Sec Bug->Bug #77484 [Ver]: Zend engine crashes when calling realpath in invalid working dir

Edit report at https://bugs.php.net/bug.php?id=77484&edit=1 ID: 77484 Updated by: stas@php.net Reported by: marcospassos dot com at gmail dot com Summary: Zend engine crashes when calling realpath in invalid working dir Status: Verified -Type: Security +Type: Bug Package: *Directory/Filesystem functions Operating System: Mac OS 10.12.6 PHP Version: 7.3.1 Assigned To: ab Block user comment: N Private report: Y New Comment: Not a security issue - requires special condition and explicit user action to trigger. Previous Comments: ------------------------------------------------------------------------ [2019-01-18 16:56:33] cmb@php.net There occurs an unsigned underflow in tsrm_realpath_r()[1]; the attached patch add-undeflow-check would solve this. Anatol, since you've refactored tsrm_realpath_r() to size_t, could you please review the patch? [1] <https://github.com/php/php-src/blob/php-7.3.1/Zend/zend_virtual_cwd.c#L767> ------------------------------------------------------------------------ [2019-01-18 16:56:30] cmb@php.net The following patch has been added/updated: Patch Name: add-undeflow-check Revision: 1547830590 URL: https://bugs.php.net/patch-display.php?bug=77484&patch=add-undeflow-check&revision=1547830590 ------------------------------------------------------------------------ [2019-01-18 11:31:57] cmb@php.net Tentatively marking as sec bug. ------------------------------------------------------------------------ [2019-01-18 00:31:47] spam2 at rhsoft dot net outside the PHP world this would classify as vulnerability when simple 2-liner crashs a shared server process ------------------------------------------------------------------------ [2019-01-18 00:28:25] marcospassos dot com at gmail dot com Description: ------------ Calling realpath in an invalid working directory causes the engine to crash. Test script: --------------- https://3v4l.org/jWhgB Expected result: ---------------- false Actual result: -------------- Crash ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=77484&edit=1