Use After Free Vulnerability in array_walk()/array_walk_recursive()

Disclosed: 2019-10-13 11:08:05 By ryat To ibb
Unknown
Vulnerability Details
https://bugs.php.net/bug.php?id=70713 I think this bugs is still security issue since this bug can be still triggered remotely in some real world&apps. Example: https://github.com/zendframework/zend-loader/blob/ceb32b5129525e1f19b01f37dbbcc6398b0a9635/src/ClassMapAutoloader.php#L210-L215 ``` array_walk($parts, function ($value, $key) use (&$parts) { if ($value === '..') { unset($parts[$key], $parts[$key-1]); $parts = array_values($parts); <== ['x', 'y', '..'] will be changed into ['x'] from the memory, it is possible to lead to use-after-free. } }); ```
Actions
View on HackerOne
Report Stats
  • Report ID: 155223
  • State: Closed
  • Substate: resolved
  • Upvotes: 5
Share this report