pmmp / ext-pmmpthread

Fork of https://github.com/krakjoe/pthreads with a revamped API and PHP 8.1+ support
Other
82 stars 15 forks source link

pthreads_store_sync_local_properties() may segfault when syncing properties after its connection was destroyed from another thread #95

Closed dktapps closed 1 year ago

dktapps commented 1 year ago

https://github.com/pmmp/pthreads/blob/355432f7229afd64e9c16db666532c5b2cb3fe60/src/store.c#L80

Nothing in this code guarantees that threadedStorage will actually be valid, since the code doesn't check if the object still remains in the global object table, and there's also no ref added to the object when it's in a property table like this.

This means that a UAF may occur in this code, as seen in the updated gone.phpt here: 355432f7229afd64e9c16db666532c5b2cb3fe60

dktapps commented 1 year ago

This is a pain to fix. In any thread which isn't the owner of the object, this will necessitate a pthreads_globals_lock() to verify that the object in question is still valid.