Heap buffer overflow in php-src under specific OPcache optimization settings poses remote code execution risk
When SCCP is enabled and the compact-literals optimization path is disabled, if both the class and method names of a dynamic static call are optimized by constant propagation, the ZEND_INIT_STATIC_METHOD_CALL_SPEC_CONST_CONST_HANDLER handler incorrectly reads memory outside the function runtime cache. An attacker can craft a malicious PHP script to trigger this logic flaw, causing a heap buffer overflow that may crash the service or enable unauthorized code execution.
Component
php-src is the core source repository of the PHP interpreter. It builds the PHP language runtime and Zend Engine, parses and executes PHP scripts, and integrates Opcode caching to improve performance. It aims to provide efficient and stable dynamic content processing for Web applications across server-side development scenarios.
Type
Heap-based Buffer Overflow (CWE-122)
Repo
github.com/php/php-src
· Stars 40440
Remediation
- Review runtime cache allocation during OPcache optimization so that static method calls after constant propagation correctly compute and allocate cache slots, and verify memory access boundaries under different optimization levels to eliminate out-of-bounds reads caused by inconsistent cache sizes.
