Sec Bug->Bug #70077 [Opn]: Segfault / stack corruption in zend_call_function (zend_execute_API.c:696)

Edit report at https://bugs.php.net/bug.php?id=70077&edit=1 ID: 70077 Updated by: stas@php.net Reported by: brian dot carpenter at gmail dot com Summary: Segfault / stack corruption in zend_call_function (zend_execute_API.c:696) Status: Open -Type: Security +Type: Bug Package: Reproducible crash Operating System: Debian 7 PHP Version: 7.0Git-2015-07-14 (Git) Block user comment: N Private report: Y Previous Comments: ------------------------------------------------------------------------ [2015-07-18 05:29:27] brian dot carpenter at gmail dot com I've retested this with PHP 7.0.0-dev (cli) (built: Jul 15 2015 16:00:56) and the test case I provided still crashes: ==25286== Stack overflow in thread #1: can't grow stack to 0xffe801000 ==25286== ==25286== Process terminating with default action of signal 11 (SIGSEGV) ==25286== Access not within mapped region at address 0xFFE801FF8 ==25286== Stack overflow in thread #1: can't grow stack to 0xffe801000 ==25286== at 0x132137D: _emalloc (zend_alloc.c:2203) ==25286== If you believe this happened as a result of a stack ==25286== overflow in your program's main thread (unlikely but ==25286== possible), you can try to increase the size of the ==25286== main thread stack using the --main-stacksize= flag. ==25286== The main thread stack size used in this run was 8388608. ==25286== Stack overflow in thread #1: can't grow stack to 0xffe801000 ==25286== ==25286== Process terminating with default action of signal 11 (SIGSEGV) ==25286== Access not within mapped region at address 0xFFE801FF0 ==25286== Stack overflow in thread #1: can't grow stack to 0xffe801000 ==25286== at 0x4A22620: _vgnU_freeres (vg_preloaded.c:58) ==25286== If you believe this happened as a result of a stack ==25286== overflow in your program's main thread (unlikely but ==25286== possible), you can try to increase the size of the ==25286== main thread stack using the --main-stacksize= flag. ==25286== The main thread stack size used in this run was 8388608. Segmentation fault Program received signal SIGSEGV, Segmentation fault. 0x00000000014f05b4 in zend_call_method () (gdb) bt #0 0x00000000014f05b4 in zend_call_method () #1 0x00007ffff6003118 in ?? () #2 0x0000000001c45d4c in ?? () #3 0x0000000000000c08 in ?? () #4 0x000000000146209f in _zend_hash_add () #5 0x00007ffff5abeb90 in ?? () #6 0x00007ffff5b225a0 in ?? () #7 0x0000000000000000 in ?? () (gdb) i r rax 0x0 0 rbx 0x7fffff7ff1c0 140737479963072 rcx 0x1c45d4c 29646156 rdx 0x7ffff6003118 140737320595736 rsi 0x7ffff6003018 140737320595480 rdi 0x7fffff7ff1c0 140737479963072 rbp 0x1 0x1 rsp 0x7fffff7fefa8 0x7fffff7fefa8 r8 0x5 5 r9 0x0 0 r10 0x7ffff5b1e7e0 140737315465184 r11 0x7ffff5b225a0 140737315480992 r12 0x7ffff5abeb90 140737315072912 r13 0x7ffff60640e0 140737320992992 r14 0x7ffff6003018 140737320595480 r15 0x7ffff6003118 140737320595736 rip 0x14f05b4 0x14f05b4 <zend_call_method+148> eflags 0x10202 [ IF RF ] cs 0x33 51 ss 0x2b 43 ds 0x0 0 es 0x0 0 fs 0x0 0 gs 0x0 0 ------------------------------------------------------------------------ [2015-07-14 18:01:57] brian dot carpenter at gmail dot com Description: ------------ While fuzzing PHP 7.0.0-dev (cli) (built: Jul 12 2015 03:27:06) I came across a script that causes a segfault (and possible stack corruption) in zend_call_function (zend_execute_API.c:696). It