Edit report at https://bugs.php.net/bug.php?id=75934&edit=1
ID: 75934
Comment by: jedisct1@php.net
Reported by: zhihua dot yao at dbappsecurity dot com dot cn
Summary: Out of Bound in sodium_pad
Status: Assigned
Type: Bug
Package: Reproducible crash
PHP Version: 7.2.2
Assigned To: jedisct1
Block user comment: N
Private report: N
New Comment:
Workaround: https://github.com/jedisct1/libsodium-php/commit/75701f246f44911ca9cd559341c827538f563d24
But the root cause should rather be fixed.
Previous Comments:
------------------------------------------------------------------------
[2018-04-28 14:13:38] jedisct1@php.net
zend_string_alloc() is broken due to the absence of overflow check before rounding; if the requested
length is >= SIZE_MAX-16, it allocates either 0 or 16 bytes, and returns a valid pointer instead
of an OOM.
------------------------------------------------------------------------
[2018-04-28 00:52:09] zhihua dot yao at dbappsecurity dot com dot cn
However, I was using the latest version. When I compiled the sodium, this poc would cause a
crash.Maybe it has been fixed?
------------------------------------------------------------------------
[2018-04-27 14:34:31] jedisct1@php.net
Weird, the memory allocation should have failed. There are no ways to allocate close to 4 Gb on
Linux/i386.
Tried on a Linux system and the memory allocation failed as expected.
Where did you find a PHP 7 binary for such an old distribution?
------------------------------------------------------------------------
[2018-04-27 14:26:59] zhihua dot yao at dbappsecurity dot com dot cn
Yes,Ubuntu 14.04 x86
------------------------------------------------------------------------
[2018-04-27 13:43:14] jedisct1@php.net
What system is that on? Is it a 32 bit system?
------------------------------------------------------------------------
The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
https://bugs.php.net/bug.php?id=75934
--
Edit this bug report at https://bugs.php.net/bug.php?id=75934&edit=1