Bug #75934 [Com]: Out of Bound in sodium_pad

Edit report at https://bugs.php.net/bug.php?id=75934&edit=1 ID: 75934 Comment by: jedisct1@php.net Reported by: zhihua dot yao at dbappsecurity dot com dot cn Summary: Out of Bound in sodium_pad Status: Assigned Type: Bug Package: Reproducible crash PHP Version: 7.2.2 Assigned To: jedisct1 Block user comment: N Private report: N New Comment: zend_string_alloc() is broken due to the absence of overflow check before rounding; if the requested length is >= SIZE_MAX-16, it allocates either 0 or 16 bytes, and returns a valid pointer instead of an OOM. Previous Comments: ------------------------------------------------------------------------ [2018-04-28 00:52:09] zhihua dot yao at dbappsecurity dot com dot cn However, I was using the latest version. When I compiled the sodium, this poc would cause a crash.Maybe it has been fixed? ------------------------------------------------------------------------ [2018-04-27 14:34:31] jedisct1@php.net Weird, the memory allocation should have failed. There are no ways to allocate close to 4 Gb on Linux/i386. Tried on a Linux system and the memory allocation failed as expected. Where did you find a PHP 7 binary for such an old distribution? ------------------------------------------------------------------------ [2018-04-27 14:26:59] zhihua dot yao at dbappsecurity dot com dot cn Yes,Ubuntu 14.04 x86 ------------------------------------------------------------------------ [2018-04-27 13:43:14] jedisct1@php.net What system is that on? Is it a 32 bit system? ------------------------------------------------------------------------ [2018-04-27 12:05:17] cmb@php.net On a quick glance, the check blocksize > SIZE_MAX[1] looks fishy. Frank, could you please have a look at this issue? [1] <https://github.com/php/php-src/blob/PHP-7.2.2/ext/sodium/libsodium.c#L3386> ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=75934 -- Edit this bug report at https://bugs.php.net/bug.php?id=75934&edit=1