Bug #75067 [NEW]: Passing of unterminated C string as argument to %s in format string

From: enclaved at safe-mail dot net Operating system: All PHP version: 7.1.8 Package: Strings related Bug Type: Bug Bug description:Passing of unterminated C string as argument to %s in format string Description: ------------ Zend/zend_API.h, around line 580: #define CHECK_ZVAL_STRING(str) \ if (ZSTR_VAL(str)[ZSTR_LEN(str)] != '\0') { zend_error(E_WARNING, "String is not zero-terminated (%s)", ZSTR_VAL(str)); } #define CHECK_ZVAL_STRING_REL(str) \ if (ZSTR_VAL(str)[ZSTR_LEN(str)] != '\0') { zend_error(E_WARNING, "String is not zero-terminated (%s) (source: %s:%d)", ZSTR_VAL(str) ZEND_FILE_LINE_RELAY_CC); } Both of these macros pass unterminated C strings (as far as zend_string is concerned) to zend_error() as arguments to the %s format string conversion specifier. Regardless of whether the strings are implicitly terminated by whatever allocation method they use, this is generally a very bad practice from the common C format string usage semantics. If a truly unterminated C string wrapped in zend_string is passed to one of these macros, it will almost certainly result in delivery of SIGBUS (or SIGSEGV on some platforms). Please make a terminated copy of the string in question with estrndup() or similar means, giving ZSTR_LEN() as an explicit length. -- Edit bug report at https://bugs.php.net/bug.php?id=75067&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=75067&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=75067&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=75067&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=75067&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=75067&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=75067&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=75067&r=needscript Try newer version: https://bugs.php.net/fix.php?id=75067&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=75067&r=support Expected behavior: https://bugs.php.net/fix.php?id=75067&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=75067&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=75067&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=75067&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=75067&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=75067&r=dst IIS Stability: https://bugs.php.net/fix.php?id=75067&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=75067&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=75067&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=75067&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=75067&r=mysqlcfg