Bug #72703 [Asn->Csd]: Out of bounds global memory read in BF_crypt triggered by password_verify

Edit report at https://bugs.php.net/bug.php?id=72703&edit=1 ID: 72703 Updated by: ab@php.net Reported by: hanno at boeck dot de Summary: Out of bounds global memory read in BF_crypt triggered by password_verify -Status: Assigned +Status: Closed Type: Bug Package: hash related PHP Version: 7.0.9 Assigned To: ab Block user comment: N Private report: N New Comment: Automatic comment on behalf of ab Revision: http://git.php.net/?p=php-src.git;a=commit;h=295303b59059536079caf68b4d76acf2149bd42c Log: Fixed bug #72703 Out of bounds global memory read in BF_crypt triggered by password_verify Previous Comments: ------------------------------------------------------------------------ [2016-08-29 17:09:32] stas@php.net Sounds good. ------------------------------------------------------------------------ [2016-08-29 15:01:49] ab@php.net Thanks, Stas. I've lost this ticket after no feedback. As you say, a salt is produced by a backend, so this issue is barely triggerable from remote. I would tend therefore to include tihs patch in the upcomming RC to get some possible feedback, not waiting for the final. Cheers. ------------------------------------------------------------------------ [2016-08-28 04:22:32] php-bugs at lists dot php dot net No feedback was provided. The bug is being suspended because we assume that you are no longer experiencing the problem. If this is not the case and you are able to provide the information that was requested earlier, please do so and change the status of the bug back to "Re-Opened". Thank you. ------------------------------------------------------------------------ [2016-08-14 23:42:43] ab@php.net @hanno, could you please check whether the below makes ASAN happy? I'd also ask for the other invalid inputs you've mentioned, so they can be included in the test. Thanks. --- a/ext/standard/crypt.c +++ b/ext/standard/crypt.c @@ -204,6 +204,14 @@ PHPAPI zend_string *php_crypt(const char *password, const int pass_len, const ch salt[1] == '2' && salt[3] == '$') { char output[PHP_MAX_SALT_LEN + 1]; + int k = 7; + + while (isalnum(salt[k]) || '.' == salt[k] || '/' == salt[k]) { + k++; + } + if (k != salt_len) { + return NULL; + } ------------------------------------------------------------------------ [2016-08-04 05:26:45] stas@php.net Doesn't look like security issue, since second parameter of password_verify() should not be user-controlled by its nature. ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=72703 -- Edit this bug report at https://bugs.php.net/bug.php?id=72703&edit=1