Bug #73023 [NEW]: fsockopen null dereference

From: fernando at null-life dot com Operating system: Windows PHP version: 7.0.10 Package: Sockets related Bug Type: Bug Bug description:fsockopen null dereference Description: ------------ Attached test case causes an exception on Windows when running with USE_ZEND_ALLOC=0 /* * Do format conversion placing the output in buffer */ static void xbuf_format_converter(void *xbuf, zend_bool is_char, const char *fmt, va_list ap) /* {{{ */ { .... if (adjust_width && adjust == RIGHT && min_width > s_len) { if (pad_char == '0' && prefix_char != NUL) { INS_CHAR(xbuf, *s, is_char); s++; s_len--; min_width--; } PAD_CHAR(xbuf, pad_char, min_width - s_len, is_char); } /* * Print the string s. */ ---> INS_STRING(xbuf, s, s_len, is_char); Test script: --------------- <?php $v1=str_repeat(".", 0xffffffff/5); fsockopen($v1); Expected result: ---------------- No crash Actual result: -------------- (3780.3594): Access violation - code c0000005 (first chance) First chance exceptions are reported before any exception handling. This exception may be expected and handled. php7!xbuf_format_converter+0x2b9: 624e4e79 8b410c mov eax,dword ptr [ecx+0Ch] ds:002b:0000000c=???????? Processing initial command 'r;!exploitable -v' 0:000:x86> r;!exploitable -v eax=00000000 ebx=3333334c ecx=00000000 edx=00000000 esi=33333333 edi=10016030 eip=624e4e79 esp=06a1da20 ebp=06a1e2ec iopl=0 nv up ei pl zr na pe nc cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010246 php7!xbuf_format_converter+0x2b9: 624e4e79 8b410c mov eax,dword ptr [ecx+0Ch] ds:002b:0000000c=???????? !exploitable 1.6.0.0 HostMachine\HostUser Executing Processor Architecture is x86 Debuggee is in User Mode Debuggee is a live user mode debugging session on the local machine Event Type: Exception *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\SysWOW64\KERNEL32.DLL - *** ERROR: Symbol file could not be found. Defaulted to export symbols for ntdll.dll - Exception Faulting Address: 0xc First Chance Exception Type: STATUS_ACCESS_VIOLATION (0xC0000005) Exception Sub-Type: Read Access Violation Faulting Instruction:624e4e79 mov eax,dword ptr [ecx+0ch] Basic Block: 624e4e79 mov eax,dword ptr [ecx+0ch] Tainted Input operands: 'ecx' 624e4e7c add ecx,10h Tainted Input operands: 'ecx' 624e4e7f add eax,ecx Tainted Input operands: 'eax','ecx' 624e4e81 push eax Tainted Input operands: 'eax' 624e4e82 call php7!memcpy (6279c896) Tainted Input operands: 'ecx','StackContents' Exception Hash (Major/Minor): 0x222bde06.0x00ab3689 Hash Usage : Stack Trace: Major+Minor : php7!xbuf_format_converter+0x2b9 Major+Minor : php7!vstrpprintf+0x23 Major+Minor : php7!strpprintf+0x12 Major+Minor : php7!php_tcp_sockop_set_option+0x1cf Major+Minor : php_openssl!php_openssl_sockop_set_option+0x3b1 Minor : php7!_php_stream_set_option+0x3c Minor : php7!php_stream_xport_connect+0x67 Minor : php7!_php_stream_xport_create+0x22d Minor : php7!php_fsockopen_stream+0x18c Minor : php7!zif_fsockopen+0xf Minor : php7!execute_ex+0xfb Minor : php7!zend_execute+0x124 Minor : php7!zend_execute_scripts+0xe7 Minor : php7!php_execute_script+0x372 Minor : php!do_cli+0x3d3 Minor : php!main+0x2cb Minor : php!__scrt_common_main_seh+0xf9 Minor : KERNEL32!BaseThreadInitThunk+0x24 Excluded : ntdll_77600000!RtlInitializeExceptionChain+0x8f Excluded : ntdll_77600000!RtlInitializeExceptionChain+0x5a Instruction Address: 0x00000000624e4e79 Source File: c:\php-sdk\php70dev\vc14\x86\php-7.0.10\main\spprintf.c Source Line: 818 Description: Read Access Violation near NULL Short Description: ReadAVNearNull Exploitability Classification: PROBABLY_NOT_EXPLOITABLE Recommended Bug Title: Read Access Violation near NULL starting at php7!xbuf_format_converter+0x00000000000002b9 (Hash=0x222bde06.0x00ab3689) This is a user mode read access violation near null, and is probably not exploitable. -- Edit bug report at https://bugs.php.net/bug.php?id=73023&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=73023&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=73023&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=73023&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=73023&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=73023&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=73023&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=73023&r=needscript Try newer version: https://bugs.php.net/fix.php?id=73023&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=73023&r=support Expected behavior: https://bugs.php.net/fix.php?id=73023&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=73023&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=73023&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=73023&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=73023&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=73023&r=dst IIS Stability: https://bugs.php.net/fix.php?id=73023&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=73023&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=73023&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=73023&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=73023&r=mysqlcfg