<?php
class E { function __toString(){ $GLOBALS['re'] = []; return "/a/"; } }
$re = [ new E() ];
for ($i=0;$i<3000;$i) $re[] = '/a/';
$GLOBALS['re'] =& $re;
preg_replace($re, 'b', 'aaaa'); =================================================================
==1==ERROR: AddressSanitizer: heap-use-after-free on address 0xffffacf3c820 at pc 0x000000ca5320 bp 0xfffffec86970 sp 0xfffffec86968
READ of size 1 at 0xffffacf3c820 thread T0
#0 0xca531c in zval_get_type /src/php-src/Zend/zend_types.h:685:18
#1 0xcd9a74 in php_pcre_replace_array /src/php-src/ext/pcre/php_pcre.c:2129:3
#2 0xcd8bf4 in php_replace_in_subject /src/php-src/ext/pcre/php_pcre.c:2166:12
#3 0xcbd1c4 in _preg_replace_common /src/php-src/ext/pcre/php_pcre.c:2290:12
#4 0xcbcd4c in zflf_preg_replace_3 /src/php-src/ext/pcre/php_pcre.c:2388:2
#5 0x5ec3018 in ZEND_FRAMELESS_ICALL_3_SPEC_HANDLER /src/php-src/Zend/zend_vm_execute.h:3969:3
#6 0x5916d98 in execute_ex /src/php-src/Zend/zend_vm_execute.h:110551:12
#7 0x5919010 in zend_execute /src/php-src/Zend/zend_vm_execute.h:115989:2
#8 0x656733c in zend_execute_script /src/php-src/Zend/zend.c:1977:3
#9 0x4e4e2e0 in php_execute_script_ex /src/php-src/main/main.c:2589:13
#10 0x4e4f358 in php_execute_script /src/php-src/main/main.c:2629:9
#11 0x657a078 in do_cli /src/php-src/sapi/cli/php_cli.c:933:5
#12 0x6574b2c in do_php_cli /src/php-src/sapi/cli/php_cli.c:1346:18
#13 0x6573020 in main /src/php-src/sapi/cli/php_cli_main.c:18:9
#14 0xffffb3e073fc (/lib/aarch64-linux-gnu/libc.so.6+0x273fc)
#15 0xffffb3e074d4 in __libc_start_main (/lib/aarch64-linux-gnu/libc.so.6+0x274d4)
#16 0x48e06c in _start (/src/php-src/sapi/cli/php+0x48e06c)
0xffffacf3c820 is located 32 bytes inside of 65544-byte region [0xffffacf3c800,0xffffacf4c808)
freed by thread T0 here:
#0 0x4fdc2c in free (/src/php-src/sapi/cli/php+0x4fdc2c)
#1 0x552d670 in __zend_free /src/php-src/Zend/zend_alloc.c:3671:2
#2 0x5537044 in _efree /src/php-src/Zend/zend_alloc.c:2888:3
#3 0x6096d48 in zend_array_destroy /src/php-src/Zend/zend_hash.c:1878:2
#4 0x6510268 in rc_dtor_func /src/php-src/Zend/zend_variables.c:56:2
#5 0x5f5b8bc in zend_assign_to_variable /src/php-src/Zend/zend_execute.h:184:4
#6 0x59baa38 in ZEND_ASSIGN_SPEC_VAR_CONST_RETVAL_UNUSED_HANDLER /src/php-src/Zend/zend_vm_execute.h:25473:11
#7 0x5916d98 in execute_ex /src/php-src/Zend/zend_vm_execute.h:110551:12
#8 0x58b0d6c in zend_call_function /src/php-src/Zend/zend_execute_API.c:1038:3
#9 0x58b7134 in zend_call_known_function_ex /src/php-src/Zend/zend_execute_API.c:1136:23
#10 0x63f4870 in zend_call_known_function /src/php-src/Zend/zend_API.h:870:2
#11 0x63f4818 in zend_call_known_instance_method /src/php-src/Zend/zend_API.h:898:2
#12 0x63ae794 in zend_call_known_instance_method_with_0_params /src/php-src/Zend/zend_API.h:904:2
#13 0x63f1144 in zend_std_cast_object_tostring /src/php-src/Zend/zend_object_handlers.c:2589:5
#14 0x64541f4 in __zval_get_string_func /src/php-src/Zend/zend_operators.c:1154:8
#15 0x6453778 in zval_get_string_func /src/php-src/Zend/zend_operators.c:1175:9
#16 0xcd1160 in zval_get_tmp_string /src/php-src/Zend/zend_operators.h:355:17
#17 0xcd9aa4 in php_pcre_replace_array /src/php-src/ext/pcre/php_pcre.c:2132:29
