structure and its
requiredfield.The
requiredfield, until now, stored how many required parameters the function, it belongs to, has. I think this is rather problematic because it's a feature of the function to know how many required parameters it has, not of the parameter itself. The parameter should only say if it's required or optional (among other unrelated things).Also storing the function's number of required parameters in every parameter was redundant since the _zend_function structure already has that information. And storing the same value (number of required parameters) across multiple variables is inefficient and could lead to inconsistencies.
So I tried to solve this problem by declaring the
requiredfield aszend_bool(see 7fe93ca66dd806a197).While working on this I noticed some inconsistency between a comment and the code, bb59a5f5256df4d2e6.
I also updated the related reflection tests and everything seems ok (59fa4989f2ebb8d0).
While updating the tests I noticed a duplicate so I deleted it, see f613f01157abfc495.
Finally I thought
var_dump()calls on aReflectionParametermust be consistent withechoandprintso I came up with db3c26b4e62361a.PS:
You can assign the above stated problem with the following analogy.
A vehicle must know about its number of required or optional (in case of flats) wheels (parameters), the wheel itself should not know how many of it it takes to assemble the vehicle(the function) in order to run.
It only says that it's required when it's assembled on the vehicle and optional when serving as a back up wheel.