Sec Bug->Bug #73151 [Opn]: shell_exec could produce string larger than 2GB

Edit report at https://bugs.php.net/bug.php?id=73151&edit=1 ID: 73151 Updated by: stas@php.net Reported by: nguyenluan dot vnn at gmail dot com Summary: shell_exec could produce string larger than 2GB Status: Open -Type: Security +Type: Bug Package: Strings related PHP Version: 5.6.26 Block user comment: N Private report: Y New Comment: Doesn't look like security issue, shell_exec return is not something that would be remotely-controlled. Previous Comments: ------------------------------------------------------------------------ [2016-09-23 15:32:33] nguyenluan dot vnn at gmail dot com Description: ------------ Function shell_exec declare total_readbytes as size_t then later check for total_readbytes > 0. This could lead to output string is larger than INTMAX. PHP_FUNCTION(shell_exec) { FILE *in; size_t total_readbytes; char *command; int command_len; char *ret; php_stream *stream; ... ... stream = php_stream_fopen_from_pipe(in, "rb"); total_readbytes = php_stream_copy_to_mem(stream, &ret, PHP_STREAM_COPY_ALL, 0); php_stream_close(stream); if (total_readbytes > 0) { RETVAL_STRINGL(ret, total_readbytes, 0); <- could produce string larger than 2Gb } } Test script: --------------- Python script to create test file: #! /usr/bin/env python f = open('html.html', 'w'); f.write('<html>') for _ in range(0x100): f.write('<p>') for _ in range(0x100): f.write('a'*(0x8000)) f.write('</p>') f.write('</html>') f.close() PHP script: <?php ini_set("memory_limit", -1); $str = shell_exec('python -c "f = open(\'html.html\');data=f.read();f.close();print data"'); var_dump(strlen($str)); ?> Expected result: ---------------- No string returned. Actual result: -------------- gdb-peda$ r ../test/string/test_shellexec.php Starting program: /home/user/Desktop/php-5.6.26/sapi/cli/php ../test/string/test_shellexec.php [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". [New process 13361] [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". process 13361 is executing new program: /bin/dash [New process 13362] process 13362 is executing new program: /usr/bin/python2.7 [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". [Inferior 3 (process 13362) exited normally] int(-2147481842) <- string larger than 2Gb ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=73151&edit=1