René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Invalid read/segfault on specific input","articleBody":"Hi again :wave:,\r\n\r\nI found a flaw in msgpack on a specific input string.\r\n\r\nVery easy to reproducer:\r\n\r\n```php\r\n\u003c?php\r\n$data = hex2bin('de06000000c09baa316e3b303e66656367675203060657545563343864643600000000');\r\n$unserilized = msgpack_unserialize($data);\r\n```\r\n\r\nWith the zend allocator:\r\n\r\n```\r\n valgrind sapi/cli/php unserialize.php\r\n==3142543== Memcheck, a memory error detector\r\n==3142543== Copyright (C) 2002-2024, and GNU GPL'd, by Julian Seward et al.\r\n==3142543== Using Valgrind-3.23.0 and LibVEX; rerun with -h for copyright info\r\n==3142543== Command: sapi/cli/php unserialize.php\r\n==3142543==\r\n==3142543== Warning: set address range perms: large range [0x59c95000, 0xd9c95000) (defined)\r\n==3142543== Warning: set address range perms: large range [0x59c96000, 0xd9c95000) (undefined)\r\n\r\nWarning: [msgpack] (php_msgpack_unserialize) Insufficient data for unserializing in /home/mike/dev/phpfarm/src/php-8.3.11-debug/unserialize.php on line 4\r\nphp: /home/mike/dev/phpfarm/src/php-8.3.11-debug/Zend/zend_gc.c:698: gc_possible_root: Assertion `zval_gc_type((ref)-\u003egc.u.type_info) == 7 || zval_gc_type((ref)-\u003egc.u.type_info) == 8' failed.\r\n==3142543==\r\n==3142543== Process terminating with default action of signal 6 (SIGABRT)\r\n==3142543==    at 0x5E009FC: __pthread_kill_implementation (pthread_kill.c:44)\r\n==3142543==    by 0x5E009FC: __pthread_kill_internal (pthread_kill.c:78)\r\n==3142543==    by 0x5E009FC: pthread_kill@@GLIBC_2.34 (pthread_kill.c:89)\r\n==3142543==    by 0x5DAC475: raise (raise.c:26)\r\n==3142543==    by 0x5D927F2: abort (abort.c:79)\r\n==3142543==    by 0x5D9271A: __assert_fail_base.cold (assert.c:92)\r\n==3142543==    by 0x5DA3E95: __assert_fail (assert.c:101)\r\n==3142543==    by 0xEA5570: gc_possible_root (zend_gc.c:698)\r\n==3142543==    by 0xDD50CA: gc_check_possible_root (zend_gc.h:98)\r\n==3142543==    by 0xDD511C: i_zval_ptr_dtor (zend_variables.h:46)\r\n==3142543==    by 0xDD52EB: zval_ptr_dtor (zend_variables.c:84)\r\n==3142543==    by 0x8C9D3B: msgpack_unserialize_var_destroy (msgpack_unpack.c:364)\r\n==3142543==    by 0x8C4DB9: php_msgpack_unserialize (msgpack.c:279)\r\n==3142543==    by 0x8C4F2D: zif_msgpack_unserialize (msgpack.c:318)\r\n==3142543==\r\n==3142543== HEAP SUMMARY:\r\n==3142543==     in use at exit: 3,418,965 bytes in 27,735 blocks\r\n==3142543==   total heap usage: 30,680 allocs, 2,944 frees, 2,151,772,892 bytes allocated\r\n==3142543==\r\n==3142543== LEAK SUMMARY:\r\n==3142543==    definitely lost: 34,983 bytes in 986 blocks\r\n==3142543==    indirectly lost: 40 bytes in 1 blocks\r\n==3142543==      possibly lost: 2,619,303 bytes in 21,628 blocks\r\n==3142543==    still reachable: 2,148,244,191 bytes in 5,121 blocks\r\n==3142543==         suppressed: 0 bytes in 0 blocks\r\n==3142543== Rerun with --leak-check=full to see details of leaked memory\r\n==3142543==\r\n==3142543== For lists of detected and suppressed errors, rerun with: -s\r\n==3142543== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)\r\n[1]    3142543 IOT instruction (core dumped)  valgrind sapi/cli/php unserialize.php\r\n```\r\n\r\nWithout the allocator:\r\n\r\n```\r\n USE_ZEND_ALLOC=0 valgrind sapi/cli/php unserialize.php\r\n==3142751== Memcheck, a memory error detector\r\n==3142751== Copyright (C) 2002-2024, and GNU GPL'd, by Julian Seward et al.