Sec Bug->Bug #72852 [Opn]: imap_mail null dereference

Edit report at https://bugs.php.net/bug.php?id=72852&edit=1 ID: 72852 Updated by: stas@php.net Reported by: fernando at null-life dot com Summary: imap_mail null dereference Status: Open -Type: Security +Type: Bug Package: IMAP related Operating System: Windows PHP Version: 7.0.9 Block user comment: N Private report: Y Previous Comments: ------------------------------------------------------------------------ [2016-08-16 09:08:22] fernando at null-life dot com Description: ------------ This seems to be a Windows only issue, tested with the 7.0.10RC1 QA build [1]. I don't have symbols for rfc822_parse_adrlist [2] so I'm unable to debug further. Seems to be a null dereference based on the stack trace. [1] http://windows.php.net/qa/ [2] https://github.com/php/php-src/blob/master/ext/imap/php_imap.c#L3965 Test script: --------------- <?php $to="<a href=\""; $subject="A"; $message="A"; imap_mail($to,$subject,$message); Expected result: ---------------- No crash Actual result: -------------- Faulting Instruction:6d6cb891 cmp byte ptr [eax],40h Basic Block: 6d6cb891 cmp byte ptr [eax],40h Tainted Input operands: 'eax' 6d6cb894 cmovne ecx,eax 6d6cb897 lea eax,[esp+1ch] 6d6cb89b push ecx 6d6cb89c push dword ptr [esi+8] 6d6cb89f push offset php_imap!body_encodings+0x130 (6d76eda8) 6d6cb8a4 push eax 6d6cb8a5 call php_imap!sprintf (6d6ce3b0) Exception Hash (Major/Minor): 0x212bb295.0x3256a426 Hash Usage : Stack Trace: Major+Minor : php_imap!rfc822_parse_routeaddr+0x201 Major+Minor : php_imap!rfc822_parse_mailbox+0x4b Major+Minor : php_imap!rfc822_parse_address+0x51 Major+Minor : php_imap!rfc822_parse_adrlist+0xa8 Major+Minor : php_imap!_php_imap_mail+0x113 Minor : php_imap!zif_imap_mail+0x133 Minor : php7!ZEND_DO_ICALL_SPEC_HANDLER+0x51 Minor : php7!execute_ex+0x21 Minor : php7!zend_execute+0x325 Minor : php7!zend_execute_scripts+0xab Minor : php7!php_execute_script+0x2aa Minor : php!do_cli+0x7e3 Minor : php!main+0x44e Minor : php!__scrt_common_main_seh+0xf9 Minor : KERNEL32!BaseThreadInitThunk+0x24 Minor : ntdll_774c0000!__RtlUserThreadStart+0x2f Minor : ntdll_774c0000!_RtlUserThreadStart+0x1b Instruction Address: 0x000000006d6cb891 ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=72852&edit=1