Sec Bug->Bug #72960 [Opn]: unserialize DOMConfiguration causes stack-overflow

From: Date: Mon, 29 Aug 2016 08:48:01 +0000
Subject: Sec Bug->Bug #72960 [Opn]: unserialize DOMConfiguration causes stack-overflow
References: 1  Groups: php.bugs 
Request: Send a blank email to php-bugs+get-203640@lists.php.net to get a copy of this message 
Edit report at https://bugs.php.net/bug.php?id=72960&edit=1

 ID:                 72960
 Updated by:         stas@php.net
 Reported by:        fernando at null-life dot com
 Summary:            unserialize DOMConfiguration causes stack-overflow
 Status:             Open
-Type:               Security
+Type:               Bug
 Package:            *General Issues
 Operating System:   *
 PHP Version:        5.6.25
 Block user comment: N
 Private report:     Y



Previous Comments:
------------------------------------------------------------------------
[2016-08-29 03:32:59] fernando at null-life dot com

Description:
------------
Wrong serialized string causes infinite recursion and finally stack exhaustion, when we try to
deserialize "DOMConfiguration" class.


Test script:
---------------
<?php

$x = 'O:16:"DOMConfiguration":1:{s:1:"A";r:1;}';
var_dump(unserialize($x));

Expected result:
----------------
object(DOMConfiguration)#1 (1) {
  ["A"]=>
  *RECURSION*
}

Actual result:
--------------
object(DOMConfiguration)#1 (1) {
  ["A"]=>
  object(DOMConfiguration)#1 (1) {
    ["A"]=>
    object(DOMConfiguration)#1 (1) {
      ["A"]=>
      object(DOMConfiguration)#1 (1) {
        ["A"]=>
        object(DOMConfiguration)#1 (1) {
....

---------------------------

ASan output:

==23077==ERROR: AddressSanitizer: stack-overflow on address 0x7ffdf18a8e58 (pc 0x7ff155350bd6 bp
0x7ffdf18a96d0 sp 0x7ffdf18a8e60 T0)
    #0 0x7ff155350bd5 in __asan_memset (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x8cbd5)
    #1 0x16bbb2f in memset /usr/include/x86_64-linux-gnu/bits/string3.h:90
    #2 0x16bbb2f in xbuf_format_converter /home/operac/php-src-56/php-src/main/spprintf.c:789
    #3 0x16c4011 in vspprintf /home/operac/php-src-56/php-src/main/spprintf.c:821
    #4 0x1699807 in php_printf /home/operac/php-src-56/php-src/main/main.c:756
    #5 0x14e9e96 in php_object_property_dump /home/operac/php-src-56/php-src/ext/standard/var.c:67
    #6 0x19bd175 in zend_hash_apply_with_arguments
/home/operac/php-src-56/php-src/Zend/zend_hash.c:701
    #7 0x14e928c in php_var_dump /home/operac/php-src-56/php-src/ext/standard/var.c:146
    #8 0x14ea11f in php_object_property_dump /home/operac/php-src-56/php-src/ext/standard/var.c:82
    #9 0x19bd175 in zend_hash_apply_with_arguments
/home/operac/php-src-56/php-src/Zend/zend_hash.c:701
    #10 0x14e928c in php_var_dump /home/operac/php-src-56/php-src/ext/standard/var.c:146
    #11 0x14ea11f in php_object_property_dump /home/operac/php-src-56/php-src/ext/standard/var.c:82
    #12 0x19bd175 in zend_hash_apply_with_arguments
/home/operac/php-src-56/php-src/Zend/zend_hash.c:701
    #13 0x14e928c in php_var_dump /home/operac/php-src-56/php-src/ext/standard/var.c:146
    #14 0x14ea11f in php_object_property_dump /home/operac/php-src-56/php-src/ext/standard/var.c:82
    #15 0x19bd175 in zend_hash_apply_with_arguments
/home/operac/php-src-56/php-src/Zend/zend_hash.c:701
    #16 0x14e928c in php_var_dump /home/operac/php-src-56/php-src/ext/standard/var.c:146
    #17 0x14ea11f in php_object_property_dump /home/operac/php-src-56/php-src/ext/standard/var.c:82
    #18 0x19bd175 in zend_hash_apply_with_arguments
/home/operac/php-src-56/php-src/Zend/zend_hash.c:701
    #19 0x14e928c in php_var_dump /home/operac/php-src-56/php-src/ext/standard/var.c:146
    #20 0x14ea11f in php_object_property_dump /home/operac/php-src-56/php-src/ext/standard/var.c:82
    #21 0x19bd175 in zend_hash_apply_with_arguments
/home/operac/php-src-56/php-src/Zend/zend_hash.c:701
    #22 0x14e928c in php_var_dump /home/operac/php-src-56/php-src/ext/standard/var.c:146
    #23 0x14ea11f in php_object_property_dump /home/operac/php-src-56/php-src/ext/standard/var.c:82
    #24 0x19bd175 in zend_hash_apply_with_arguments
/home/operac/php-src-56/php-src/Zend/zend_hash.c:701
    #25 0x14e928c in php_var_dump /home/operac/php-src-56/php-src/ext/standard/var.c:146
    #26 0x14ea11f in php_object_property_dump /home/operac/php-src-56/php-src/ext/standard/var.c:82
    #27 0x19bd175 in zend_hash_apply_with_arguments
/home/operac/php-src-56/php-src/Zend/zend_hash.c:701
...

SUMMARY: AddressSanitizer: stack-overflow ??:0 __asan_memset


------------------------------------------------------------------------



--
Edit this bug report at https://bugs.php.net/bug.php?id=72960&edit=1

Thread (1 message)

  • stas@php.net
  • Unknown Message
    • stas@php.net
« previous php.bugs (#203640) next »