Bug #65744 [Fbk->NoF]: zend mm integer overflow

Edit report at https://bugs.php.net/bug.php?id=65744&edit=1 ID: 65744 Updated by: php-bugs@lists.php.net Reported by: moltesalt at gmail dot com Summary: zend mm integer overflow -Status: Feedback +Status: No Feedback Type: Bug Package: Reproducible crash PHP Version: master-Git-2013-09-23 (Git) Private report: Y New Comment: No feedback was provided. The bug is being suspended because we assume that you are no longer experiencing the problem. If this is not the case and you are able to provide the information that was requested earlier, please do so and change the status of the bug back to "Re-Opened". Thank you. Previous Comments: ------------------------------------------------------------------------ [2014-06-09 05:45:00] stas@php.net Thank you for this bug report. To properly diagnose the problem, we need a short but complete example script to be able to reproduce this bug ourselves. A proper reproducing script starts with <?php and ends with ?>, is max. 10-20 lines long and does not require any external resources such as databases, etc. If the script requires a database to demonstrate the issue, please make sure it creates all necessary tables, stored procedures etc. Please avoid embedding huge scripts into the report. Could you please provide some code example that reproduces the crash? ------------------------------------------------------------------------ [2013-09-23 20:08:14] moltesalt at gmail dot com Description: ------------ The _estrndup() function requires length parameter as an unsigned int, but there are some macro and code block which pass a signed int. For example: http://lxr.php.net/xref/PHP_5_5/Zend/zend_API.h#582 http://lxr.php.net/xref/PHP_5_4/Zend/zend_API.h#578 578#define ZVAL_STRINGL(z, s, l, duplicate) do { \ 579 const char *__s=(s); int __l=l; \ 580 zval *__z = (z); \ 581 Z_STRLEN_P(__z) = __l; \ 582 Z_STRVAL_P(__z) = (duplicate?estrndup(__s, __l):(char*)__s);\ 583 Z_TYPE_P(__z) = IS_STRING; \ 584 } while (0) The successful exploit requires the control of both the string and length. Successful exploitation can lead to memory leak exploits. ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=65744&edit=1