Bug #71561 [NEW]: NULL Pointer Deference in virtual_file_ex

From: martino dot sani at gmail dot com Operating system: Debian 4.0.8-2 x86_64 GNU/Linux PHP version: master-Git-2016-02-09 (Git) Package: Reproducible crash Bug Type: Bug Bug description:NULL Pointer Deference in virtual_file_ex Description: ------------ virtual_file_ex method in the zend_virtual_cwd.c file uses a char* argument that could be NULL. I triggered this issue through extractTo method in the PHP Zip extension (see test script), opening a not existing ZIP archive. Vulnerable code in zend_virtual_cwd.c: CWD_API int virtual_file_ex(cwd_state *state, const char *path, verify_path_func verify_path, int use_realpath) /* {{{ */ { // path could be NULL int path_length = (int)strlen(path); The issue is triggerable via addEmptyDir and extractTo Zip extension methods, if not existing zip archive will be opened. extractTo method in the php_zip.c file: /* Extract all files */ // zip_get_num_files returns 1 (intern->nentry is equal to 1) because, I think, addEmptyDir incremented it. int filecount = zip_get_num_files(intern); if (filecount == -1) { // ... } for (i = 0; i < filecount; i++) { // zip_get_name returns NULL char *file = (char*)zip_get_name(intern, i, ZIP_FL_UNCHANGED); // php_zip_extract_file uses virtual_file_ex if (!php_zip_extract_file(intern, pathto, file, strlen(file))) { RETURN_FALSE; } } PHP builded using: ./buildconf --force ./configure --prefix=/opt/php --enable-debug --enable-zip make && make install Test script: --------------- <?php $zip = new ZipArchive(); // Open a not existing zip file $zip->open("/dev/shm/notexisting.zip", ZIPARCHIVE::CREATE); $zip->addEmptyDir("foo"); // Program terminated with signal SIGSEGV, Segmentation fault. $zip->extractTo("/dev/shm/"); $zip->close(); ?> Expected result: ---------------- PHP interpreter should not crash. No actions could be performed by extractTo method because the zip file does not physically exist, or the "in-memory" zip archive could be handled as a normal archive (if possible). Actual result: -------------- PHP interpreter crashes with a SIGSEGV. $ gdb) where #0 strlen () at ../sysdeps/x86_64/strlen.S:106 #1 0x000000000079055a in c_ziparchive_extractTo (execute_data=0x7f3656a15120, return_value=0x7f3656a15100) at /php-src/master/src/ext/zip/php_zip.c:2671 #2 0x0000000000891c3a in ZEND_DO_FCALL_SPEC_RETVAL_UNUSED_HANDLER () at /php-src/master/src/Zend/zend_vm_execute.h:1024 #3 0x0000000000890610 in execute_ex (ex=0x7f3656a15030) at /php-src/master/src/Zend/zend_vm_execute.h:422 #4 0x0000000000890721 in zend_execute (op_array=0x7f3656a82000, return_value=0x0) at /php-src/master/src/Zend/zend_vm_execute.h:466 #5 0x00000000008362e8 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /php-src/master/src/Zend/zend.c:1427 #6 0x00000000007a76ae in php_execute_script (primary_file=0x7ffd6efe8db0) at /php-src/master/src/main/main.c:2484 #7 0x0000000000908079 in do_cli (argc=3, argv=0x18a1c40) at /php-src/master/src/sapi/cli/php_cli.c:974 #8 0x0000000000909043 in main (argc=3, argv=0x18a1c40) at /php-src/master/src/sapi/cli/php_cli.c:1345 -- Edit bug report at https://bugs.php.net/bug.php?id=71561&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=71561&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=71561&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=71561&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=71561&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=71561&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=71561&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=71561&r=needscript Try newer version: https://bugs.php.net/fix.php?id=71561&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=71561&r=support Expected behavior: https://bugs.php.net/fix.php?id=71561&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=71561&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=71561&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=71561&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=71561&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=71561&r=dst IIS Stability: https://bugs.php.net/fix.php?id=71561&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=71561&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=71561&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=71561&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=71561&r=mysqlcfg