Edit report at https://bugs.php.net/bug.php?id=70077&edit=1
ID: 70077
Updated by: php-bugs@lists.php.net
Reported by: brian dot carpenter at gmail dot com
Summary: Segfault / stack corruption in zend_call_function
(zend_execute_API.c:696)
-Status: Feedback
+Status: No Feedback
Type: Bug
Package: Reproducible crash
Operating System: Debian 7
PHP Version: 7.0Git-2015-07-14 (Git)
Private report: N
New Comment:
No feedback was provided. The bug is being suspended because
we assume that you are no longer experiencing the problem.
If this is not the case and you are able to provide the
information that was requested earlier, please do so and
change the status of the bug back to "Re-Opened". Thank you.
Previous Comments:
------------------------------------------------------------------------
[2015-08-03 10:31:56] dmitry@php.net
This is not a stack corruption.
This is a stack overflow caused by infinity recursion in PHP code.
I wouldn't interpret this like a bug at all.
------------------------------------------------------------------------
[2015-07-18 05:49:26] brian dot carpenter at gmail dot com
According to 3v4l.org, this code crashes every version between PHP 5.0.0 and 7.0.0alpha2.
------------------------------------------------------------------------
[2015-07-18 05:29:27] brian dot carpenter at gmail dot com
I've retested this with PHP 7.0.0-dev (cli) (built: Jul 15 2015 16:00:56) and the test case I
provided still crashes:
==25286== Stack overflow in thread #1: can't grow stack to 0xffe801000
==25286==
==25286== Process terminating with default action of signal 11 (SIGSEGV)
==25286== Access not within mapped region at address 0xFFE801FF8
==25286== Stack overflow in thread #1: can't grow stack to 0xffe801000
==25286== at 0x132137D: _emalloc (zend_alloc.c:2203)
==25286== If you believe this happened as a result of a stack
==25286== overflow in your program's main thread (unlikely but
==25286== possible), you can try to increase the size of the
==25286== main thread stack using the --main-stacksize= flag.
==25286== The main thread stack size used in this run was 8388608.
==25286== Stack overflow in thread #1: can't grow stack to 0xffe801000
==25286==
==25286== Process terminating with default action of signal 11 (SIGSEGV)
==25286== Access not within mapped region at address 0xFFE801FF0
==25286== Stack overflow in thread #1: can't grow stack to 0xffe801000
==25286== at 0x4A22620: _vgnU_freeres (vg_preloaded.c:58)
==25286== If you believe this happened as a result of a stack
==25286== overflow in your program's main thread (unlikely but
==25286== possible), you can try to increase the size of the
==25286== main thread stack using the --main-stacksize= flag.
==25286== The main thread stack size used in this run was 8388608.
Segmentation fault
Program received signal SIGSEGV, Segmentation fault.
0x00000000014f05b4 in zend_call_method ()
(gdb) bt
#0 0x00000000014f05b4 in zend_call_method ()
#1 0x00007ffff6003118 in ?? ()
#2 0x0000000001c45d4c in ?? ()
#3 0x0000000000000c08 in ?? ()
#4 0x000000000146209f in _zend_hash_add ()
#5 0x00007ffff5abeb90 in ?? ()
#6 0x00007ffff5b225a0 in ?? ()
#7 0x0000000000000000 in ?? ()
(gdb) i r
rax 0x0 0
rbx 0x7fffff7ff1c0 140737479963072
rcx 0x1c45d4c 29646156
rdx 0x7ffff6003118 140737320595736
rsi 0x7ffff6003018 140737320595480
rdi 0x7fffff7ff1c0 140737479963072
rbp 0x1 0x1
rsp 0x7fffff7fefa8 0x7fffff7fefa8
r8 0x5 5
r9 0x0 0
r10 0x7ffff5b1e7e0 140737315465184
r11 0x7ffff5b225a0 140737315480992
r12 0x7ffff5abeb90 140737315072912
r13 0x7ffff60640e0 140737320992992
r14 0x7ffff6003018 140737320595480
r15 0x7ffff6003118 140737320595736
rip 0x14f05b4 0x14f05b4 <zend_call_method+148>
eflags 0x10202 [ IF RF ]
cs 0x33 51
ss 0x2b 43
ds 0x0 0
es 0x0 0
fs 0x0 0
gs 0x0 0
------------------------------------------------------------------------
[2015-07-14 18:01:57] brian dot carpenter at gmail dot com
Description:
------------
While fuzzing PHP 7.0.0-dev (cli) (built: Jul 12 2015 03:27:06) I came across a script that causes a
segfault (and possible stack corruption) in zend_call_function (zend_execute_API.c:696). It also
appears to affect PHP 5.4.41-0+deb7u1 (cli) (built: May 22 2015 12:49:18).
