Bug #73022 [Fbk->NoF]: str_repeat write access violation

Edit report at https://bugs.php.net/bug.php?id=73022&edit=1 ID: 73022 Updated by: php-bugs@lists.php.net Reported by: fernando at null-life dot com Summary: str_repeat write access violation -Status: Feedback +Status: No Feedback Type: Bug Package: Strings related Operating System: Windows PHP Version: 7.0.10 Private report: N New Comment: No feedback was provided. The bug is being suspended because we assume that you are no longer experiencing the problem. If this is not the case and you are able to provide the information that was requested earlier, please do so and change the status of the bug back to "Re-Opened". Thank you. Previous Comments: ------------------------------------------------------------------------ [2016-09-05 21:01:38] stas@php.net Unable to reproduce on my machine. Unfortunately, I don't have Windows, so not sure what is going there. Is it reproducible on any Unix system? ------------------------------------------------------------------------ [2016-09-05 20:40:47] fernando at null-life dot com Description: ------------ Attached script causes a write access violation when running with the windows.php.com binary when using USE_ZEND_ALLOC=0 PHP_FUNCTION(str_repeat) { zend_string *input_str; /* Input string */ zend_long mult; /* Multiplier */ zend_string *result; /* Resulting string */ size_t result_len; /* Length of the resulting string */ if (zend_parse_parameters(ZEND_NUM_ARGS(), "Sl", &input_str, &mult) == FAILURE) { return; } if (mult < 0) { php_error_docref(NULL, E_WARNING, "Second argument has to be greater than or equal to 0"); return; } /* Don't waste our time if it's empty */ /* ... or if the multiplier is zero */ if (ZSTR_LEN(input_str) == 0 || mult == 0) RETURN_EMPTY_STRING(); /* Initialize the result string */ --> result = zend_string_safe_alloc(ZSTR_LEN(input_str), mult, 0, 0); result_len = ZSTR_LEN(input_str) * mult; Test script: --------------- <?php $v3=str_repeat("#", 0xffffffff/3); Expected result: ---------------- No crash Actual result: -------------- (2a90.24c0): Access violation - code c0000005 (first chance) First chance exceptions are reported before any exception handling. This exception may be expected and handled. php7!zif_str_repeat+0x76: 6263c906 c70601000000 mov dword ptr [esi],1 ds:002b:00000000=???????? Processing initial command 'r;!exploitable -v' 0:000:x86> r;!exploitable -v eax=00000000 ebx=55555555 ecx=ad59a3d1 edx=00000000 esi=00000000 edi=55555555 eip=6263c906 esp=0680e49c ebp=0a4a00d0 iopl=0 nv up ei pl nz na pe nc cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010206 php7!zif_str_repeat+0x76: 6263c906 c70601000000 mov dword ptr [esi],1 ds:002b:00000000=???????? !exploitable 1.6.0.0 HostMachine\HostUser Executing Processor Architecture is x86 Debuggee is in User Mode Debuggee is a live user mode debugging session on the local machine Event Type: Exception *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\SysWOW64\KERNEL32.DLL - *** ERROR: Symbol file could not be found. Defaulted to export symbols for ntdll.dll - Exception Faulting Address: 0x0 First Chance Exception Type: STATUS_ACCESS_VIOLATION (0xC0000005) Exception Sub-Type: Write Access Violation Faulting Instruction:6263c906 mov dword ptr [esi],1 Basic Block: 6263c906 mov dword ptr [esi],1 Tainted Input operands: 'esi' 6263c90c mov dword ptr [esi+4],6 6263c913 mov dword ptr [esi+8],0 6263c91a mov dword ptr [esi+0ch],ebx 6263c91d mov ecx,dword ptr [esp+0ch] 6263c921 mov edx,dword ptr [esp+10h] 6263c925 mov edi,dword ptr [ecx+0ch] 6263c928 mov eax,edi 6263c92a imul eax,edx 6263c92d mov dword ptr [esp+14h],eax 6263c931 cmp edi,1 6263c934 jne php7!zif_str_repeat+0xba (6263c94a) Exception Hash (Major/Minor): 0xde5931c9.0xdf3ae42d Hash Usage : Stack Trace: Major+Minor : php7!zif_str_repeat+0x76 Major+Minor : php7!execute_ex+0xfb Major+Minor : php7!zend_execute+0x124 Major+Minor : php7!zend_execute_scripts+0xe7 Major+Minor : php7!php_execute_script+0x372 Minor : php!do_cli+0x3d3 Minor : php!main+0x2cb Minor : php!__scrt_common_main_seh+0xf9 Minor : KERNEL32!BaseThreadInitThunk+0x24 Excluded : ntdll_77600000!RtlInitializeExceptionChain+0x8f Excluded : ntdll_77600000!RtlInitializeExceptionChain+0x5a Instruction Address: 0x000000006263c906 Source File: c:\php-sdk\php70dev\vc14\x86\php-7.0.10\ext\standard\string.c Source Line: 5031 Description: User Mode Write AV near NULL Short Description: WriteAVNearNull Exploitability Classification: UNKNOWN Recommended Bug Title: User Mode Write AV near NULL starting at php7!zif_str_repeat+0x0000000000000076 (Hash=0xde5931c9.0xdf3ae42d) User mode write access violations that are near NULL are unknown. ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=73022&edit=1