Bug #73023 [Fbk->NoF]: fsockopen null dereference

Edit report at https://bugs.php.net/bug.php?id=73023&edit=1 ID: 73023 Updated by: php-bugs@lists.php.net Reported by: fernando at null-life dot com Summary: fsockopen null dereference -Status: Feedback +Status: No Feedback Type: Bug Package: Sockets related Operating System: Windows PHP Version: 7.0.10 Private report: N New Comment: No feedback was provided. The bug is being suspended because we assume that you are no longer experiencing the problem. If this is not the case and you are able to provide the information that was requested earlier, please do so and change the status of the bug back to "Re-Opened". Thank you. Previous Comments: ------------------------------------------------------------------------ [2017-01-08 21:00:43] ab@php.net Thanks for the report. I don't reproduce this with the current dev trees. Either it's already fixed, or some parameter is missing. Could you please check? Thanks. ------------------------------------------------------------------------ [2016-09-05 21:11:18] fernando at null-life dot com Description: ------------ Attached test case causes an exception on Windows when running with USE_ZEND_ALLOC=0 /* * Do format conversion placing the output in buffer */ static void xbuf_format_converter(void *xbuf, zend_bool is_char, const char *fmt, va_list ap) /* {{{ */ { .... if (adjust_width && adjust == RIGHT && min_width > s_len) { if (pad_char == '0' && prefix_char != NUL) { INS_CHAR(xbuf, *s, is_char); s++; s_len--; min_width--; } PAD_CHAR(xbuf, pad_char, min_width - s_len, is_char); } /* * Print the string s. */ ---> INS_STRING(xbuf, s, s_len, is_char); Test script: --------------- <?php $v1=str_repeat(".", 0xffffffff/5); fsockopen($v1); Expected result: ---------------- No crash Actual result: -------------- (3780.3594): Access violation - code c0000005 (first chance) First chance exceptions are reported before any exception handling. This exception may be expected and handled. php7!xbuf_format_converter+0x2b9: 624e4e79 8b410c mov eax,dword ptr [ecx+0Ch] ds:002b:0000000c=???????? Processing initial command 'r;!exploitable -v' 0:000:x86> r;!exploitable -v eax=00000000 ebx=3333334c ecx=00000000 edx=00000000 esi=33333333 edi=10016030 eip=624e4e79 esp=06a1da20 ebp=06a1e2ec iopl=0 nv up ei pl zr na pe nc cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010246 php7!xbuf_format_converter+0x2b9: 624e4e79 8b410c mov eax,dword ptr [ecx+0Ch] ds:002b:0000000c=???????? !exploitable 1.6.0.0 HostMachine\HostUser Executing Processor Architecture is x86 Debuggee is in User Mode Debuggee is a live user mode debugging session on the local machine Event Type: Exception *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\SysWOW64\KERNEL32.DLL - *** ERROR: Symbol file could not be found. Defaulted to export symbols for ntdll.dll - Exception Faulting Address: 0xc First Chance Exception Type: STATUS_ACCESS_VIOLATION (0xC0000005) Exception Sub-Type: Read Access Violation Faulting Instruction:624e4e79 mov eax,dword ptr [ecx+0ch] Basic Block: 624e4e79 mov eax,dword ptr [ecx+0ch] Tainted Input operands: 'ecx' 624e4e7c add ecx,10h Tainted Input operands: 'ecx' 624e4e7f add eax,ecx Tainted Input operands: 'eax','ecx' 624e4e81 push eax Tainted Input operands: 'eax' 624e4e82 call php7!memcpy (6279c896) Tainted Input operands: 'ecx','StackContents' Exception Hash (Major/Minor): 0x222bde06.0x00ab3689 Hash Usage : Stack Trace: Major+Minor : php7!xbuf_format_converter+0x2b9 Major+Minor : php7!vstrpprintf+0x23 Major+Minor : php7!strpprintf+0x12 Major+Minor : php7!php_tcp_sockop_set_option+0x1cf Major+Minor : php_openssl!php_openssl_sockop_set_option+0x3b1 Minor : php7!_php_stream_set_option+0x3c Minor : php7!php_stream_xport_connect+0x67 Minor : php7!_php_stream_xport_create+0x22d Minor : php7!php_fsockopen_stream+0x18c Minor : php7!zif_fsockopen+0xf Minor : php7!execute_ex+0xfb Minor : php7!zend_execute+0x124 Minor : php7!zend_execute_scripts+0xe7 Minor : php7!php_execute_script+0x372 Minor : php!do_cli+0x3d3 Minor : php!main+0x2cb Minor : php!__scrt_common_main_seh+0xf9 Minor : KERNEL32!BaseThreadInitThunk+0x24 Excluded : ntdll_77600000!RtlInitializeExceptionChain+0x8f Excluded : ntdll_77600000!RtlInitializeExceptionChain+0x5a Instruction Address: 0x00000000624e4e79 Source File: c:\php-sdk\php70dev\vc14\x86\php-7.0.10\main\spprintf.c Source Line: 818 Description: Read Access Violation near NULL Short Description: ReadAVNearNull Exploitability Classification: PROBABLY_NOT_EXPLOITABLE Recommended Bug Title: Read Access Violation near NULL starting at php7!xbuf_format_converter+0x00000000000002b9 (Hash=0x222bde06.0x00ab3689) This is a user mode read access violation near null, and is probably not exploitable. ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=73023&edit=1