Bug #71860 [Com]: null pointer exception phar::webPhar, potential code execution

Edit report at https://bugs.php.net/bug.php?id=71860&edit=1 ID: 71860 Comment by: vvvaagn at gmail dot com Reported by: vvvaagn at gmail dot com Summary: null pointer exception phar::webPhar, potential code execution Status: Open Type: Bug Package: PHAR related Operating System: all PHP Version: 7.0.5RC1 Block user comment: N Private report: N New Comment: root@TZDG001:/tmp/data2# valgrind -q ../php-7.0.4/sapi/cli/php test.php ret/crash13 ==20538== Invalid read of size 8 ==20538== at 0xC70678: zend_mm_alloc_small (zend_alloc.c:1291) ==20538== by 0xC70678: zend_mm_alloc_heap (zend_alloc.c:1358) ==20538== by 0xC70678: _emalloc (zend_alloc.c:2442) ==20538== by 0xC7696F: _estrndup (zend_alloc.c:2565) ==20538== by 0x76BD95: phar_split_fname (phar.c:2229) ==20538== by 0x732F19: phar_parse_url (stream.c:74) ==20538== by 0x747A26: phar_wrapper_open_dir (dirstream.c:315) ==20538== by 0xBA6BB7: _php_stream_opendir (streams.c:1982) ==20538== by 0x85DDB2: spl_filesystem_dir_open (spl_directory.c:236) ==20538== by 0x869E39: spl_filesystem_object_construct (spl_directory.c:724) ==20538== by 0x869E39: zim_spl_RecursiveDirectoryIterator___construct (spl_directory.c:1563) ==20538== by 0xCE6370: zend_call_function (zend_execute_API.c:879) ==20538== by 0xE0662A: zend_call_method (zend_interfaces.c:104) ==20538== by 0x779BC1: zim_Phar___construct (phar_object.c:1233) ==20538== by 0x101447C: ZEND_DO_FCALL_SPEC_HANDLER (zend_vm_execute.h:842) ==20538== Address 0x73752f2e20656c75 is not stack'd, malloc'd or (recently) free'd ==20538== ==20538== ==20538== Process terminating with default action of signal 11 (SIGSEGV) ==20538== General Protection Fault ==20538== at 0xC70678: zend_mm_alloc_small (zend_alloc.c:1291) ==20538== by 0xC70678: zend_mm_alloc_heap (zend_alloc.c:1358) ==20538== by 0xC70678: _emalloc (zend_alloc.c:2442) ==20538== by 0xC7696F: _estrndup (zend_alloc.c:2565) ==20538== by 0x76BD95: phar_split_fname (phar.c:2229) ==20538== by 0x732F19: phar_parse_url (stream.c:74) ==20538== by 0x747A26: phar_wrapper_open_dir (dirstream.c:315) ==20538== by 0xBA6BB7: _php_stream_opendir (streams.c:1982) ==20538== by 0x85DDB2: spl_filesystem_dir_open (spl_directory.c:236) ==20538== by 0x869E39: spl_filesystem_object_construct (spl_directory.c:724) ==20538== by 0x869E39: zim_spl_RecursiveDirectoryIterator___construct (spl_directory.c:1563) ==20538== by 0xCE6370: zend_call_function (zend_execute_API.c:879) ==20538== by 0xE0662A: zend_call_method (zend_interfaces.c:104) ==20538== by 0x779BC1: zim_Phar___construct (phar_object.c:1233) ==20538== by 0x101447C: ZEND_DO_FCALL_SPEC_HANDLER (zend_vm_execute.h:842) Previous Comments: ------------------------------------------------------------------------ [2016-03-19 18:50:55] vvvaagn at gmail dot com Description: ------------ tail -f /var/log/kern.log Mar 19 18:41:33 TZDG001 kernel: [10476143.454202] php[18389]: segfault at ae6572 ip 0000000000d531b4 sp 00007ffea1567a70 error 7 in php[400000+e80000] (gdb) r test.php ret/crash13 Starting program: /tmp/php-7.0.4/sapi/cli/php test.php ret/crash13 [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". Program received signal SIGSEGV, Segmentation fault. zend_string_init (persistent=0, len=2, str=0x121a64c "->") at /tmp/php-7.0.4/Zend/zend_string.h:157 157 zend_string *ret = zend_string_alloc(len, persistent); (gdb) i r rax 0xae6572 11429234 rbx 0x7fffffffa880 140737488332928 rcx 0x64c 1612 rdx 0x2 2 rsi 0x3 