Bug #72534 [NEW]: stream_socket_get_name crashes

From: fernando at null-life dot com Operating system: Windows PHP version: 7.0.8 Package: Streams related Bug Type: Bug Bug description:stream_socket_get_name crashes Description: ------------ stream_socket_get_name 0:000:x86> r;!exploitable -v eax=00000000 ebx=06013020 ecx=060130c0 edx=00000006 esi=10174f40 edi=06076118 eip=10175037 esp=0441e8e0 ebp=060130d0 iopl=0 nv up ei pl zr na pe nc cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010246 php7!zif_stream_socket_get_name+0xf7: 10175037 f6400502 test byte ptr [eax+5],2 ds:002b:00000005=?? !exploitable 1.6.0.0 HostMachine\HostUser Executing Processor Architecture is x86 Debuggee is in User Mode Debuggee is a live user mode debugging session on the local machine Event Type: Exception Exception Faulting Address: 0x5 First Chance Exception Type: STATUS_ACCESS_VIOLATION (0xC0000005) Exception Sub-Type: Read Access Violation Faulting Instruction:10175037 test byte ptr [eax+5],2 Basic Block: 10175037 test byte ptr [eax+5],2 Tainted Input operands: 'eax' 1017503b mov eax,1406h 10175040 cmovne eax,edx 10175043 mov dword ptr [ecx+8],eax 10175046 add esp,8 10175049 ret Exception Hash (Major/Minor): 0x12fc71c9.0xac8b025a Hash Usage : Stack Trace: Major+Minor : php7!zif_stream_socket_get_name+0xf7 Major+Minor : php7!zend_execute+0x124 Major+Minor : php7!expand_filepath_ex+0x17 Major+Minor : php7!php_execute_script+0x369 Major+Minor : KERNELBASE!BasepInitializeFindFileHandle+0x59 Minor : KERNELBASE!FindFirstFileExW+0x532 Minor : Unknown Minor : KERNELBASE!FindFirstFileA+0x139 Instruction Address: 0x0000000010175037 Source File: c:\php-sdk\php70dev\vc14\x86\php-7.0.8\ext\standard\streamsfuncs.c Source Line: 329 0:000:x86> ?? name struct _zend_string * 0x06213020 +0x000 gc : _zend_refcounted_h +0x008 h : 0 +0x00c len : 0x626b280 +0x010 val : [1] "" Code: PHP_FUNCTION(stream_socket_get_name) { php_stream *stream; zval *zstream; zend_bool want_peer; zend_string *name = NULL; #ifndef FAST_ZPP if (zend_parse_parameters(ZEND_NUM_ARGS(), "rb", &zstream, &want_peer) == FAILURE) { RETURN_FALSE; } #else ZEND_PARSE_PARAMETERS_START(2, 2) Z_PARAM_RESOURCE(zstream) Z_PARAM_BOOL(want_peer) ZEND_PARSE_PARAMETERS_END_EX(RETURN_FALSE); #endif php_stream_from_zval(stream, zstream); if (0 != php_stream_xport_get_name(stream, want_peer, &name, NULL, NULL )) { RETURN_FALSE; } RETVAL_STR(name); <--- crash here } Test script: --------------- <?php $fp0 = fopen('aa.tmp', 'w'); $v1=$fp0;$v2=FALSE; stream_socket_get_name($v1,$v2); Expected result: ---------------- No crash Actual result: -------------- (1894.19c8): Access violation - code c0000005 (first chance) First chance exceptions are reported before any exception handling. This exception may be expected and handled. php7!zif_stream_socket_get_name+0xf7: 10175037 f6400502 test byte ptr [eax+5],2 ds:002b:00000005=?? -- Edit bug report at https://bugs.php.net/bug.php?id=72534&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=72534&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=72534&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=72534&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=72534&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=72534&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=72534&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=72534&r=needscript Try newer version: https://bugs.php.net/fix.php?id=72534&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=72534&r=support Expected behavior: https://bugs.php.net/fix.php?id=72534&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=72534&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=72534&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=72534&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=72534&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=72534&r=dst IIS Stability: https://bugs.php.net/fix.php?id=72534&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=72534&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=72534&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=72534&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=72534&r=mysqlcfg