Sec Bug->Bug #74308 [Opn]: Memory corruption in gmp_powm

Edit report at https://bugs.php.net/bug.php?id=74308&edit=1 ID: 74308 Updated by: stas@php.net Reported by: whitehat002 at hotmail dot com Summary: Memory corruption in gmp_powm Status: Open -Type: Security +Type: Bug Package: GNU MP related PHP Version: 7.1.3 Block user comment: N Private report: Y Previous Comments: ------------------------------------------------------------------------ [2017-03-25 11:36:30] whitehat002 at hotmail dot com Take this function （gmp_scan0) as an example test script <?php ini_set('memory_limit',-1); $a=str_repeat("1",0xffffffff); gmp_scan0($a,0xffffffff); -------------------------------------------------------- crash information： root@mhn:~# /usr/local/php/bin/php test.php GNU MP: Cannot allocate memory (size=4294967312) Aborted (core dumped) -------------------------------------------------------- root@mhn:~# gdb -q --args ./php-7.1.3/sapi/cli/php -n test.php Reading symbols from ./php-7.1.3/sapi/cli/php...done. (gdb) r Starting program: /root/php-7.1.3/sapi/cli/php -n test.php [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". GNU MP: Cannot allocate memory (size=4294967312) Program received signal SIGABRT, Aborted. 0x00007ffff5720c37 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56 56 ../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory. (gdb) bt #0 0x00007ffff5720c37 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56 #1 0x00007ffff5724028 in __GI_abort () at abort.c:89 #2 0x00007ffff75072a5 in __gmp_default_allocate () from /usr/lib/x86_64-linux-gnu/libgmp.so.10 #3 0x00007ffff7507b89 in __gmp_tmp_reentrant_alloc () from /usr/lib/x86_64-linux-gnu/libgmp.so.10 #4 0x00007ffff751d76f in __gmpz_set_str () from /usr/lib/x86_64-linux-gnu/libgmp.so.10 #5 0x00000000005e9ada in convert_to_gmp (gmpnumber=0x7fffffffad70, val=<optimized out>, base=<optimized out>) at /root/php-7.1.3/ext/gmp/gmp.c:738 #6 0x00000000005ea4c8 in zif_gmp_scan0 (execute_data=<optimized out>, return_value=0x7fffffffadc0) at /root/php-7.1.3/ext/gmp/gmp.c:2050 #7 0x00000000008bd1bd in ZEND_DO_ICALL_SPEC_RETVAL_UNUSED_HANDLER () at /root/php-7.1.3/Zend/zend_vm_execute.h:628 #8 0x00000000008abe73 in execute_ex (ex=<optimized out>) at /root/php-7.1.3/Zend/zend_vm_execute.h:429 #9 0x0000000000907edb in zend_execute (op_array=<optimized out>, return_value=<optimized out>) at /root/php-7.1.3/Zend/zend_vm_execute.h:474 #10 0x0000000000861d47 in zend_execute_scripts (type=type@entry=8, retval=retval@entry=0x0, file_count=file_count@entry=3) at /root/php-7.1.3/Zend/zend.c:1476 #11 0x00000000007f2010 in php_execute_script ( primary_file=primary_file@entry=0x7fffffffd290) at /root/php-7.1.3/main/main.c:2537 #12 0x000000000090a355 in do_cli (argc=3, argv=0x11f8a30) at /root/php-7.1.3/sapi/cli/php_cli.c:993 #13 0x0000000000440d3a in main (argc=3, argv=0x11f8a30) ---Type <return> to continue, or q <return> to quit--- at /root/php-7.1.3/sapi/cli/php_cli.c:1381 ------------------------------------------------------------------------ [2017-03-25 04:31:20] whitehat002 at hotmail dot com Most of functions for GNU Mp related have the same problem. ------------------------------------------------------------------------ [2017-03-24 10:34:22] whitehat002 at hotmail dot com Description: ------------ I found it via Black-box Testing.It looks like the libgmp's problem.And I think it's a security bug for memory corruption. My test environment： root@mhn:~# /usr/local/php/bin/php -v PHP 7.1.3 (cli) (built: Mar 24 2017 13:29:12) ( ZTS ) Copyright (c) 1997-2017 The PHP Group Zend Engine v3.1.0, Copyright (c) 1998-2017 Zend Technologies And gmp's version is 6.1.2. Test script: --------------- <?php ini_set('memory_limit',-1); $a=str_repeat("1",0x80000000); var_dump(gmp_powm("1",$a ,200)); ?> Expected result: ---------------- no crash Actual result: -------------- root@mhn:~# gdb --q --args ./php-7.1.3/sapi/cli/php -n test.php Reading symbols from ./php-7.1.3/sapi/cli/php...done. (gdb) r Starting program: /root/php-7.1.3/sapi/cli/php -n test.php [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". GNU MP: Cannot allocate memory (size=2147483665) Program received signal SIGABRT, Aborted. 0x00007ffff5720c37 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56 56 ../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory. (gdb) bt #0 0x00007ffff5720c37 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56 #1 0x00007ffff5724028 in __GI_abort () at abort.c:89 #2 0x00007ffff75072a5 in __gmp_default_allocate () from /usr/lib/x86_64-linux-gnu/libgmp.so.10 #3 0x00007ffff7507b89 in __gmp_tmp_reentrant_alloc () from /usr/lib/x86_64-linux-gnu/libgmp.so.10 #4 0x00007ffff751d76f in __gmpz_set_str () from /usr/lib/x86_64-linux-gnu/libgmp.so.10 #5 0x00000000005e9ada in convert_to_gmp (gmpnumber=0x7fffffffad50, val=<optimized out>, base=<optimized out>) at /root/php-7.1.3/ext/gmp/gmp.c:738 #6 0x00000000005ec6af in zif_gmp_powm (execute_data=<optimized out>, return_value=0x7ffff12130c0) at /root/php-7.1.3/ext/gmp/gmp.c:1427 #7 0x00000000008bcfb7 in ZEND_DO_ICALL_SPEC_RETVAL_USED_HANDLER () at /root/php-7.1.3/Zend/zend_vm_execute.h:675 #8 0x00000000008abe73 in execute_ex (ex=<optimized out>) at /root/php-7.1.3/Zend/zend_vm_execute.h:429 #9 0x0000000000907edb in zend_execute (op_array=<optimized out>, return_value=<optimized out>) at /root/php-7.1.3/Zend/zend_vm_execute.h:474 #10 0x0000000000861d47 in zend_execute_scripts (type=type@entry=8, retval=retval@entry=0x0, file_count=file_count@entry=3) at /root/php-7.1.3/Zend/zend.c:1476 #11 0x00000000007f2010 in php_execute_script ( primary_file=primary_file@entry=0x7fffffffd290) at /root/php-7.1.3/main/main.c:2537 #12 0x000000000090a355 in do_cli (argc=3, argv=0x11f8a30) at /root/php-7.1.3/sapi/cli/php_cli.c:993 #13 0x0000000000440d3a in main (argc=3, argv=0x11f8a30) ---Type <return> to continue, or q <return> to quit--- at /root/php-7.1.3/sapi/cli/php_cli.c:1381 ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=74308&edit=1