Test script:
---------------
<?php
class wp0{private$d;function __get($e){$wp0=new wp0;$wp0->e;}}function c(){(0);}$wp0=new
wp0;$wp0->i;
Expected result:
----------------
No crash.
Actual result:
--------------
==12935== Stack overflow in thread 1: can't grow stack to 0x7fe801fe8
==12935==
==12935== Process terminating with default action of signal 11 (SIGSEGV)
==12935== Access not within mapped region at address 0x7FE801FE8
==12935== at 0x1622978: zend_call_method (zend_interfaces.c:43)
==12935== If you believe this happened as a result of a stack
==12935== overflow in your program's main thread (unlikely but
==12935== possible), you can try to increase the size of the
==12935== main thread stack using the --main-stacksize= flag.
==12935== The main thread stack size used in this run was 8388608.
==12935== Stack overflow in thread 1: can't grow stack to 0x7fe801fe0
==12935==
==12935== Process terminating with default action of signal 11 (SIGSEGV)
==12935== Access not within mapped region at address 0x7FE801FE0
==12935== at 0x4A226E0: _vgnU_freeres (vg_preloaded.c:58)
==12935== If you believe this happened as a result of a stack
==12935== overflow in your program's main thread (unlikely but
==12935== possible), you can try to increase the size of the
==12935== main thread stack using the --main-stacksize= flag.
==12935== The main thread stack size used in this run was 8388608.
Segmentation fault
Starting program: /home/geeknik/php-src/sapi/cli/php test00-min
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Program received signal SIGSEGV, Segmentation fault.
0x00000000014d38f8 in zend_call_function (fci=0x7fffff7ff180,
fci_cache=0x7fffff7ff150)
at /home/geeknik/php-src/Zend/zend_execute_API.c:696
696 if (!EG(active)) {
(gdb) bt
#0 0x00000000014d38f8 in zend_call_function (fci=0x7fffff7ff180,
fci_cache=0x7fffff7ff150)
at /home/geeknik/php-src/Zend/zend_execute_API.c:696
#1 0x0000000065675f00 in ?? ()
#2 0x00007ffff5b04660 in ?? ()
#3 0x00007fffff7ff1d0 in ?? ()
#4 0x00007fffff7ff1d0 in ?? ()
#5 0x0000000000000000 in ?? ()
(gdb) i r
rax 0x7ffff5ab2dd0 140737315024336
rbx 0x7fffff7ff2a0 140737479963296
rcx 0x7ffff5b04660 140737315358304
rdx 0x65675f00 1701273344
rsi 0x7fffff7ff150 140737479962960
rdi 0x7fffff7ff180 140737479963008
rbp 0x1 0x1
rsp 0x7fffff7fef78 0x7fffff7fef78
r8 0x5 5
r9 0x7ffff6003118 140737320595736
r10 0x7ffff6003230 140737320596016
r11 0x5 5
r12 0x7fffff7ff180 140737479963008
r13 0x2056ba0 33909664
r14 0x0 0
r15 0x7ffff6003018 140737320595480
rip 0x14d38f8 0x14d38f8 <zend_call_function+136>
eflags 0x10202 [ IF RF ]
cs 0x33 51
ss 0x2b 43
ds 0x0 0
es 0x0 0
fs 0x0 0
gs 0x0 0
(gdb) exploitable
Description: Possible stack corruption
Short description: PossibleStackCorruption (7/22)
Hash: fdacf7bfdade269be71df9a402726823.9a75f6ab0bd3a6de69a05282ade5ee5d
Exploitability Classification: EXPLOITABLE
Explanation: GDB generated an error while unwinding the stack and/or the stack contained return
addresses that were not mapped in the inferior's process address space and/or the stack pointer
is pointing to a location outside the default stack region. These conditions likely indicate stack
corruption, which is generally considered exploitable.
Other tags: DestAv (8/22), AccessViolation (21/22)
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=70077&edit=1