#38322 [Opn->Fbk]: reading past array in sscanf leads to arbitary code execution

From: Date: Fri, 04 Aug 2006 09:28:06 +0000
Subject: #38322 [Opn->Fbk]: reading past array in sscanf leads to arbitary code execution
References: 1  Groups: php.bugs 
Request: Send a blank email to php-bugs+get-100327@lists.php.net to get a copy of this message 
 ID:               38322
 Updated by:       tony2001@php.net
 Reported By:      heintz at hotmail dot com
-Status:           Open
+Status:           Feedback
 Bug Type:         Strings related
 Operating System: all
 PHP Version:      5.1.4
 New Comment:

Please check out this patch:
http://tony2001.phpclub.net/dev/tmp/bug38322.diff


Previous Comments:
------------------------------------------------------------------------

[2006-08-04 00:36:21] heintz at hotmail dot com

Description:
------------
ext/standard/scanf.c line ~887
  ---
  if (numVars) {
                    current = args[objIndex++];                
  ---
  
  objIndex points past the end of array in other format cases too





Reproduce code:
---------------
sscanf('foo ','$1s',$str);

http://www.plain-text.info/sscanf_bug.txt -
full description

Actual result:
--------------
will try to dereference a pointer to pointer which usually causes
segmentation fault


------------------------------------------------------------------------


-- 
Edit this bug report at http://bugs.php.net/?id=38322&edit=1

Thread (4 messages)

« previous php.bugs (#100327) next »