Bug #71220 [Csd]: Null pointer deref (segfault) in compact via ob_start

Edit report at https://bugs.php.net/bug.php?id=71220&edit=1 ID: 71220 User updated by: hugh at allthethings dot co dot nz Reported by: hugh at allthethings dot co dot nz Summary: Null pointer deref (segfault) in compact via ob_start Status: Closed Type: Bug Package: Reproducible crash Operating System: Linux PHP Version: 7.0.1 Assigned To: laruence Block user comment: N Private report: N New Comment: Hi stas, I mean functions that are defined in the Zend c language space rather than php userland which I assume is what ob_start is intended for. Here the compact is. Actually calling zif_compact and in the other vug reports they are also zif_ functions. Sorry about confusion about what I meant with Zend defined. Hopefully this clears it uo Previous Comments: ------------------------------------------------------------------------ [2015-12-27 23:18:57] stas@php.net Hugh, what you mean by "zend defined functions"? compact() is a regular PHP function: http://php.net/manual/en/function.compact.php ------------------------------------------------------------------------ [2015-12-26 09:01:55] hugh at allthethings dot co dot nz Just to make sure you understand. This requires a different patch to the one you did in bug #71221. I'm a bit confused why the stance from php devs have changed since the comment from an in bug #70183? In my opinion, the big issue here is that you are allowed to call zend defined functions via ob_start instead of just userland defined functions. So far I've filed three independent reports about this and got two patches in and awaiting a third here. I'm positive if I start fuzzing this again I'll find more. If you would like I'm happy collaborating with php to get a patch in that will fix that root issue if I can get guarantee that a patch of that nature would be accepted by upstream. Cheers, Hugh ------------------------------------------------------------------------ [2015-12-26 08:47:46] laruence@php.net simple null pointer deref,and it require specific codes. I don't this this is a security issue. and your patch has been committed, thus closed. thanks ------------------------------------------------------------------------ [2015-12-26 05:47:32] hugh at allthethings dot co dot nz Hi, This is a null pointer deference, which is described on the common weakness enumeration (CWE) list as CWE-476 [1]. It can cause a denial of service, by causing the PHP process to crash unexpectedly (segmentation fault on linux systems). It is similar to bug #70290 which you fixed promptly, and to earlier bugs I filed such as bug #70183 where ab said that similar bugs (null pointer derefence causing crashes) would count as security after PHP 7 was released, which it has. If you would like me to label null pointer derefences as non security issues in future, let me know. Cheers, Hugh [1] - https://cwe.mitre.org/data/definitions/476.html ------------------------------------------------------------------------ [2015-12-26 05:21:44] laruence@php.net I think this is not a security issue, public it. ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=71220 -- Edit this bug report at https://bugs.php.net/bug.php?id=71220&edit=1