Repository navigation
sqlite3 UAF #24159
Description
Description
The following code:
<?php
try {
$db = new SQLite3(':memory:');
$db->exec('CREATE TABLE t (a INTEGER)');
$db->exec('INSERT INTO t VALUES (1)');
$db->createAggregate('agg', function ($context, $rows, $a) use (&$db, &$reported) {
if (!$reported) {
try {
var_dump($db->close());
} catch (Throwable $e) {
}
}
}, function ($context, $rows) {
}, 1);
$db = $db->prepare('SELECT agg(a) FROM t');
$res = $db->execute();
} catch (\Throwable $_ffl_e) {}Resulted in this output:
=================================================================
==3179922==ERROR: AddressSanitizer: heap-use-after-free on address 0x603000040400 at pc 0x000000dddd1d bp 0x7ffdac372270 sp 0x7ffdac372268
READ of size 1 at 0x603000040400 thread T0
#0 0xdddd1c in zval_get_type /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/Zend/zend_types.h:685:18
#1 0xddd556 in sqlite3_do_callback /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/ext/sqlite3/sqlite3.c:880:23
#2 0xda8f43 in php_sqlite3_callback_step /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/ext/sqlite3/sqlite3.c:912:2
#3 0x7f6b030a8259 in sqlite3VdbeExec (/lib/x86_64-linux-gnu/libsqlite3.so.0+0xde259)
#4 0x7f6b030b2a2e in sqlite3_step (/lib/x86_64-linux-gnu/libsqlite3.so.0+0xe8a2e)
#5 0xdbd018 in zim_SQLite3Stmt_execute /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/ext/sqlite3/sqlite3.c:1901:16
#6 0x60dd22e in ZEND_DO_FCALL_SPEC_OBSERVER_HANDLER /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/Zend/zend_vm_execute.h:2284:4
#7 0x2fd5067 in zend_jit_trace_execute /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/ext/opcache/jit/zend_jit_vm_helpers.c:1082:12
#8 0x2ffc9e5 in zend_jit_trace_hot_root /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/ext/opcache/jit/zend_jit_trace.c:8204:9
#9 0x2fc3903 in zend_jit_trace_counter_helper /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/ext/opcache/jit/zend_jit_vm_helpers.c:470:7
#10 0x2fc319a in zend_jit_func_trace_helper /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/ext/opcache/jit/zend_jit_vm_helpers.c:506:2
#11 0x5e8e9b7 in execute_ex /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/Zend/zend_vm_execute.h:110583:12
#12 0x5e90bf8 in zend_execute /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/Zend/zend_vm_execute.h:116021:2
#13 0x6ad321c in zend_execute_script /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/Zend/zend.c:1980:3
#14 0x53dd1fd in php_execute_script_ex /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/main/main.c:2590:13
#15 0x53de308 in php_execute_script /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/main/main.c:2630:9
#16 0x6ae5dd2 in do_cli /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/sapi/cli/php_cli.c:941:5
#17 0x6ae058a in do_php_cli /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/sapi/cli/php_cli.c:1354:18
#18 0x6ade991 in main /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/sapi/cli/php_cli_main.c:18:9
#19 0x7f6b0284ad8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#20 0x7f6b0284ae3f in __libc_start_main csu/../csu/libc-start.c:392:3
#21 0x605b34 in _start (/home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/sapi/cli/php+0x605b34)
0x603000040400 is located 16 bytes inside of 32-byte region [0x6030000403f0,0x603000040410)
freed by thread T0 here:
#0 0x680792 in free (/home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/sapi/cli/php+0x680792)
#1 0x7f6b03060e91 in sqlite3_free (/lib/x86_64-linux-gnu/libsqlite3.so.0+0x96e91)
previously allocated by thread T0 here:
#0 0x6809fd in malloc (/home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/sapi/cli/php+0x6809fd)
#1 0x7f6b0305c7ea (/lib/x86_64-linux-gnu/libsqlite3.so.0+0x927ea)
SUMMARY: AddressSanitizer: heap-use-after-free /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/Zend/zend_types.h:685:18 in zval_get_type
Shadow bytes around the buggy address:
0x0c0680000030: 00 00 00 fa fa fa fd fd fd fa fa fa fd fd fd fa
0x0c0680000040: fa fa fd fd fd fa fa fa fd fd fd fa fa fa fd fd
0x0c0680000050: fd fa fa fa fd fd fd fa fa fa fd fd fd fa fa fa
0x0c0680000060: fd fd fd fa fa fa 00 00 00 fa fa fa fd fd fd fd
0x0c0680000070: fa fa fd fd fd fd fa fa fd fd fd fd fa fa fd fd
=>0x0c0680000080:[fd]fd fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0680000090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c06800000a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c06800000b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c06800000c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c06800000d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==3179922==ABORTING
To reproduce:
/home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/sapi/cli/php ./test.php
Commit:
940ff2098ea4cbc1ce711a07df958f7d531e51fa
Configurations:
CC="clang-12" CXX="clang++-12" CFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" CXXFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" ./configure --enable-debug --enable-address-sanitizer --enable-undefined-sanitizer --enable-re2c-cgoto --enable-fpm --enable-litespeed --enable-phpdbg-debug --enable-zts --enable-bcmath --enable-calendar --enable-dba --enable-dl-test --enable-exif --enable-ftp --enable-gd --enable-gd-jis-conv --enable-mbstring --enable-pcntl --enable-shmop --enable-soap --enable-sockets --enable-sysvmsg --enable-zend-test --with-zlib --with-bz2 --with-curl --with-enchant --with-gettext --with-gmp --with-mhash --with-ldap --with-libedit --with-readline --with-snmp --with-sodium --with-xsl --with-zip --with-mysqli --with-pdo-mysql --with-pdo-pgsql --with-pgsql --with-sqlite3 --with-pdo-sqlite --with-webp --with-jpeg --with-freetype --enable-sigchild --with-readline --with-pcre-jit --with-iconv
Operating System:
Ubuntu 20.04 Host, Docker 0599jiangyc/flowfusion:latest
This bug was found by fusion-fuzz
PHP Version
940ff2098ea4cbc1ce711a07df958f7d531e51fa
Operating System
No response
Activity
iliaal commentedon Oct 6, 2026
Duplicate of #23728:
$dbis rebound to the statement, so the callback callsSQLite3Stmt::close()on the statement being stepped. Fixed by #23736.