Bug #71861 [NEW]: Buffer Overrun in curl_exec() causing hang

From: paul at salesintel dot com Operating system: Windows 10 x64 PHP version: 7.0.4 Package: cURL related Bug Type: Bug Bug description:Buffer Overrun in curl_exec() causing hang Description: ------------ When a couple of cURL options are set in a specific and valid way, and the curl.cainfo is set in php.ini, curl_exec() never returns and PHP does not throw any exception, causing indefinite hang. Same code in php 5.6.x (in each x32/x64 ts/nts) worked as expected. In php 7.0.4 x32/x64 nts builds, hang occurs (ts versions not tried). Test script: --------------- FILE php.ini: ;change root path of your php accordingly extension_dir = "C:\bin\php\7.0.4\nts-x32\ext\" extension=php_curl.dll curl.cainfo = "C:\bin\php\cacert.pem" ;cacert.pem downloaded from "https://curl.haxx.se/ca/cacert.pem" FILE repro.php <?php repro(); function repro() { $location = 'https://mail.microsoft.com/ews/exchange.asmx'; $request = str_repeat(' ', 1025); $ch = curl_init($location); curl_setopt($ch, CURLOPT_POSTFIELDS, $request); curl_setopt($ch, CURLOPT_HTTPAUTH, CURLAUTH_BASIC | CURLAUTH_NTLM); curl_setopt($ch, CURLOPT_USERPWD, ' '); $response = curl_exec($ch); } Expected result: ---------------- Call to curl_exec($ch) returns. Actual result: -------------- Call to curl_exec($ch) never returns. However.... If you comment out the "curl.cainfo=" setting in php.ini, curl_exec($ch) returns. If you change $location to an invalid endpoint or one that does not require NTLM, curl_exec() returns. If you remove the 'CURLAUTH_BASIC' leaving only 'CURLAUTH_NTLM', curl_exec() returns; If you remove 'CURLAUTH_NTLM' leaving only 'CURLAUTH_BASIC', curl_exec() returns; If you set an empty string ('') instead of one with one or more characters to CURLOPT_USERPWD, curl_exec() returns. $request is a string with 1025 characters. If you remove one character, leaving a (suspiciously sized) 1024 character length $request, curl_exec($ch) returns. -- Edit bug report at https://bugs.php.net/bug.php?id=71861&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=71861&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=71861&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=71861&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=71861&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=71861&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=71861&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=71861&r=needscript Try newer version: https://bugs.php.net/fix.php?id=71861&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=71861&r=support Expected behavior: https://bugs.php.net/fix.php?id=71861&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=71861&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=71861&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=71861&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=71861&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=71861&r=dst IIS Stability: https://bugs.php.net/fix.php?id=71861&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=71861&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=71861&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=71861&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=71861&r=mysqlcfg