#18 0xcd8bf4 in php_replace_in_subject /src/php-src/ext/pcre/php_pcre.c:2166:12
#19 0xcbd1c4 in _preg_replace_common /src/php-src/ext/pcre/php_pcre.c:2290:12
#20 0xcbcd4c in zflf_preg_replace_3 /src/php-src/ext/pcre/php_pcre.c:2388:2
#21 0x5ec3018 in ZEND_FRAMELESS_ICALL_3_SPEC_HANDLER /src/php-src/Zend/zend_vm_execute.h:3969:3
#22 0x5916d98 in execute_ex /src/php-src/Zend/zend_vm_execute.h:110551:12
#23 0x5919010 in zend_execute /src/php-src/Zend/zend_vm_execute.h:115989:2
#24 0x656733c in zend_execute_script /src/php-src/Zend/zend.c:1977:3
#25 0x4e4e2e0 in php_execute_script_ex /src/php-src/main/main.c:2589:13
#26 0x4e4f358 in php_execute_script /src/php-src/main/main.c:2629:9
#27 0x657a078 in do_cli /src/php-src/sapi/cli/php_cli.c:933:5
#28 0x6574b2c in do_php_cli /src/php-src/sapi/cli/php_cli.c:1346:18
#29 0x6573020 in main /src/php-src/sapi/cli/php_cli_main.c:18:9
previously allocated by thread T0 here:
#0 0x4fe18c in realloc (/src/php-src/sapi/cli/php+0x4fe18c)
#1 0x5537aa4 in __zend_realloc /src/php-src/Zend/zend_alloc.c:3662:6
#2 0x5537540 in _erealloc2 /src/php-src/Zend/zend_alloc.c:2909:10
#3 0x6060568 in zend_hash_packed_grow /src/php-src/Zend/zend_hash.c:316:2
#4 0x6084848 in _zend_hash_index_add_or_update_i /src/php-src/Zend/zend_hash.c:1156:4
#5 0x60827d4 in zend_hash_next_index_insert /src/php-src/Zend/zend_hash.c:1241:9
#6 0x59f9548 in ZEND_ASSIGN_DIM_SPEC_CV_UNUSED_OP_DATA_CONST_HANDLER /src/php-src/Zend/zend_vm_execute.h:48873:12
#7 0x5916d98 in execute_ex /src/php-src/Zend/zend_vm_execute.h:110551:12
#8 0x5919010 in zend_execute /src/php-src/Zend/zend_vm_execute.h:115989:2
#9 0x656733c in zend_execute_script /src/php-src/Zend/zend.c:1977:3
#10 0x4e4e2e0 in php_execute_script_ex /src/php-src/main/main.c:2589:13
#11 0x4e4f358 in php_execute_script /src/php-src/main/main.c:2629:9
#12 0x657a078 in do_cli /src/php-src/sapi/cli/php_cli.c:933:5
#13 0x6574b2c in do_php_cli /src/php-src/sapi/cli/php_cli.c:1346:18
#14 0x6573020 in main /src/php-src/sapi/cli/php_cli_main.c:18:9
#15 0xffffb3e073fc (/lib/aarch64-linux-gnu/libc.so.6+0x273fc)
#16 0xffffb3e074d4 in __libc_start_main (/lib/aarch64-linux-gnu/libc.so.6+0x274d4)
#17 0x48e06c in _start (/src/php-src/sapi/cli/php+0x48e06c)
SUMMARY: AddressSanitizer: heap-use-after-free /src/php-src/Zend/zend_types.h:685:18 in zval_get_type
Shadow bytes around the buggy address:
0x200ff59e78b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x200ff59e78c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x200ff59e78d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x200ff59e78e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x200ff59e78f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x200ff59e7900: fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd
0x200ff59e7910: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x200ff59e7920: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x200ff59e7930: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x200ff59e7940: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x200ff59e7950: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==1==ABORTING
Description
The following code:
Resulted in this output:
PHP Version
Operating System
ubuntu 22.04