\r\n==3142751== Using Valgrind-3.23.0 and LibVEX; rerun with -h for copyright info\r\n==3142751== Command: sapi/cli/php unserialize.php\r\n==3142751==\r\n==3142751== Warning: set address range perms: large range [0x59c95000, 0xd9c95000) (defined)\r\n==3142751== Warning: set address range perms: large range [0x59c96000, 0xd9c95000) (undefined)\r\n\r\nWarning: [msgpack] (php_msgpack_unserialize) Insufficient data for unserializing in /home/mike/dev/phpfarm/src/php-8.3.11-debug/unserialize.php on line 4\r\n==3142751== Invalid read of size 4\r\n==3142751==    at 0xDD4E45: zend_gc_delref (zend_types.h:1342)\r\n==3142751==    by 0xDD50FE: i_zval_ptr_dtor (zend_variables.h:43)\r\n==3142751==    by 0xDD52EB: zval_ptr_dtor (zend_variables.c:84)\r\n==3142751==    by 0x8C9D3B: msgpack_unserialize_var_destroy (msgpack_unpack.c:364)\r\n==3142751==    by 0x8C4DB9: php_msgpack_unserialize (msgpack.c:279)\r\n==3142751==    by 0x8C4F2D: zif_msgpack_unserialize (msgpack.c:318)\r\n==3142751==    by 0xE18658: ZEND_DO_ICALL_SPEC_RETVAL_USED_HANDLER (zend_vm_execute.h:1337)\r\n==3142751==    by 0xE8E113: execute_ex (zend_vm_execute.h:57216)\r\n==3142751==    by 0xE92959: zend_execute (zend_vm_execute.h:61604)\r\n==3142751==    by 0xDD9AAA: zend_execute_scripts (zend.c:1891)\r\n==3142751==    by 0xD37F82: php_execute_script (main.c:2528)\r\n==3142751==    by 0xF4C25A: do_cli (php_cli.c:966)\r\n==3142751==  Address 0xa07ee50 is 0 bytes inside a block of size 56 free'd\r\n==3142751==    at 0x484C9F4: free (vg_replace_malloc.c:989)\r\n==3142751==    by 0xD9AF5D: _efree_custom (zend_alloc.c:2500)\r\n==3142751==    by 0xD9B0A8: _efree (zend_alloc.c:2620)\r\n==3142751==    by 0xDF2F95: zend_array_destroy (zend_hash.c:1867)\r\n==3142751==    by 0xDD517A: rc_dtor_func (zend_variables.c:57)\r\n==3142751==    by 0xDD510E: i_zval_ptr_dtor (zend_variables.h:44)\r\n==3142751==    by 0xDD52EB: zval_ptr_dtor (zend_variables.c:84)\r\n==3142751==    by 0x8CADD3: msgpack_unserialize_map_item (msgpack_unpack.c:647)\r\n==3142751==    by 0x8C4511: msgpack_unserialize_execute (unpack_template.h:405)\r\n==3142751==    by 0x8C4B9D: php_msgpack_unserialize (msgpack.c:252)\r\n==3142751==    by 0x8C4F2D: zif_msgpack_unserialize (msgpack.c:318)\r\n==3142751==    by 0xE18658: ZEND_DO_ICALL_SPEC_RETVAL_USED_HANDLER (zend_vm_execute.h:1337)\r\n==3142751==  Block was alloc'd at\r\n==3142751==    at 0x484977B: malloc (vg_replace_malloc.c:446)\r\n==3142751==    by 0xD9C29B: __zend_malloc (zend_alloc.c:3128)\r\n==3142751==    by 0xD9AEF0: _malloc_custom (zend_alloc.c:2491)\r\n==3142751==    by 0xD9B02E: _emalloc (zend_alloc.c:2610)\r\n==3142751==    by 0xDEDEC9: _zend_new_array (zend_hash.c:291)\r\n==3142751==    by 0x8CA788: msgpack_unserialize_array (msgpack_unpack.c:550)\r\n==3142751==    by 0x8C39BA: msgpack_unserialize_execute (unpack_template.h:231)\r\n==3142751==    by 0x8C4B9D: php_msgpack_unserialize (msgpack.c:252)\r\n==3142751==    by 0x8C4F2D: zif_msgpack_unserialize (msgpack.c:318)\r\n==3142751==    by 0xE18658: ZEND_DO_ICALL_SPEC_RETVAL_USED_HANDLER (zend_vm_execute.h:1337)\r\n==3142751==    by 0xE8E113: execute_ex (zend_vm_execute.h:57216)\r\n==3142751==    by 0xE92959: zend_execute (zend_vm_execute.h:61604)\r\n==3142751==\r\nphp: /home/mike/dev/phpfarm/src/php-8.3.11-debug/Zend/zend_types.h:1342: zend_gc_delref: Assertion `p-\u003erefcount \u003e 0' failed.\r\n==3142751==\r\n==3142751== Process terminating with default action of signal 6 (SIGABRT)\r\n==3142751==    at 0x5E009FC: __pthread_kill_implementation (pthread_kill.c:44)\r\n==3142751==    by 0x5E009FC: __pthread_kill_internal (pthread_kill.c:78)\r\n==3142751==    by 0x5E009FC: pthread_kill@@GLIBC_2.34 (pthread_kill.c:89)\r\n==3142751==    by 0x5DAC475: raise (raise.c:26)\r\n==3142751==    by 0x5D927F2: abort (abort.c:79)\r\n==3142751==    by 0x5D9271A: __assert_fail_base.cold (assert.c:92)\r\n==3142751==    by 0x5DA3E95: __assert_fail (assert.c:101)\r\n==3142751==    by 0xDD4E63: zend_gc_delref (zend_types.h:1342)\r\n==3142751==    by 0xDD50FE: i_zval_ptr_dtor (zend_variables.h:43)\r\n==3142751==    by 0xDD52EB: zval_ptr_dtor (zend_variables.c:84)\r\n==3142751==    by 0x8C9D3B: msgpack_unserialize_var_destroy (msgpack_unpack.c:364)\r\n==3142751==    by 0x8C4DB9: php_msgpack_unserialize (msgpack.c:279)\r\n==3142751==    by 0x8C4F2D: zif_msgpack_unserialize (msgpack.c:318)\r\n==3142751==    by 0xE18658: ZEND_DO_ICALL_SPEC_RETVAL_USED_HANDLER (zend_vm_execute.h:1337)\r\n==3142751==\r\n==3142751== HEAP SUMMARY:\r\n==3142751==     in use at exit: 3,854,817 bytes in 27,959 blocks\r\n==3142751==   total heap usage: 31,192 allocs, 3,232 frees, 2,152,369,935 bytes allocated\r\n==3142751==\r\n==3142751== LEAK SUMMARY:\r\n==3142751==    definitely lost: 34,983 bytes in 986 blocks\r\n==3142751==    indirectly lost: 40 bytes in 1 blocks\r\n==3142751==      possibly lost: 2,679,753 bytes in 21,820 blocks\r\n==3142751==    still reachable: 2,148,619,593 bytes in 5,153 blocks\r\n==3142751==         suppressed: 0 bytes in 0 blocks\r\n==3142751== Rerun with --leak-check=full to see details of leaked memory\r\n==3142751==\r\n==3142751== For lists of detected and suppressed errors, rerun with: -s\r\n==3142751== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0)\r\n[1]    3142751 IOT instruction (core dumped)  USE_ZEND_ALLOC=0 valgrind sapi/cli/php unserialize.php\r\n```\r\n\r\nI can replicate the problem both in debug and release builds of PHP. I'm using 8.3.11 here though.\r\n\r\n```bash\r\nPHP 8.3.11 (cli) (built: Aug 30 2024 09:27:49) (NTS)\r\nCopyright (c) The PHP Group\r\nZend Engine v4.3.11, Copyright (c) Zend Technologies\r\n    with Zend OPcache v8.3.11, Copyright (c), by Zend Technologies\r\n```\r\n\r\nLet me know if I can provide any other info.","author":{"url":"https://github.com/michael-grunder","@type":"Person","name":"michael-grunder"},"datePublished":"2024-11-03T20:51:13.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/177/msgpack-php/issues/177"}