Bug #72138 [Opn->Csd]: Integer Overflow in Length of String-typed ZVAL

Edit report at https://bugs.php.net/bug.php?id=72138&edit=1 ID: 72138 Updated by: stas@php.net Reported by: taoguangchen at icloud dot com Summary: Integer Overflow in Length of String-typed ZVAL -Status: Open +Status: Closed Type: Bug Package: Reproducible crash Operating System: * PHP Version: 5.6.21 Block user comment: N Private report: N New Comment: Automatic comment on behalf of stas Revision: http://git.php.net/?p=php-src.git;a=commit;h=4c968c6ddd2d3eb46838db153264edf5c7b3fefa Log: Fix bug #72138 - Integer Overflow in Length of String-typed ZVAL Previous Comments: ------------------------------------------------------------------------ [2016-05-10 05:28:21] stas@php.net This does not look like security issue - requires special code under unrealistic memory limit. ------------------------------------------------------------------------ [2016-05-02 10:08:11] taoguangchen at icloud dot com Description: ------------ ``` typedef union _zvalue_value { long lval; /* long value */ double dval; /* double value */ struct { char *val; int len; } str; HashTable *ht; /* hash table value */ zend_object_value obj; } zvalue_value; ``` The len is defined as signed int, integer overflow is possible in some situations, that results in len into a negative value and get a corrupted string-typed ZVAL. ex: str_replace/str_ireplace ``` Z_STRLEN_P(result) = len + (char_count * (to_len - 1)); ``` PoC: ``` <?php ini_set('memory_limit', -1); $str = str_replace('B', 'AAAAAAAA', str_repeat('B', 0xffffffff/8)); var_dump(strlen($str)); ?> ``` ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=72138&edit=1