Sec Bug->Bug #73022 [Opn->Fbk]: str_repeat write access violation

Edit report at https://bugs.php.net/bug.php?id=73022&edit=1 ID: 73022 Updated by: stas@php.net Reported by: fernando at null-life dot com Summary: str_repeat write access violation -Status: Open +Status: Feedback -Type: Security +Type: Bug Package: Strings related Operating System: Windows PHP Version: 7.0.10 Block user comment: N Private report: Y New Comment: Unable to reproduce on my machine. Unfortunately, I don't have Windows, so not sure what is going there. Is it reproducible on any Unix system? Previous Comments: ------------------------------------------------------------------------ [2016-09-05 20:40:47] fernando at null-life dot com Description: ------------ Attached script causes a write access violation when running with the windows.php.com binary when using USE_ZEND_ALLOC=0 PHP_FUNCTION(str_repeat) { zend_string *input_str; /* Input string */ zend_long mult; /* Multiplier */ zend_string *result; /* Resulting string */ size_t result_len; /* Length of the resulting string */ if (zend_parse_parameters(ZEND_NUM_ARGS(), "Sl", &input_str, &mult) == FAILURE) { return; } if (mult < 0) { php_error_docref(NULL, E_WARNING, "Second argument has to be greater than or equal to 0"); return; } /* Don't waste our time if it's empty */ /* ... or if the multiplier is zero */ if (ZSTR_LEN(input_str) == 0 || mult == 0) RETURN_EMPTY_STRING(); /* Initialize the result string */ --> result = zend_string_safe_alloc(ZSTR_LEN(input_str), mult, 0, 0); result_len = ZSTR_LEN(input_str) * mult; Test script: --------------- <?php $v3=str_repeat("#", 0xffffffff/3); Expected result: ---------------- No crash Actual result: -------------- (2a90.24c0): Access violation - code c0000005 (first chance) First chance exceptions are reported before any exception handling. This exception may be expected and handled. php7!zif_str_repeat+0x76: 6263c906 c70601000000 mov dword ptr [esi],1 ds:002b:00000000=???????? Processing initial command 'r;!exploitable -v' 0:000:x86> r;!exploitable -v eax=00000000 ebx=55555555 ecx=ad59a3d1 edx=00000000 esi=00000000 edi=55555555 eip=6263c906 esp=0680e49c ebp=0a4a00d0 iopl=0 nv up ei pl nz na pe nc cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010206 php7!zif_str_repeat+0x76: 6263c906 c70601000000 mov dword ptr [esi],1 ds:002b:00000000=???????? !exploitable 1.6.0.0 HostMachine\HostUser Executing Processor Architecture is x86 Debuggee is in User Mode Debuggee is a live user mode debugging session on the local machine Event Type: Exception *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\SysWOW64\KERNEL32.DLL - *** ERROR: Symbol file could not be found. Defaulted to export symbols for ntdll.dll - Exception Faulting Address: 0x0 First Chance Exception Type: STATUS_ACCESS_VIOLATION (0xC0000005) Exception Sub-Type: Write Access Violation Faulting Instruction:6263c906 mov dword ptr [esi],1 Basic Block: 6263c906 mov dword ptr [esi],1 Tainted Input operands: 'esi' 6263c90c mov dword ptr [esi+4],6 6263c913 mov dword ptr [esi+8],0 6263c91a mov dword ptr [esi+0ch],ebx 6263c91d mov ecx,dword ptr [esp+0ch] 6263c921 mov edx,dword ptr [esp+10h] 6263c925 mov edi,dword ptr [ecx+0ch] 6263c928 mov eax,edi 6263c92a imul eax,edx 6263c92d mov dword ptr [esp+14h],eax 6263c931 cmp edi,1 6263c934 jne php7!zif_str_repeat+0xba (6263c94a) Exception Hash (Major/Minor): 0xde5931c9.0xdf3ae42d Hash Usage : Stack Trace: Major+Minor : php7!zif_str_repeat+0x76 Major+Minor : php7!execute_ex+0xfb Major+Minor : php7!zend_execute+0x124 Major+Minor : php7!zend_execute_scripts+0xe7 Major+Minor : php7!php_execute_script+0x372 Minor : php!do_cli+0x3d3 Minor : php!main+0x2cb Minor : php!__scrt_common_main_seh+0xf9 Minor : KERNEL32!BaseThreadInitThunk+0x24 Excluded : ntdll_77600000!RtlInitializeExceptionChain+0x8f Excluded : ntdll_77600000!RtlInitializeExceptionChain+0x5a Instruction Address: 0x000000006263c906 Source File: c:\php-sdk\php70dev\vc14\x86\php-7.0.10\ext\standard\string.c Source Line: 5031 Description: User Mode Write AV near NULL Short Description: WriteAVNearNull Exploitability Classification: UNKNOWN Recommended Bug Title: User Mode Write AV near NULL starting at php7!zif_str_repeat+0x0000000000000076 (Hash=0xde5931c9.0xdf3ae42d) User mode write access violations that are near NULL are unknown. ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=73022&edit=1