#23732·php-src

php_user_filter::filter() 删除自身过滤器会导致越界读取

作者: djarfluka创建于 2026年9月17日更新于 2026年9月17日
标签BugStatus: Needs Triage

结果如下:

==10==ERROR: AddressSanitizer: heap-use-after-free on address 0xffffae0086a8 at pc 0x000004350410 bp 0xfffff27db510 sp 0xfffff27db508 READ of size 8 at 0xffffae0086a8 thread T0 #0 0x435040c in userfilter_filter /src/php-src/ext/standard/user_filters.c:241:29 #1 0x4f945f8 in php_stream_fill_read_buffer /src/php-src/main/streams/streams.c:487:14 #2 0x4f992f4 in php_stream_read /src/php-src/main/streams/streams.c:658:8 #3 0x4f99d18 in php_stream_read_to_str /src/php-src/main/streams/streams.c:706:17 #4 0x3fd63f8 in zif_fread /src/php-src/ext/standard/file.c:1622:8 #5 0x5d5b9e0 in ZEND_DO_ICALL_SPEC_RETVAL_USED_HANDLER /src/php-src/Zend/zend_vm_execute.h:1393:2 #6 0x5916d98 in execute_ex /src/php-src/Zend/zend_vm_execute.h:110551:12 #7 0x5919010 in zend_execute /src/php-src/Zend/zend_vm_execute.h:115989:2 #8 0x656733c in zend_execute_script /src/php-src/Zend/zend.c:1977:3 #9 0x4e4e2e0 in php_execute_script_ex /src/php-src/main/main.c:2589:13 #10 0x4e4f358 in php_execute_script /src/php-src/main/main.c:2629:9 #11 0x657a078 in do_cli /src/php-src/sapi/cli/php_cli.c:933:5 #12 0x6574b2c in do_php_cli /src/php-src/sapi/cli/php_cli.c:1346:18 #13 0x6573020 in main /src/php-src/sapi/cli/php_cli_main.c:18:9 #14 0xffffb5e773fc (/lib/aarch64-linux-gnu/libc.so.6+0x273fc) #15 0xffffb5e774d4 in __libc_start_main (/lib/aarch64-linux-gnu/libc.so.6+0x274d4) #16 0x48e06c in _start (/src/php-src/sapi/cli/php+0x48e06c) 0xffffae0086a8 位于 88 字节区域 [0xffffae0086a0,0xffffae0086f8) 内的 8 字节处,由线程 T0 释放,如下所示: #0 0x4fdc2c in free (/src/php-src/sapi/cli/php+0x4fdc2c) #1 0x552d670 in __zend_free /src/php-src/Zend/zend_alloc.c:3671:2 #2 0x5537044 in _efree /src/php-src/Zend/zend_alloc.c:2888:3 #3 0x4f4dd84 in php_stream_filter_free /src/php-src/main/streams/filter.c:328:2 #4 0x4f536b8 in php_stream_filter_remove /src/php-src/main/streams/filter.c:558:3 #5 0x42214f8 in zif_stream_filter_remove