Fix GH-22878: Use-after-free of callable via autoloader

Validating an array or string callable runs user code before its borrowed
method name and object are used: a string class name can trigger an
autoloader, and a compound "Class::method" name emits an E_DEPRECATED that
reaches a user error handler. Either can free or mutate the callable,
leaving the method string and $this dangling. Copy the method string
before the reentrant lookup, and hold the callable array across
INIT_USER_CALL's validation and frame build so the object survives to the
call. This also covers call_user_func_array(), $cb(), and referenced or
reference-wrapped array members.

Fixes GH-22878

Author: iliaal

NEWS

@@ -11,6 +11,7 @@ PHP                                                                        NEWS
   . Fixed bug GH-18847 (SEGV in zend_fetch_debug_backtrace() when the memory
     limit is reached while the tracing JIT enters a call frame). (Arnaud,
     iliaal)
+  . Fixed bug GH-22878 (Use-after-free of callable via autoloader). (iliaal)
 
 - DOM:
   . Fixed bug GH-22825 (DOMElement::setAttribute() fails silently when the DTD

Zend/tests/gh22878.phpt

@@ -0,0 +1,41 @@
+--TEST--
+GH-22878 (Use-after-free of callable via autoloader)
+--FILE--
+<?php
+spl_autoload_register(function (string $class): void {
+    $GLOBALS['cb'] = null;
+    eval("class $class { public static function __callStatic(\$name, \$args) { echo strlen(\$name), \"\\n\"; } }");
+});
+
+$method = str_repeat('m', 256);
+$cb = ['GH22878ArrayCuf', $method];
+unset($method);
+call_user_func($cb);
+
+$method = str_repeat('m', 256);
+$cb = ['GH22878ArrayCufa', $method];
+unset($method);
+call_user_func_array($cb, []);
+
+$method = str_repeat('m', 256);
+$cb = ['GH22878ArrayDynamic', $method];
+unset($method);
+$cb();
+
+$method = str_repeat('m', 256);
+$cb = 'GH22878Str::' . $method;
+unset($method);
+call_user_func($cb);
+
+$cb = 'GH22878Lit::literalMethod';
+call_user_func($cb);
+
+echo "done\n";
+?>
+--EXPECT--
+256
+256
+256
+256
+13
+done

Zend/zend_API.c

@@ -4194,6 +4194,9 @@ ZEND_API bool zend_is_callable_at_frame(
 	bool ret;
 	zend_fcall_info_cache fcc_local;
 	bool strict_class = false;
+	zval callable_copy;
+
+	ZVAL_UNDEF(&callable_copy);
 
 	if (fcc == NULL) {
 		fcc = &fcc_local;
@@ -4221,11 +4224,17 @@ ZEND_API bool zend_is_callable_at_frame(
 				return 1;
 			}
 
+			ZVAL_COPY(&callable_copy, callable);
+			callable = &callable_copy;
+
 check_func:
 			ret = zend_is_callable_check_func(callable, frame, fcc, strict_class, error, check_flags & IS_CALLABLE_SUPPRESS_DEPRECATIONS);
 			if (fcc == &fcc_local) {
 				zend_release_fcall_info_cache(fcc);
 			}
+			if (!Z_ISUNDEF(callable_copy)) {
+				zval_ptr_dtor(&callable_copy);
+			}
 			return ret;
 
 		case IS_ARRAY:
@@ -4259,7 +4268,11 @@ ZEND_API bool zend_is_callable_at_frame(
 						return 1;
 					}
 
+					ZVAL_COPY(&callable_copy, method);
+					callable = &callable_copy;
+
 					if (!zend_is_callable_check_class(Z_STR_P(obj), get_scope(frame), frame, fcc, &strict_class, error, check_flags & IS_CALLABLE_SUPPRESS_DEPRECATIONS)) {
+						zval_ptr_dtor(&callable_copy);
 						return 0;
 					}
 				} else {
@@ -4271,9 +4284,11 @@ ZEND_API bool zend_is_callable_at_frame(
 						fcc->called_scope = fcc->calling_scope;
 						return 1;
 					}
+
+					ZVAL_COPY(&callable_copy, method);
+					callable = &callable_copy;
 				}
 
-				callable = method;
 				goto check_func;
 			}
 			return 0;