also appears to affect PHP 5.4.41-0+deb7u1 (cli) (built: May 22 2015 12:49:18). Test script: --------------- <?php class wp0{private$d;function __get($e){$wp0=new wp0;$wp0->e;}}function c(){(0);}$wp0=new wp0;$wp0->i; Expected result: ---------------- No crash. Actual result: -------------- ==12935== Stack overflow in thread 1: can't grow stack to 0x7fe801fe8 ==12935== ==12935== Process terminating with default action of signal 11 (SIGSEGV) ==12935== Access not within mapped region at address 0x7FE801FE8 ==12935== at 0x1622978: zend_call_method (zend_interfaces.c:43) ==12935== If you believe this happened as a result of a stack ==12935== overflow in your program's main thread (unlikely but ==12935== possible), you can try to increase the size of the ==12935== main thread stack using the --main-stacksize= flag. ==12935== The main thread stack size used in this run was 8388608. ==12935== Stack overflow in thread 1: can't grow stack to 0x7fe801fe0 ==12935== ==12935== Process terminating with default action of signal 11 (SIGSEGV) ==12935== Access not within mapped region at address 0x7FE801FE0 ==12935== at 0x4A226E0: _vgnU_freeres (vg_preloaded.c:58) ==12935== If you believe this happened as a result of a stack ==12935== overflow in your program's main thread (unlikely but ==12935== possible), you can try to increase the size of the ==12935== main thread stack using the --main-stacksize= flag. ==12935== The main thread stack size used in this run was 8388608. Segmentation fault Starting program: /home/geeknik/php-src/sapi/cli/php test00-min [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". Program received signal SIGSEGV, Segmentation fault. 0x00000000014d38f8 in zend_call_function (fci=0x7fffff7ff180, fci_cache=0x7fffff7ff150) at /home/geeknik/php-src/Zend/zend_execute_API.c:696 696 if (!EG(active)) { (gdb) bt #0 0x00000000014d38f8 in zend_call_function (fci=0x7fffff7ff180, fci_cache=0x7fffff7ff150) at /home/geeknik/php-src/Zend/zend_execute_API.c:696 #1 0x0000000065675f00 in ?? () #2 0x00007ffff5b04660 in ?? () #3 0x00007fffff7ff1d0 in ?? () #4 0x00007fffff7ff1d0 in ?? () #5 0x0000000000000000 in ?? () (gdb) i r rax 0x7ffff5ab2dd0 140737315024336 rbx 0x7fffff7ff2a0 140737479963296 rcx 0x7ffff5b04660 140737315358304 rdx 0x65675f00 1701273344 rsi 0x7fffff7ff150 140737479962960 rdi 0x7fffff7ff180 140737479963008 rbp 0x1 0x1 rsp 0x7fffff7fef78 0x7fffff7fef78 r8 0x5 5 r9 0x7ffff6003118 140737320595736 r10 0x7ffff6003230 140737320596016 r11 0x5 5 r12 0x7fffff7ff180 140737479963008 r13 0x2056ba0 33909664 r14 0x0 0 r15 0x7ffff6003018 140737320595480 rip 0x14d38f8 0x14d38f8 <zend_call_function+136> eflags 0x10202 [ IF RF ] cs 0x33 51 ss 0x2b 43 ds 0x0 0 es 0x0 0 fs 0x0 0 gs 0x0 0 (gdb) exploitable Description: Possible stack corruption Short description: PossibleStackCorruption (7/22) Hash: fdacf7bfdade269be71df9a402726823.9a75f6ab0bd3a6de69a05282ade5ee5d Exploitability Classification: EXPLOITABLE Explanation: GDB generated an error while unwinding the stack and/or the stack contained return addresses that were not mapped in the inferior's process address space and/or the stack pointer is pointing to a location outside the default stack region. These conditions likely indicate stack corruption, which is generally considered exploitable. Other tags: DestAv (8/22), AccessViolation (21/22) ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=70077&edit=1