Sec Bug->Bug #72463 [Opn]: mail fails with invalid argument
Edit report at https://bugs.php.net/bug.php?id=72463&edit=1
ID: 72463
Updated by: stas@php.net
Reported by: fernando at null-life dot com
Summary: mail fails with invalid argument
Status: Open
-Type: Security
+Type: Bug
-Package: *General Issues
+Package: Mail related
Operating System: Windows
PHP Version: 7.0.7
Block user comment: N
Private report: Y
Previous Comments:
------------------------------------------------------------------------
[2016-06-21 12:29:42] fernando at null-life dot com
Some additional information:
https://github.com/php/php-src/blob/PHP-7.0.7/ext/pcre/php_pcre.c#L1345
1343 memcpy(ZSTR_VAL(result) + result_len, piece, subject_len - start_offset);
1344 result_len += subject_len - start_offset;
1345 ZSTR_VAL(result)[result_len] = '\0';
1346 ZSTR_LEN(result) = result_len;
The exception occurs while trying to write the null char, this could be a problem in PCRE or a
miss-use of the PCRE api from the TSendMail code.
------------------------------------------------------------------------
[2016-06-21 11:38:36] fernando at null-life dot com
Description:
------------
PHP 7.0.7 with debugging symbols obtained from windows.php.net
Run attached test script under windbg / cdb:
0:000:x86> k
ChildEBP RetAddr
08ffe498 624568aa php7!php_pcre_replace_impl+0x696
[c:\php-sdk\php70dev\vc14\x86\php-7.0.7\ext\pcre\php_pcre.c @ 1345]
08ffe4c0 6278fff2 php7!php_pcre_replace+0x3a
[c:\php-sdk\php70dev\vc14\x86\php-7.0.7\ext\pcre\php_pcre.c @ 1105]
08ffe508 6278fcaa php7!php_win32_mail_trim_header+0x9e
[c:\php-sdk\php70dev\vc14\x86\php-7.0.7\win32\sendmail.c @ 156]
08ffe520 62505bfb php7!TSendMail+0x6a [c:\php-sdk\php70dev\vc14\x86\php-7.0.7\win32\sendmail.c @
227]
08ffe578 62505843 php7!php_mail+0x25b [c:\php-sdk\php70dev\vc14\x86\php-7.0.7\ext\standard\mail.c @
341]
08ffe5c4 623ad9ab php7!zif_mail+0x353 [c:\php-sdk\php70dev\vc14\x86\php-7.0.7\ext\standard\mail.c @
174]
08ffe5f4 623c6a64 php7!execute_ex+0xfb
[c:\php-sdk\php70dev\vc14\x86\php-7.0.7\zend\zend_vm_execute.h @ 417]
08ffe620 623c68c7 php7!zend_execute+0x124
[c:\php-sdk\php70dev\vc14\x86\php-7.0.7\zend\zend_vm_execute.h @ 459]
08ffe670 623c6759 php7!zend_execute_scripts+0xe7 [c:\php-sdk\php70dev\vc14\x86\php-7.0.7\zend\zend.c
@ 1427]
08fff8d4 00ce1833 php7!php_execute_script+0x369 [c:\php-sdk\php70dev\vc14\x86\php-7.0.7\main\main.c
@ 2494]
08fffb88 00ce135b php!do_cli+0x3d3 [c:\php-sdk\php70dev\vc14\x86\php-7.0.7\sapi\cli\php_cli.c @ 975]
08fffc1c 00ce2271 php!main+0x2cb [c:\php-sdk\php70dev\vc14\x86\php-7.0.7\sapi\cli\php_cli.c @ 1344]
08fffc68 750838f4 php!__scrt_common_main_seh+0xff
[f:\dd\vctools\crt\vcstartup\src\startup\exe_common.inl @ 255]
https://github.com/php/php-src/blob/master/win32/sendmail.c#L227
Crash occurs when the 4th parameter is empty or null.
Test script:
---------------
<?php
mail("f@f.com","subject","a", "");
mail("f@f.com","subject","a", NULL);
Expected result:
----------------
No crash
Actual result:
--------------
Exception Faulting Address: 0x10
First Chance Exception Type: STATUS_ACCESS_VIOLATION (0xC0000005)
Exception Sub-Type: Write Access Violation
Faulting Instruction:624581a6 mov byte ptr [ebx+esi+10h],0
Basic Block:
624581a6 mov byte ptr [ebx+esi+10h],0
Tainted Input operands: 'ebx','esi'
624581ab add esp,0ch
624581ae mov dword ptr [esi+0ch],ebx
624581b1 mov ebx,dword ptr [ebp-8]
624581b4 cmp dword ptr [ebp-40h],20h
624581b8 jg php7!php_pcre_replace_impl+0x6b0 (624581c0)
Exception Hash (Major/Minor): 0x4e335b72.0xf3c17505
Hash Usage : Stack Trace:
Major+Minor : php7!php_pcre_replace_impl+0x696
Major+Minor : php7!php_pcre_replace+0x3a
Major+Minor : php7!php_win32_mail_trim_header+0x9e
Major+Minor : php7!TSendMail+0x6a
Major+Minor : php7!php_mail+0x25b
Minor : php7!zif_mail+0x353
Minor : php7!execute_ex+0xfb
Minor : php7!zend_execute+0x124
Minor : php7!zend_execute_scripts+0xe7
Minor : php7!php_execute_script+0x369
Minor : php!do_cli+0x3d3
Minor : php!main+0x2cb
Minor : php!__scrt_common_main_seh+0xff
Minor : KERNEL32!BaseThreadInitThunk+0x24
Minor : ntdll_77d90000!RtlUnicodeStringToInteger+0x253
Minor : ntdll_77d90000!RtlUnicodeStringToInteger+0x21e
Instruction Address: 0x00000000624581a6
Source File: c:\php-sdk\php70dev\vc14\x86\php-7.0.7\ext\pcre\php_pcre.c
Source Line: 1345
Description: User Mode Write AV near NULL
Short Description: WriteAVNearNull
Exploitability Classification: UNKNOWN
Recommended Bug Title: User Mode Write AV near NULL starting at
php7!php_pcre_replace_impl+0x0000000000000696 (Hash=0x4e335b72.0xf3c17505)
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=72463&edit=1
Thread (1 message)
- stas@php.net
- Unknown Message
- stas@php.net