#38687 [NEW]: Possible buffer overflow in stream_socket_client() when using "bindto" + IPv6

From: christian dot schuster at s2000 dot tu-chemnitz dot de Operating system: Linux PHP version: 5CVS-2006-09-01 (CVS) PHP Bug Type: Streams related Bug description: Possible buffer overflow in stream_socket_client() when using "bindto" + IPv6 Description: ------------ Using stream_socket_client() with a context containing a valid local IPv6 binding address does not actually bind the socket to that address, but fails silently. This is a "side effect" of a possible buffer overflow: In main/network.c, php_network_connect_socket_to_host() uses a "struct sockaddr", and references it via a pointer to "struct sockaddr_in" or "struct sockaddr_in6". For IPv4, this is usually sufficient - for IPv6 it is not. Upon the subsequent call to inet_pton(), some memory beyond the "struct sockaddr" is accessed. A "struct sockaddr_in" or "struct sockaddr_in6" should be used instead, depending on the protocol. PHP6 is affected by this bug, too. Proposed patch: http://www-user.tu-chemnitz.de/~chschu/patches/php-stream_socket_client-bind.patch Reproduce code: --------------- /* sample code for illegal use of struct sockaddr */ #include <sys/types.h> #include <sys/socket.h> #include <arpa/inet.h> int main(int, char**) { struct sockaddr local_address; struct sockaddr_in6 *in6 = (struct sockaddr_in6*)&local_address; inet_pton(AF_INET6, "::1", &in6->sin6_addr); } Expected result: ---------------- Normal program termination. Actual result: -------------- "Segmentation fault" on inet_pton(). -- Edit bug report at http://bugs.php.net/?id=38687&edit=1 -- Try a CVS snapshot (PHP 4.4): http://bugs.php.net/fix.php?id=38687&r=trysnapshot44 Try a CVS snapshot (PHP 5.2): http://bugs.php.net/fix.php?id=38687&r=trysnapshot52 Try a CVS snapshot (PHP 6.0): http://bugs.php.net/fix.php?id=38687&r=trysnapshot60 Fixed in CVS: http://bugs.php.net/fix.php?id=38687&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=38687&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=38687&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=38687&r=needscript Try newer version: http://bugs.php.net/fix.php?id=38687&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=38687&r=support Expected behavior: http://bugs.php.net/fix.php?id=38687&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=38687&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=38687&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=38687&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=38687&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=38687&r=dst IIS Stability: http://bugs.php.net/fix.php?id=38687&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=38687&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=38687&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=38687&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=38687&r=mysqlcfg