Bug #75575 [NEW]: Theoretical pointer wrapping and access-out-of-bounds in non-standard Zend code

From: plebbyastian at gmail dot com Operating system: Whatever PHP version: Irrelevant Package: *General Issues Bug Type: Bug Bug description:Theoretical pointer wrapping and access-out-of-bounds in non-standard Zend code Description: ------------ The subtraction at <https://github.com/php/php-src/blob/26f8fc833b9668a8b8e14ecd7d94930146019adb/Zend/zend_operators.c#L3059> has no guard to ensure pointer wrapping (which itself is undefined behaviour) doesn't occur. There's an identical unguarded pointer subtraction at <https://github.com/php/php-src/blob/26f8fc833b9668a8b8e14ecd7d94930146019adb/Zend/zend_operators.c#L3093>. Successful exploitation would result in high ranges of memory becoming accessible to the attacker, with similar usecases to heartbleed. Remember this when you try to argue for use of non-standard, reinvented wheels. Testing incurs a price. As does code complexity. To put my "standardisation" rants into perspective, here's how C11/6.5.6p8 defines PHP: > ... If both the pointer operand and the result point to elements of the same array object, or one past the last element of the array object, the evaluation shall not produce an overflow; otherwise, the behavior is undefined. ... -- Edit bug report at https://bugs.php.net/bug.php?id=75575&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=75575&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=75575&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=75575&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=75575&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=75575&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=75575&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=75575&r=needscript Try newer version: https://bugs.php.net/fix.php?id=75575&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=75575&r=support Expected behavior: https://bugs.php.net/fix.php?id=75575&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=75575&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=75575&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=75575&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=75575&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=75575&r=dst IIS Stability: https://bugs.php.net/fix.php?id=75575&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=75575&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=75575&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=75575&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=75575&r=mysqlcfg