Heap-use-after-free in zend_array_count at Zend/zend_hash.c #20477
Description
Description
The following code:
<?php
class Foo {
public function __destruct() {
$a[0] =&$a;
$a = $this->$$a = $this->#destruct() {
$a = unserialize(serialize($GLOBALS));
}
}
$c = new Foo();
for($cnt=0;$cnt<6;$cnt++) {
$a = unserialize(serialize($GLOBALS));
$a.= unserialize(serialize($GLOBALS));
$a = unserialize(serialize($GLOBALS));
}Resulted in this output:
SUMMARY: AddressSanitizer: heap-use-after-free php-src/Zend/zend_hash.c:478:6 in zend_array_count
Shadow bytes around the buggy address:
0x0c0c7fffe490: 00 00 00 00 00 00 00 fa fa fa fa fa 00 00 00 00
0x0c0c7fffe4a0: 00 00 00 fa fa fa fa fa fd fd fd fd fd fd fd fd
0x0c0c7fffe4b0: fa fa fa fa 00 00 00 00 00 00 00 fa fa fa fa fa
0x0c0c7fffe4c0: fd fd fd fd fd fd fd fa fa fa fa fa fd fd fd fd
0x0c0c7fffe4d0: fd fd fd fd fa fa fa fa 00 00 00 00 00 00 00 fa
=>0x0c0c7fffe4e0: fa fa fa fa fd[fd]fd fd fd fd fd fa fa fa fa fa
0x0c0c7fffe4f0: fd fd fd fd fd fd fd fa fa fa fa fa fd fd fd fd
0x0c0c7fffe500: fd fd fd fd fa fa fa fa fd fd fd fd fd fd fd fd
0x0c0c7fffe510: fa fa fa fa fd fd fd fd fd fd fd fa fa fa fa fa
0x0c0c7fffe520: fd fd fd fd fd fd fd fa fa fa fa fa fd fd fd fd
0x0c0c7fffe530: fd fd fd fd fa fa fa fa fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==3046755==ABORTING
Commit:
9cd367362da5442861f30d3b41e967d641b90cbd
Build configuration:
CC="clang" CXX="clang++" CFLAGS="-fsanitize=address -g -O0" CXXFLAGS="-fsanitize=address -g -O0" ./configure --enable-debug --enable-address-sanitizer --disable-shared --with-pic
Thanks a lot for finding this bug with the help of @vi3tL0u1s
PHP Version
PHP 8.6.0-dev (cli) (built: Nov 14 2025 10:37:56) (NTS DEBUG)
Copyright (c) The PHP Group
Zend Engine v4.6.0-dev, Copyright (c) Zend Technologies
with Zend OPcache v8.6.0-dev, Copyright (c), by Zend Technologies
Operating System
Ubuntu 22.04