Bug #77544 [Fbk->Asn]: stack-buffer-overflow while using eval in php 5.6.40
Edit report at https://bugs.php.net/bug.php?id=77544&edit=1
ID: 77544
User updated by: insi_2304 at ymail dot com
Reported by: insi_2304 at ymail dot com
Summary: stack-buffer-overflow while using eval in php 5.6.40
-Status: Feedback
+Status: Assigned
Type: Bug
Package: Scripting Engine problem
Operating System: Kali Linux
PHP Version: 5.6.40
Assigned To: cmb
Block user comment: N
Private report: N
New Comment:
I could not check for other supported versions as other versions are throwing memory leak while
compiling with asan
Previous Comments:
------------------------------------------------------------------------
[2019-01-30 08:33:38] cmb@php.net
Then please check whether this issue also happens with any
*actively* *supported* PHP version[1].
[1] <http://php.net/supported-versions.php>
------------------------------------------------------------------------
[2019-01-30 04:34:17] insi_2304 at ymail dot com
The version affected is 5.6.40,
------------------------------------------------------------------------
[2019-01-29 22:45:13] cmb@php.net
The title claims this about PHP 5.6.40, but the version field says it's 7.3.1. Which is it?
------------------------------------------------------------------------
[2019-01-29 19:12:16] insi_2304 at ymail dot com
Description:
------------
root@kali2:~/fuzzing/victims/php-src-php-5.6.40/sapi/cli# USE_ZEND_ALLOC=0 ./php -r
'eval(file_get_contents("php://stdin"));' < ./stack_bof_eval
=================================================================
==3122==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffd1460eb10 at pc
0x00000149417d bp 0x7ffd1460c590 sp 0x7ffd1460c588
WRITE of size 1 at 0x7ffd1460eb10 thread T0
#0 0x149417c in yysyntax_error
/root/fuzzing/victims/php-src-php-5.6.40/Zend/zend_language_parser.c:3171:18
#1 0x14864cc in zendparse
/root/fuzzing/victims/php-src-php-5.6.40/Zend/zend_language_parser.c:6673:33
#2 0x1499e51 in compile_string
/root/fuzzing/victims/php-src-php-5.6.40/Zend/zend_language_scanner.l:751:21
#3 0x1798da1 in ZEND_INCLUDE_OR_EVAL_SPEC_VAR_HANDLER
/root/fuzzing/victims/php-src-php-5.6.40/Zend/zend_vm_execute.h:13758:21
#4 0x16ece6d in execute_ex
/root/fuzzing/victims/php-src-php-5.6.40/Zend/zend_vm_execute.h:363:14
#5 0x16eee52 in zend_execute
/root/fuzzing/victims/php-src-php-5.6.40/Zend/zend_vm_execute.h:388:2
#6 0x15aec87 in zend_eval_stringl
/root/fuzzing/victims/php-src-php-5.6.40/Zend/zend_execute_API.c:1080:4
#7 0x15b0409 in zend_eval_stringl_ex
/root/fuzzing/victims/php-src-php-5.6.40/Zend/zend_execute_API.c:1127:11
#8 0x15b0409 in zend_eval_string_ex
/root/fuzzing/victims/php-src-php-5.6.40/Zend/zend_execute_API.c:1138
#9 0x194a9c8 in do_cli /root/fuzzing/victims/php-src-php-5.6.40/sapi/cli/php_cli.c:1038:8
#10 0x1947841 in main /root/fuzzing/victims/php-src-php-5.6.40/sapi/cli/php_cli.c:1382:18
#11 0x7f3d63d9c09a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2409a)
#12 0x43de79 in _start (/root/fuzzing/victims/php-src-php-5.6.40/sapi/cli/php+0x43de79)
Address 0x7ffd1460eb10 is located in stack of thread T0 at offset 9040 in frame
#0 0x1485a2f in zendparse
/root/fuzzing/victims/php-src-php-5.6.40/Zend/zend_language_parser.c:3213
This frame has 8 object(s):
[32, 72) 'yylval'
[112, 512) 'yyssa'
[576, 8576) 'yyvsa'
[8832, 8872) 'yyval'
[8912, 9040) 'yymsgbuf' <== Memory access at offset 9040 overflows this variable
[9072, 9080) 'yymsg_alloc'
[9104, 9144) 'tmp_znode'
[9184, 9224) 'tmp_znode1708'
HINT: this may be a false positive if your program uses some custom stack unwind mechanism or
swapcontext
(longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow
/root/fuzzing/victims/php-src-php-5.6.40/Zend/zend_language_parser.c:3171:18 in yysyntax_error
Shadow bytes around the buggy address:
0x1000228b9d10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x1000228b9d20: 00 00 00 00 00 00 00 00 f2 f2 f2 f2 f2 f2 f2 f2
0x1000228b9d30: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2
0x1000228b9d40: f2 f2 f2 f2 f2 f2 f2 f2 00 00 00 00 00 f2 f2 f2
0x1000228b9d50: f2 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x1000228b9d60: 00 00[f2]f2 f2 f2 00 f2 f2 f2 00 00 00 00 00 f2
0x1000228b9d70: f2 f2 f2 f2 00 00 00 00 00 f3 f3 f3 f3 f3 f3 f3
0x1000228b9d80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x1000228b9d90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x1000228b9da0: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1
0x1000228b9db0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==3122==ABORTING
Test script:
---------------
namespace MfP"pp{} namespace M�Feovuw);
�chP1ÃXhe__Fakeup>at�Zi\{mfd(�Fro
�at��"ce
$dmtdti�h.hhhhhhhhhhhhhUh$dm.hhhhhhhhhhhhhtdtireate
t�o�eeev_destrudi�lad��dral);
e h� $datEmAr
atIstanc��ateX��eHme-adry-It�Zi\{mfd(�FroN��b@omA.ray�d($�FC;
echo �eete');
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=77544&edit=1
Thread (1 message)
- insi_2304 at ymail dot com
- Unknown Message
- insi_2304 at ymail dot com