Bug #71894 [Opn->Ana]: AddressSanitizer: global-buffer-overflow in zif_cal_from_jd

Edit report at https://bugs.php.net/bug.php?id=71894&edit=1 ID: 71894 Updated by: cmb@php.net Reported by: fernando at null-life dot com Summary: AddressSanitizer: global-buffer-overflow in zif_cal_from_jd -Status: Open +Status: Analyzed Type: Bug Package: Calendar related Operating System: Linux PHP Version: 5.6.19 -Assigned To: +Assigned To: cmb Block user comment: N Private report: N New Comment: The actual problem is that Julian days < 347998, which result in invalid Jewish dates are not particularly catered to. Simply fixing this OOB read is possible, but still would yield nonsentical results from cal_from_jd($jd, CAL_JEWISH) wrt. the day. Therefore it appears to be reasonable to also adjust the day related fields. Previous Comments: ------------------------------------------------------------------------ [2016-04-04 01:37:53] fernando at null-life dot com The following command also segfaults under ASAN: php -r "jdmonthname(6,4);" ==6871==ERROR: AddressSanitizer: global-buffer-overflow on address 0x0a4ad5fc at pc 0x08422429 bp 0xbfffcd08 sp 0xbfffccf8 READ of size 4 at 0x0a4ad5fc thread T0 #0 0x8422428 in zif_jdmonthname /home/fmunozs/phpasan/php5-5.6.17+dfsg.orig/ext/calendar/calendar.c:740 #1 0x9a92c45 in zend_do_fcall_common_helper_SPEC /home/fmunozs/phpasan/php5-5.6.17+dfsg.orig/Zend/zend_vm_execute.h:558 #2 0x967ec95 in execute_ex /home/fmunozs/phpasan/php5-5.6.17+dfsg.orig/Zend/zend_vm_execute.h:363 #3 0x982b063 in zend_execute /home/fmunozs/phpasan/php5-5.6.17+dfsg.orig/Zend/zend_vm_execute.h:388 #4 0x93ecc33 in zend_eval_stringl /home/fmunozs/phpasan/php5-5.6.17+dfsg.orig/Zend/zend_execute_API.c:1077 #5 0x93ed66f in zend_eval_stringl_ex /home/fmunozs/phpasan/php5-5.6.17+dfsg.orig/Zend/zend_execute_API.c:1124 #6 0x93ed66f in zend_eval_string_ex /home/fmunozs/phpasan/php5-5.6.17+dfsg.orig/Zend/zend_execute_API.c:1135 #7 0x9a9f291 in do_cli /home/fmunozs/phpasan/php5-5.6.17+dfsg.orig/sapi/cli/php_cli.c:1034 #8 0x8088248 in main /home/fmunozs/phpasan/php5-5.6.17+dfsg.orig/sapi/cli/php_cli.c:1378 #9 0xb763f645 in __libc_start_main (/lib/i386-linux-gnu/libc.so.6+0x18645) #10 0x808881b (/home/fmunozs/phpasan/php5-5.6.17+dfsg.orig/sapi/cli/php+0x808881b) Line 740 includes the same macro, so it's probably the same issue.: monthname = JEWISH_MONTH_NAME(year)[month]; ------------------------------------------------------------------------ [2016-03-25 21:08:55] stas@php.net ext/calendar/calendar.c:426 is this: https://github.com/php/php-src/blob/PHP-5.6/ext/calendar/calendar.c#L426 add_assoc_string(return_value, "abbrevmonth", JEWISH_MONTH_NAME(year)[month], 1); And month year and day would be 0 there. As far as I can see, the only issue there may be this: #define JEWISH_MONTH_NAME(year) ((monthsPerYear[((year)-1) % 19] == 13)?JewishMonthNameLeap:JewishMonthName) If year is 0, it may access monthsPerYear[-1] which is not right. Would not produce any consequences though as it is used to just choose between two options, each of which would produce "" anyway. Accessing [-1] is not nice, but definitely not a security issue. ------------------------------------------------------------------------ [2016-03-25 07:19:42] fernando at null-life dot com Description: ------------ Recompile PHP with ASAN enabled and run the test script. Test script: --------------- <?php cal_from_jd(999, CAL_JEWISH); Expected result: ---------------- Not crash Actual result: -------------- $ /home/fmunozs/phpasan/php5-5.6.17+dfsg.orig/sapi/cli/php test.php ================================================================= ==12485==ERROR: AddressSanitizer: global-buffer-overflow on address 0x0a188e7c at pc 0x083db7aa bp 0xbfb5d3a8 sp 0xbfb5d398 READ of size 4 at 0x0a188e7c thread T0 #0 0x83db7a9 in zif_cal_from_jd /home/fmunozs/phpasan/php5-5.6.17+dfsg.orig/ext/calendar/calendar.c:426 #1 0x9804a25 in zend_do_fcall_common_helper_SPEC /home/fmunozs/phpasan/php5-5.6.17+dfsg.orig/Zend/zend_vm_execute.h:558 #2 0x93f0a75 in execute_ex /home/fmunozs/phpasan/php5-5.6.17+dfsg.orig/Zend/zend_vm_execute.h:363 #3 0x959ce43 in zend_execute /home/fmunozs/phpasan/php5-5.6.17+dfsg.orig/Zend/zend_vm_execute.h:388 #4 0x91f35fb in zend_execute_scripts /home/fmunozs/phpasan/php5-5.6.17+dfsg.orig/Zend/zend.c:1341 #5 0x8ef82f5 in php_execute_script /home/fmunozs/phpasan/php5-5.6.17+dfsg.orig/main/main.c:2597 #6 0x9811848 in do_cli /home/fmunozs/phpasan/php5-5.6.17+dfsg.orig/sapi/cli/php_cli.c:994 #7 0x807f668 in main /home/fmunozs/phpasan/php5-5.6.17+dfsg.orig/sapi/cli/php_cli.c:1378 #8 0xb6e29645 in __libc_start_main (/lib/i386-linux-gnu/libc.so.6+0x18645) #9 0x807fc3b (/home/fmunozs/phpasan/php5-5.6.17+dfsg.orig/sapi/cli/php+0x807fc3b) 0x0a188e7c is located 4 bytes to the left of global variable 'monthsPerYear' defined in '/home/fmunozs/phpasan/php5-5.6.17+dfsg.orig/ext/calendar/jewish.c:290:5' (0xa188e80) of size 76 0x0a188e7c is located 36 bytes to the right of global variable 'JewishMonthNameLeap' defined in '/home/fmunozs/phpasan/php5-5.6.17+dfsg.orig/ext/calendar/jewish.c:302:7' (0xa188e20) of size 56 SUMMARY: AddressSanitizer: global-buffer-overflow /home/fmunozs/phpasan/php5-5.6.17+dfsg.orig/ext/calendar/calendar.c:426 zif_cal_from_jd Shadow bytes around the buggy address: 0x21431170: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x21431180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x21431190: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x214311a0: 00 00 00 00 00 00 00 f9 f9 f9 f9 f9 00 00 00 00 0x214311b0: 00 00 00 f9 f9 f9 f9 f9 00 00 00 00 00 00 00 f9 =>0x214311c0: f9 f9 f9 f9 00 00 00 00 00 00 00 f9 f9 f9 f9[f9] 0x214311d0: 00 00 00 00 00 00 00 00 00 04 f9 f9 f9 f9 f9 f9 0x214311e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x214311f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x21431200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x21431210: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Heap right redzone: fb Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack partial redzone: f4 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe ==12485==ABORTING ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=71894&edit=1