Bug #72927 [NEW]: integer overflow in xml_utf8_encode

From: ahihibughunter at gmail dot com Operating system: All PHP version: 5.6Git-2016-08-23 (Git) Package: XML related Bug Type: Bug Bug description:integer overflow in xml_utf8_encode Description: ------------ in xml_utf8_encode function, the safe_emalloc did not check value it alloc for string, which used to store the result of encoded buffer. This cause the length of string after encode > INT_MAX. PHPAPI char *xml_utf8_encode(const char *s, int len, int *newlen, const XML_Char *encoding) { ..... newbuf = safe_emalloc(len, 4, 1); //<- muse check size of safe_emalloc here, .... } else if (c < 0x800) { newbuf[(*newlen)++] = (0xc0 | (c >> 6)); newbuf[(*newlen)++] = (0x80 | (c & 0x3f)); ... } Test script: --------------- <?php ini_set('memory_limit', -1); $a = str_repeat('Ã', (0xffffffff/6) - 10); $b = utf8_encode($a); ?> Expected result: ---------------- No crash Actual result: -------------- $gdb /data/php-src-PHP-5.6.25/sapi/cli/php GNU gdb (Ubuntu 7.7.1-0ubuntu5~14.04.2) 7.7.1 Copyright (C) 2014 Free Software Foundation, Inc. Program received signal SIGSEGV, Segmentation fault. 0x000000000095b841 in xml_utf8_encode ( s=0x7fffd95e9070 'Ã' <repeats 100 times>..., len=1431655744, newlen=0x7fffffffabb0, encoding=0x10a27f1 "ISO-8859-1") at /data/php-src-PHP-5.6.25/ext/xml/xml.c:642 642 newbuf[(*newlen)++] = (0xc0 | (c >> 6)); (gdb) -- Edit bug report at https://bugs.php.net/bug.php?id=72927&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=72927&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=72927&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=72927&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=72927&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=72927&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=72927&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=72927&r=needscript Try newer version: https://bugs.php.net/fix.php?id=72927&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=72927&r=support Expected behavior: https://bugs.php.net/fix.php?id=72927&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=72927&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=72927&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=72927&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=72927&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=72927&r=dst IIS Stability: https://bugs.php.net/fix.php?id=72927&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=72927&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=72927&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=72927&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=72927&r=mysqlcfg