Sec Bug->Bug #67251 [Csd]: date_parse_from_format out-of-bounds read

Edit report at https://bugs.php.net/bug.php?id=67251&edit=1 ID: 67251 Updated by: stas@php.net Reported by: stas@php.net Summary: date_parse_from_format out-of-bounds read Status: Closed -Type: Security +Type: Bug Package: *General Issues Operating System: * PHP Version: 5.4.28 Assigned To: stas Block user comment: N Private report: N Previous Comments: ------------------------------------------------------------------------ [2014-05-14 00:16:24] stas@php.net The fix for this bug has been committed. Snapshots of the sources are packaged every three hours; this change will be in the next snapshot. You can grab the snapshot at http://snaps.php.net/. For Windows: http://windows.php.net/snapshots/ Thank you for the report, and for helping us make PHP better. ------------------------------------------------------------------------ [2014-05-12 02:35:01] stas@php.net The following patch has been added/updated: Patch Name: fix-dateparse Revision: 1399862101 URL: https://bugs.php.net/patch-display.php?bug=67251&patch=fix-dateparse&revision=1399862101 ------------------------------------------------------------------------ [2014-05-12 02:14:06] stas@php.net Description: ------------ Date parsing routines do not check for string length when parsing the format with \. Test script: --------------- date_parse_from_format("\\","AAAABBBB"); Expected result: ---------------- no valgrind errors Actual result: -------------- ==31573== Conditional jump or move depends on uninitialised value(s) ==31573== at 0x450EE1: timelib_parse_from_format (parse_date.re:1890) ==31573== by 0x44896C: zif_date_parse_from_format (php_date.c:3014) ==31573== by 0x8FA5E2: zend_do_fcall_common_helper_SPEC (zend_vm_execute.h:550) ==31573== by 0x8EBE7F: execute_ex (zend_vm_execute.h:363) ==31573== by 0x86A089: zend_eval_stringl (zend_execute_API.c:1187) ==31573== by 0x86A168: zend_eval_stringl_ex (zend_execute_API.c:1234) ==31573== by 0x928472: do_cli (php_cli.c:1034) ==31573== by 0x928EB7: main (php_cli.c:1378) ==31573== ==31573== Conditional jump or move depends on uninitialised value(s) ==31573== at 0x450F09: timelib_parse_from_format (parse_date.re:2132) ==31573== by 0x44896C: zif_date_parse_from_format (php_date.c:3014) ==31573== by 0x8FA5E2: zend_do_fcall_common_helper_SPEC (zend_vm_execute.h:550) ==31573== by 0x8EBE7F: execute_ex (zend_vm_execute.h:363) ==31573== by 0x86A089: zend_eval_stringl (zend_execute_API.c:1187) ==31573== by 0x86A168: zend_eval_stringl_ex (zend_execute_API.c:1234) ==31573== by 0x928472: do_cli (php_cli.c:1034) ==31573== by 0x928EB7: main (php_cli.c:1378) ==31573== ==31573== Conditional jump or move depends on uninitialised value(s) ==31573== at 0x450F0D: timelib_parse_from_format (parse_date.re:2135) ==31573== by 0x44896C: zif_date_parse_from_format (php_date.c:3014) ==31573== by 0x8FA5E2: zend_do_fcall_common_helper_SPEC (zend_vm_execute.h:550) ==31573== by 0x8EBE7F: execute_ex (zend_vm_execute.h:363) ==31573== by 0x86A089: zend_eval_stringl (zend_execute_API.c:1187) ==31573== by 0x86A168: zend_eval_stringl_ex (zend_execute_API.c:1234) ==31573== by 0x928472: do_cli (php_cli.c:1034) ==31573== by 0x928EB7: main (php_cli.c:1378) ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=67251&edit=1