3 rdi 0xae658a 11429258 rbp 0x2 0x2 rsp 0x7fffffffa7e0 0x7fffffffa7e0 r8 0xfffffffffffffffb -5 r9 0x1 1 r10 0x3 3 r11 0x1214fc0 18960320 r12 0x1206b7a 18901882 r13 0x4 4 r14 0x121a64c 18982476 r15 0x7fffffffa880 140737488332928 !!! rip 0xd531b4 0xd531b4 <add_assoc_string_ex+116> eflags 0x10206 [ PF IF RF ] cs 0x33 51 ss 0x2b 43 ds 0x0 0 es 0x0 0 fs 0x0 0 gs 0x0 0 maybe potencial attackers can manipulate rip register and get RCE Test script: --------------- cat test.php ------------------- <?php $testfile = file_get_contents($argv[1]); try { $phar = new Phar($testfile); $phar['index.php'] = '<?php echo "https://twitter.com/vah_13"; ?>'; $phar['index.phps'] = '<?php echo "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"; ?>'; $phar->setStub('<?php Phar::webPhar(); __HALT_COMPILER(); ?>'); } catch (Exception $e) { print $e; }?> ------------------- root@TZDG001:/tmp/data2# base64 ret/crash13 CkTJu4AoZHKCxhC7KlDNp2g5Grx7JE092+gDAADJVR1EZS8vL/oAAPovLy8v5y8vLy9lZWVlZWVl DAwMC+MMDAwMDM4MDAwgBwwMDAwMDAxQDC8uLi8jLy88Ly8u+C8vLxERERERERERpXRDbnQgdGhh dCBtVnJrV3h4eHh4eNt4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4ePh4Ly8vLy8vLy8vLy8v Ly8vLy8vLy8vLy8vLkYvLy8vLy8vLy8vLy9kJy8vLy8vLy8vLy8v8+TzMZovLysvLy8vL3l5eXl5 eXl5eXkpIHsEAAYgICAveHh4eHh4eHh4eAF4AAJ4eP8vIExvYWQgY29tbWFuZChTgG5lIHV0aWxp dHkKICAgIGluY2yKZGUuLi4uLi4uLi4uPCYuLi4ucG1kLnBoYXIudmVKCiAgJCAvLyBSdegDIGxp bmUgTW50ZXJmYWxlCiAgIBxleGkAAP//SFBNRFxUZXh0VUl5Q29tbWFuZAAANwAAAHNyY1Rf/39N UElMRVIodjsgPz4MChAAAAANAgAAEP//+QEAAAAAAAAiAAAqAAAAlnJjL21haW4vlA8uLlEvci8u LhAA2GVzZXRzL2NsZWFucipeTUxSZW5kZXLJYEC2IQAAAABjb3JlrgAAAAAAI2OcwrYAAAAAAA0A NwAAAHMASRwAc2V0cy91bndzcmMAnjgjW7gwgAAAcmMAAgAAADN1bGVzZXRzL2MgAAAAb///f/9p YWwueG1s4BIAAB+u4VZzcmMvbWFpbi9yZXNvdXJpZ24ueABzcmMvbQA9dr2itiEASRyXl5eXl5eX l5etl5eXlwAMc3JjL21hW24v6Bvzb3VyY2VzL3J1//+AAHR0dHR0dHR0dHR0dHR0dHR0dHR0dHR0 dHR0dHR0WWV0cy9uYRwcMBwcHBwcHBwcAB+u4TSoCwD1A3lvdXJjZXMvdmVsb2Qxmi9LZ01yAB+u 4RgAACCu4VbjDy5nLnhtbP8vAC4uLjwmLnh4eHh4eHh4eHh4+HgZLy8vLi4ucG1kLnBoL3Jlc291 cmNjZXNzcgCAAAAuGnVzc3IvLg0AAHFF7BMAc3JjL/9haW4vcGhwL1BIUE1EL1BhcnMnJycnJycn JycnJycnJyfnAAAKQ5bxci5waHBtGAAAH67hGAAAH67hVuMPLi5RLy8vLy8vc3JW4QcAANevurC2 IQAAAAcAACwvdXNyLy4uL1KHAK78Vm4vcGhwL1BIUE1EL1JlbmRlcmVyKl5NTFJlbmRlcslgQLYh AAAAAAAAGwABAHNyYy9tYWluL3BoNy9QSFBNRC9SdVRlLnCAcDIYAAAfruEAAHNyYy9tYWluL3AA iy0AAABzcmMAAFeu4VYwCAAAPXa9oi8vLy8vLy8vLy8vLy8vLy8vL28v8+TzOoAAAGhwL1D/CzpE ZXZlbG9kMZovbmdNZXRob2QQcGiKlgwAIAAAAFb8BQAAI2OcwrYhAAAAACAANwAAAGNyYy9tYc7O zs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs4AEa7hVnNyYy+A////L9YhzLYhAADg////MXBo cC9QSFBNRC9PdW1hf24vcGhwL1BIUGFEUFBQUFBQUFByYy9tYWluL3BocC9QSFBNRC9SdWxML0Rl c2lnZy9Ub29PYW55TWV0aG9kfy4fruFWYy9tYWluL3BocC9QSFBNRC9SdWxlL0Rlc2lnbi8vRGV2 ZWxvZFxlbnRDbwMAAGMvbQA9dr2itiEASRwAcG1kLnARruFWjwUF//8FcIWYAAIAAAAvLi4v//// /3JILi4vLi91c3IvLi4AADYAAABecmMvUEhQTUQvUnVsZS9EZXNpZ1svV2VpAGhwAAAAc3JjLy8v LwAAAQDk8zGaLy//L1J1bGUvRJCQkJBAkJCQkJDQkJBzkJCQkJCQkJCQkJCQkJCQkG50cm9w6HAu LgAAAQAuLi4uLi4uLi4uL1BIUE1EL091bWFpdi9waHAvUEhQTURlcgAEQ2hpbGRyZW4ucGhwbQsA AB+u4VZ+BQAAgLP4+7Yh3////wAOAAAfruxWbQYAADplbi4vdf//Ly4u5i4vdQBkHwAD6AAD6AAN ADcuLhAA2DUAAAAyAAAAc3JkLy8uLi8uL1Jzci4vdXNycGguUS8vLy9/AAAAL3Vzci+uQi8uL3Vz ci8vLi98c3IvLhciLi91c3IvLi4vdXOALy4uL/////9ldHMvYyAAAABv//9//2lhbC54tbW1tbW1 tbW1tbW1vABjL+ZJTnUgZC4vc5QPAAAEAHIvLi4vdXNyLy4uLy4vdXNyLy4AZC4vAQAAAC4uL3UQ AC8uLi8uL3Vzby4vdXNyDy4uUS8vLy8vL3NyLy4vc3IvLi4odXNyAAIAAC4vdXNzci8uLi91e3Iv rkIvLmRvci9hdRAA2DVXu7YhABcuL3Vzci8uAS8u ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=71860&edit=1