Zend/zend_execute.c

@@ -5257,23 +5257,27 @@ static zend_never_inline zend_execute_data *zend_init_dynamic_call_array(const z
 		}
 
 		if (Z_TYPE_P(obj) == IS_STRING) {
+			zend_string *method_name = zend_string_copy(Z_STR_P(method));
 			zend_class_entry *called_scope = zend_fetch_class_by_name(Z_STR_P(obj), NULL, ZEND_FETCH_CLASS_DEFAULT | ZEND_FETCH_CLASS_EXCEPTION);
 
 			if (UNEXPECTED(called_scope == NULL)) {
+				zend_string_release(method_name);
 				return NULL;
 			}
 
 			if (called_scope->get_static_method) {
-				fbc = called_scope->get_static_method(called_scope, Z_STR_P(method));
+				fbc = called_scope->get_static_method(called_scope, method_name);
 			} else {
-				fbc = zend_std_get_static_method(called_scope, Z_STR_P(method), NULL);
+				fbc = zend_std_get_static_method(called_scope, method_name, NULL);
 			}
 			if (UNEXPECTED(fbc == NULL)) {
 				if (EXPECTED(!EG(exception))) {
-					zend_undefined_method(called_scope, Z_STR_P(method));
+					zend_undefined_method(called_scope, method_name);
 				}
+				zend_string_release(method_name);
 				return NULL;
 			}
+			zend_string_release(method_name);
 			if (!(fbc->common.fn_flags & ZEND_ACC_STATIC)) {
 				zend_non_static_method_call(fbc);
 				if (fbc->common.fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE) {

Zend/zend_vm_def.h

@@ -3982,9 +3982,16 @@ ZEND_VM_HANDLER(118, ZEND_INIT_USER_CALL, CONST, CONST|TMP|CV, NUM)
 	void *object_or_called_scope;
 	zend_execute_data *call;
 	uint32_t call_info = ZEND_CALL_NESTED_FUNCTION | ZEND_CALL_DYNAMIC;
+	zval held_callable;
 
 	SAVE_OPLINE();
 	function_name = GET_OP2_ZVAL_PTR(BP_VAR_R);
+	ZVAL_UNDEF(&held_callable);
+	ZVAL_DEREF(function_name);
+	if (UNEXPECTED(Z_TYPE_P(function_name) == IS_ARRAY)) {
+		ZVAL_COPY(&held_callable, function_name);
+		function_name = &held_callable;
+	}
 	if (zend_is_callable_ex(function_name, NULL, 0, NULL, &fcc, &error)) {
 		ZEND_ASSERT(!error);
 
@@ -3993,6 +4000,9 @@ ZEND_VM_HANDLER(118, ZEND_INIT_USER_CALL, CONST, CONST|TMP|CV, NUM)
 		 * For the CONST and CV case we reuse the same exception block below
 		 * to make sure we don't increase VM size too much. */
 		if (!(OP2_TYPE & (IS_TMP_VAR|IS_VAR)) && UNEXPECTED(EG(exception))) {
+			if (UNEXPECTED(!Z_ISUNDEF(held_callable))) {
+				zval_ptr_dtor(&held_callable);
+			}
 			FREE_OP2();
 			HANDLE_EXCEPTION();
 		}
@@ -4016,6 +4026,9 @@ ZEND_VM_HANDLER(118, ZEND_INIT_USER_CALL, CONST, CONST|TMP|CV, NUM)
 			call_info |= ZEND_CALL_RELEASE_THIS | ZEND_CALL_HAS_THIS;
 		}
 
+		if (UNEXPECTED(!Z_ISUNDEF(held_callable))) {
+			zval_ptr_dtor(&held_callable);
+		}
 		FREE_OP2();
 		if ((OP2_TYPE & (IS_TMP_VAR|IS_VAR)) && UNEXPECTED(EG(exception))) {
 			if (call_info & ZEND_CALL_CLOSURE) {
@@ -4030,6 +4043,9 @@ ZEND_VM_HANDLER(118, ZEND_INIT_USER_CALL, CONST, CONST|TMP|CV, NUM)
 			init_func_run_time_cache(&func->op_array);
 		}
 	} else {
+		if (UNEXPECTED(!Z_ISUNDEF(held_callable))) {
+			zval_ptr_dtor(&held_callable);
+		}
 		zend_type_error("%s(): Argument #1 ($callback) must be a valid callback, %s", Z_STRVAL_P(RT_CONSTANT(opline, opline->op1)), error);
 		efree(error);
 		FREE_OP2();