Bug #73100 [Ver->Csd]: session_destroy null dereference in ps_files_path_create
| From: | cmb@php.net | Date: | Fri, 16 Sep 2016 22:06:25 +0000 |
| Subject: | Bug #73100 [Ver->Csd]: session_destroy null dereference in ps_files_path_create | ||
| References: | 1 | Groups: | php.bugs |
| Request: | Send a blank email to php-bugs+get-204088@lists.php.net to get a copy of this message | ||
Edit report at https://bugs.php.net/bug.php?id=73100&edit=1
ID: 73100
Updated by: cmb@php.net
Reported by: ahihibughunter at gmail dot com
Summary: session_destroy null dereference in
ps_files_path_create
-Status: Verified
+Status: Closed
Type: Bug
Package: Session related
Operating System: ALL
PHP Version: 7.0.11
Assigned To: cmb
Block user comment: N
Private report: N
New Comment:
Automatic comment on behalf of cmbecker69@gmx.de
Revision: http://git.php.net/?p=php-src.git;a=commit;h=66826730702d3ed3d6d45320ad1276977e67bb9e
Log: Fix #73100: session_destroy null dereference in ps_files_path_create
Previous Comments:
------------------------------------------------------------------------
[2016-09-16 21:32:03] cmb@php.net
I can confirm the issue which is, however, indeed no security
issue, but rather a programmer error.
------------------------------------------------------------------------
[2016-09-16 14:29:21] ahihibughunter at gmail dot com
Description:
------------
ps_files_path_create used argument without check it's value
static char *ps_files_path_create(char *buf, size_t buflen, ps_files *data, const char *key)
{
....
key_len = strlen(key);
if (key_len <= data->dirdepth || ..... <- data used without check
}
...
Test script:
---------------
<?php
ob_start();
var_dump(session_start());
session_module_name("user");
var_dump(session_destroy());
?>
Expected result:
----------------
No crash
Actual result:
--------------
$ gdb php7/php-src-PHP-7.0.11/sapi/cli/php
GNU gdb (Ubuntu 7.11.1-0ubuntu1~16.04) 7.11.1
(gdb) r crash.php
Starting program: /home/zx/zx/php/php7/php-src-PHP-7.0.11/sapi/cli/php crash.php
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Program received signal SIGSEGV, Segmentation fault.
0x00000000007fe642 in ps_files_path_create (buf=0x7fffffff9320 "", buflen=4096, data=0x0,
key=0x7fffede6e1d8 "2d4a0956c07d8cbd5ef85dfe39d1633e")
at /home/zx/zx/php/php7/php-src-PHP-7.0.11/ext/session/mod_files.c:117
117 if (key_len <= data->dirdepth ||
(gdb) bt
#0 0x00000000007fe642 in ps_files_path_create (buf=0x7fffffff9320 "", buflen=4096,
data=0x0,
key=0x7fffede6e1d8 "2d4a0956c07d8cbd5ef85dfe39d1633e")
at /home/zx/zx/php/php7/php-src-PHP-7.0.11/ext/session/mod_files.c:117
#1 0x00000000007ff61b in ps_delete_files (mod_data=0x1412f88 <ps_globals+104>,
key=0x7fffede6e1c0)
at /home/zx/zx/php/php7/php-src-PHP-7.0.11/ext/session/mod_files.c:605
#2 0x00000000007f554b in php_session_destroy ()
at /home/zx/zx/php/php7/php-src-PHP-7.0.11/ext/session/session.c:148
#3 0x00000000007fc5f1 in zif_session_destroy (execute_data=0x7fffede14160,
return_value=0x7fffede140d0)
at /home/zx/zx/php/php7/php-src-PHP-7.0.11/ext/session/session.c:2379
#4 0x0000000000a68b3f in ZEND_DO_ICALL_SPEC_HANDLER ()
at /home/zx/zx/php/php7/php-src-PHP-7.0.11/Zend/zend_vm_execute.h:586
#5 0x0000000000a6856b in execute_ex (ex=0x7fffede14030)
at /home/zx/zx/php/php7/php-src-PHP-7.0.11/Zend/zend_vm_execute.h:414
(gdb) print data
$2 = (ps_files *) 0x0
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=73100&edit=1