Sec Bug->Bug #67253 [Opn->Csd]: timelib_meridian_with_check out-of-bounds read

Edit report at https://bugs.php.net/bug.php?id=67253&edit=1 ID: 67253 Updated by: stas@php.net Reported by: stas@php.net Summary: timelib_meridian_with_check out-of-bounds read -Status: Open +Status: Closed -Type: Security +Type: Bug Package: *General Issues Operating System: * PHP Version: 5.4.28 -Assigned To: +Assigned To: stas Block user comment: N Private report: Y New Comment: The fix for this bug has been committed. Snapshots of the sources are packaged every three hours; this change will be in the next snapshot. You can grab the snapshot at http://snaps.php.net/. For Windows: http://windows.php.net/snapshots/ Thank you for the report, and for helping us make PHP better. Previous Comments: ------------------------------------------------------------------------ [2014-05-12 04:09:43] stas@php.net The following patch has been added/updated: Patch Name: fix-timelib Revision: 1399867783 URL: https://bugs.php.net/patch-display.php?bug=67253&patch=fix-timelib&revision=1399867783 ------------------------------------------------------------------------ [2014-05-12 03:58:40] stas@php.net Description: ------------ timelib_meridian_with_check does not check for string end and thus can read past the end of the string. Test script: --------------- date_parse_from_format("aHa0", "0=G{$z}9UCNnF"); Expected result: ---------------- no memory errors Actual result: -------------- ==8881== Invalid read of size 1 ==8881== at 0x44FEEB: timelib_meridian_with_check (parse_date.re:413) ==8881== by 0x47DC2D: timelib_parse_from_format (parse_date.re:1984) ==8881== by 0x4489AC: zif_date_parse_from_format (php_date.c:3014) ==8881== by 0x90C3A2: zend_do_fcall_common_helper_SPEC (zend_vm_execute.h:550) ==8881== by 0x8FDC3F: execute_ex (zend_vm_execute.h:363) ==8881== by 0x87BE49: zend_eval_stringl (zend_execute_API.c:1187) ==8881== by 0x87BF28: zend_eval_stringl_ex (zend_execute_API.c:1234) ==8881== by 0x93A232: do_cli (php_cli.c:1034) ==8881== by 0x93AC77: main (php_cli.c:1378) ==8881== Address 0x15ffb06a is 0 bytes after a block of size 10 alloc'd ==8881== at 0x4C2710F: realloc (vg_replace_malloc.c:525) ==8881== by 0x8820A4: add_string_to_string (zend_operators.c:1280) ==8881== by 0x8E61BA: ZEND_ADD_STRING_SPEC_TMP_CONST_HANDLER (zend_vm_execute.h:8921) ==8881== by 0x8FDC3F: execute_ex (zend_vm_execute.h:363) ==8881== by 0x87BE49: zend_eval_stringl (zend_execute_API.c:1187) ==8881== by 0x87BF28: zend_eval_stringl_ex (zend_execute_API.c:1234) ==8881== by 0x93A232: do_cli (php_cli.c:1034) ==8881== by 0x93AC77: main (php_cli.c:1378) ==8881== Invalid read of size 1 ==8881== at 0x44FD2E: add_pbf_error (parse_date.re:371) ==8881== by 0x47E38A: timelib_parse_from_format (parse_date.re:2154) ==8881== by 0x4489AC: zif_date_parse_from_format (php_date.c:3014) ==8881== by 0x90C3A2: zend_do_fcall_common_helper_SPEC (zend_vm_execute.h:550) ==8881== by 0x8FDC3F: execute_ex (zend_vm_execute.h:363) ==8881== by 0x87BE49: zend_eval_stringl (zend_execute_API.c:1187) ==8881== by 0x87BF28: zend_eval_stringl_ex (zend_execute_API.c:1234) ==8881== by 0x93A232: do_cli (php_cli.c:1034) ==8881== by 0x93AC77: main (php_cli.c:1378) ==8881== Address 0x15ffb06a is 0 bytes after a block of size 10 alloc'd ==8881== at 0x4C2710F: realloc (vg_replace_malloc.c:525) ==8881== by 0x8820A4: add_string_to_string (zend_operators.c:1280) ==8881== by 0x8E61BA: ZEND_ADD_STRING_SPEC_TMP_CONST_HANDLER (zend_vm_execute.h:8921) ==8881== by 0x8FDC3F: execute_ex (zend_vm_execute.h:363) ==8881== by 0x87BE49: zend_eval_stringl (zend_execute_API.c:1187) ==8881== by 0x87BF28: zend_eval_stringl_ex (zend_execute_API.c:1234) ==8881== by 0x93A232: do_cli (php_cli.c:1034) ==8881== by 0x93AC77: main (php_cli.c:1378) ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=67253&edit=1