Sec Bug->Bug #73646 [Opn]: mb_ereg_search_init null pointer dereference

Edit report at https://bugs.php.net/bug.php?id=73646&edit=1 ID: 73646 Updated by: stas@php.net Reported by: fernando at null-life dot com Summary: mb_ereg_search_init null pointer dereference Status: Open -Type: Security +Type: Bug Package: *Regular Expressions Operating System: Linux 32 bits PHP Version: 7.1.0 Block user comment: N Private report: Y New Comment: Not a security issue. Previous Comments: ------------------------------------------------------------------------ [2016-12-03 17:48:08] fernando at null-life dot com Description: ------------ When a string is built with str_repeat and invalid length, a null pointer dereference happens in mb_ereg search _init function. ----------------------------- Source code: https://github.com/php/php-src/blob/PHP-7.1/ext/mbstring/php_mbregex.c#L1384 PHP_FUNCTION(mb_ereg_search_init) { size_t argc = ZEND_NUM_ARGS(); zval *arg_str; char *arg_pattern = NULL, *arg_options = NULL; size_t arg_pattern_len = 0, arg_options_len = 0; OnigSyntaxType *syntax = NULL; OnigOptionType option; ... ZVAL_DUP(&MBREX(search_str), arg_str); if (php_mb_check_encoding( Z_STRVAL_P(arg_str), Z_STRLEN_P(arg_str), _php_mb_regex_mbctype2name(MBREX(current_mbctype)) // Null pointer dereference )) { MBREX(search_pos) = 0; RETVAL_TRUE; } else { MBREX(search_pos) = Z_STRLEN_P(arg_str); RETVAL_FALSE; } ... GDB output: gdb -q --args /home/user/build2/bin/php -n poc.php Reading symbols from /home/user/build2/bin/php...done. (gdb) r Starting program: /home/user/build2/bin/php -n poc.php [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/i386-linux-gnu/libthread_db.so.1". Warning: str_repeat(): Second argument has to be greater than or equal to 0 in /home/user/crashes/mb_ereg_search/poc.php on line 5 Program received signal SIGSEGV, Segmentation fault. 0x08566b05 in zif_mb_ereg_search_init (execute_data=0xf1014090, return_value=0xffff9a00) at /home/user/build2/php-src/ext/mbstring/php_mbregex.c:1384 1384 if (php_mb_check_encoding( (gdb) l 1379 zval_ptr_dtor(&MBREX(search_str)); 1380 } 1381 1382 ZVAL_DUP(&MBREX(search_str), arg_str); 1383 1384 if (php_mb_check_encoding( 1385 Z_STRVAL_P(arg_str), 1386 Z_STRLEN_P(arg_str), 1387 _php_mb_regex_mbctype2name(MBREX(current_mbctype)) 1388 )) { Test script: --------------- <?php $v1=str_repeat("#", -1); mb_ereg_search_init($v1); Expected result: ---------------- No crash Actual result: -------------- Warning: str_repeat(): Second argument has to be greater than or equal to 0 in /home/user/crashes/mb_ereg_search/poc.php on line 5 ASAN:SIGSEGV ================================================================= ==19448==ERROR: AddressSanitizer: SEGV on unknown address 0x0000000c (pc 0x08566b05 bp 0xffdfc2b8 sp 0xffdfc080 T0) #0 0x8566b04 in zif_mb_ereg_search_init /home/user/build2/php-src/ext/mbstring/php_mbregex.c:1384 #1 0x8cb669e in ZEND_DO_ICALL_SPEC_RETVAL_UNUSED_HANDLER /home/user/build2/php-src/Zend/zend_vm_execute.h:628 #2 0x8cb4ed1 in execute_ex /home/user/build2/php-src/Zend/zend_vm_execute.h:429 #3 0x8cb51e4 in zend_execute /home/user/build2/php-src/Zend/zend_vm_execute.h:474 #4 0x8baf604 in zend_execute_scripts /home/user/build2/php-src/Zend/zend.c:1474 #5 0x8a47247 in php_execute_script /home/user/build2/php-src/main/main.c:2533 #6 0x8eaec77 in do_cli /home/user/build2/php-src/sapi/cli/php_cli.c:990 #7 0x8eb1239 in main /home/user/build2/php-src/sapi/cli/php_cli.c:1378 #8 0xf6953636 in __libc_start_main (/lib/i386-linux-gnu/libc.so.6+0x18636) #9 0x806f240 (/home/user/build2/bin/php+0x806f240) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV /home/user/build2/php-src/ext/mbstring/php_mbregex.c:1384 zif_mb_ereg_search_init ==19448==ABORTING ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=73646&edit=1