#18932 [Opn]: fgetcsv with large line causes Apache segfault

ID: 18932 Updated by: rasmus@php.net Reported By: speedfreak50@netscape.net Status: Open Bug Type: Reproducible crash Operating System: Linux (Red Hat 7.3) PHP Version: 4CVS-2002-08-15 New Comment: With debug on, here is the backtrace Program received signal SIGSEGV, Segmentation fault. 0x0819344b in shutdown_memory_manager (silent=1, clean_cache=0) at /home/rasmus/php4/Zend/zend_alloc.c:462 462 if (!iterator->cached (gdb) bt #0 0x0819344b in shutdown_memory_manager (silent=1, clean_cache=0) at /home/rasmus/php4/Zend/zend_alloc.c:462 #1 0x08175aae in php_request_shutdown (dummy=0x0) at /home/rasmus/php4/main/main.c:901 #2 0x081b8fa6 in main (argc=2, argv=0xbffff974) at /home/rasmus/php4/sapi/cgi/cgi_main.c:1100 #3 0x4047f1c4 in __libc_start_main () from /lib/libc.so.6 (gdb) p iterator $1 = (zend_mem_header *) 0x73656363 (gdb) p *iterator $2 = {magic = 0, filename = 0x0, lineno = 0, reported = 0, orig_filename = 0x0, orig_lineno = 0, pNext = 0x0, pLast = 0x0, size = 0, cached = 0} (gdb) p *t $3 = {magic = 1930623196, filename = 0x82218c0 "/home/rasmus/php4/Zend/zend_API.c", lineno = 835, reported = 1, orig_filename = 0x0, orig_lineno = 0, pNext = 0x8303350, pLast = 0x0, size = 1247, cached = 0} That fgetcsv code is nasty-looking. Not awake enough to dive in right now. Previous Comments: ------------------------------------------------------------------------ [2002-08-15 21:04:55] rasmus@php.net Reproduced here - unlikely to be a remote exploit unless someone if fgetcsv'ing over the network and the bad guy is able to change the target of that. Or of course if the bad guy gets in and changes .csv files locally, but if they are on your server already, that is the least of your worries. ------------------------------------------------------------------------ [2002-08-15 20:37:00] speedfreak50@netscape.net Below is a .csv file and a script to generate the segfault. Just tested with php4-STABLE-200208151200 using same ./configure as in Redhat php-4.1.2 source rpm. Save this file as /tmp/segfault.csv ------------------------------------ "Xxxxxxxxx Directors Meeting","6/13/2002","4:30:00 PM","6/13/2002","5:30:00 PM","False","False","6/13/2002","4:15:00 PM",,,,,,,,"",,"Normal","False","Normal","2" "IPM Network Design Review","6/14/2002","1:30:00 PM","6/14/2002","4:00:00 PM","False","False","6/14/2002","1:15:00 PM","xxxxxxxxxxx","xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx;xxxxxxxxxxxxxxxxxxxxxxxxxxxx;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",,,,," Xxxx - can you bring your projector? Agenda: Review IPM network design Design Document draft to be distributed by EOB 6/6/02 (Thursday) Decode the XXX sizing spreadsheet Start construction of consolidated flow map Build strategy to validate all network assumptions Notes - need to add ip route-cache flow to XXX downlink interface between XXXX/04 and XXXX/02 on the 6509 Enumerate netflow generation flows through the 6509 XXXX to provide netflow architectire diagram. Rip out exclusion rules for XXX What is the specification of the field difference between XXX V5 and V7 - how do we map a XXX to port and install it into XXX? What are the commission impacts for each modem technology Why is the xxxxxxxxxxxxx network layer 2 attached to xxxxxxxxxx - is this a legacy aspect that needs to be deinstalled - xxxxxxxxxxxxx. Section 5.2.1 - Change VLAN XXX to VLAN XXX Future health check consideration would be use use a tcp porbe based upon collector script that opens and closes based upon service availability Design XXX for XXX access server off xxxxxxxxxx Outbound to XXX flows - XXX section - requires engagement with XXX to define and then design into XXX frontier Add XXX Access/Access server to XXXxxx ","8/333 Rm F",,"Normal","False","Normal","2" ---------------------------------------- And run this script: -------------------------------- <? echo "<html><head></head><body>"; $fp = fopen("/tmp/segfault.csv", 'r'); if (!$fp) { echo "FALSE<br>"; exit; } echo "GETTING CSV<br>"; flush(); while ($line = fgetcsv($fp, 1024, ",")) { echo "GOT: " . $line[0] . "<br>"; flush(); } echo "</body></html>"; ?> --------------------------------- Apache child process will crash. Could this be a remote exploit? ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=18932&edit=1