Bug #77736 [Opn->Nab]: Heap corruption in timelib_get_time_zone_info

Edit report at https://bugs.php.net/bug.php?id=77736&edit=1 ID: 77736 Updated by: nikic@php.net Reported by: bugs-syssec at rub dot de Summary: Heap corruption in timelib_get_time_zone_info -Status: Open +Status: Not a bug Type: Bug Package: *General Issues Operating System: Linux PHP Version: 7.3.3 Block user comment: N Private report: N New Comment: > PHP 7.3.0 (cli) (built: Jan 17 2019 14:04:29) ( NTS ) Please try a more recent release. The current one is PHP 7.3.3. This issue has already been fixed. Previous Comments: ------------------------------------------------------------------------ [2019-03-13 15:17:31] bugs-syssec at rub dot de Test Script: <?php spl_autoload_call(True . a); strtotime(NULL); ------------------------------------------------------------------------ [2019-03-13 15:14:36] bugs-syssec at rub dot de Description: ------------ $ ./php --version PHP 7.3.0 (cli) (built: Jan 17 2019 14:04:29) ( NTS ) Copyright (c) 1997-2018 The PHP Group Zend Engine v3.3.0-dev, Copyright (c) 1998-2018 Zend Technologies Test script: --------------- <?php $a = strtotime(A); spl_autoload($a); gc_mem_caches(); Expected result: ---------------- No crash. Actual result: -------------- ==12279== Memcheck, a memory error detector ==12279== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al. ==12279== Using Valgrind-3.13.0 and LibVEX; rerun with -h for copyright info ==12279== Command: ./php-plain heap_corrption-1-timelib_get_time_zone_info.php ==12279== ==12279== Invalid read of size 8 ==12279== at 0x37266D: zend_mm_alloc_small (zend_alloc.c:1287) ==12279== by 0x37266D: zend_mm_alloc_heap (zend_alloc.c:1358) ==12279== by 0x37266D: _emalloc (zend_alloc.c:2498) ==12279== by 0x37358A: _ecalloc (zend_alloc.c:2579) ==12279== by 0x210D52: timelib_get_time_zone_info (parse_tz.c:633) ==12279== by 0x2124A7: do_adjust_timezone (tm2unixtime.c:463) ==12279== by 0x2124A7: timelib_update_ts (tm2unixtime.c:511) ==12279== by 0x1ED8B3: zif_strtotime (php_date.c:1529) ==12279== by 0x41F3C7: ZEND_DO_ICALL_SPEC_RETVAL_UNUSED_HANDLER (zend_vm_execute.h:645) ==12279== by 0x41F3C7: execute_ex (zend_vm_execute.h:55414) ==12279== by 0x42352F: zend_execute (zend_vm_execute.h:60834) ==12279== by 0x3972F6: zend_execute_scripts (zend.c:1568) ==12279== by 0x336457: php_execute_script (main.c:2630) ==12279== by 0x42597D: do_cli (php_cli.c:997) ==12279== by 0x1E49B1: main (php_cli.c:1389) ==12279== Address 0x64014200000 is not stack'd, malloc'd or (recently) free'd ==12279== ==12279== ==12279== Process terminating with default action of signal 11 (SIGSEGV) ==12279== Access not within mapped region at address 0x64014200000 ==12279== at 0x37266D: zend_mm_alloc_small (zend_alloc.c:1287) ==12279== by 0x37266D: zend_mm_alloc_heap (zend_alloc.c:1358) ==12279== by 0x37266D: _emalloc (zend_alloc.c:2498) ==12279== by 0x37358A: _ecalloc (zend_alloc.c:2579) ==12279== by 0x210D52: timelib_get_time_zone_info (parse_tz.c:633) ==12279== by 0x2124A7: do_adjust_timezone (tm2unixtime.c:463) ==12279== by 0x2124A7: timelib_update_ts (tm2unixtime.c:511) ==12279== by 0x1ED8B3: zif_strtotime (php_date.c:1529) ==12279== by 0x41F3C7: ZEND_DO_ICALL_SPEC_RETVAL_UNUSED_HANDLER (zend_vm_execute.h:645) ==12279== by 0x41F3C7: execute_ex (zend_vm_execute.h:55414) ==12279== by 0x42352F: zend_execute (zend_vm_execute.h:60834) ==12279== by 0x3972F6: zend_execute_scripts (zend.c:1568) ==12279== by 0x336457: php_execute_script (main.c:2630) ==12279== by 0x42597D: do_cli (php_cli.c:997) ==12279== by 0x1E49B1: main (php_cli.c:1389) ==12279== If you believe this happened as a result of a stack ==12279== overflow in your program's main thread (unlikely but ==12279== possible), you can try to increase the size of the ==12279== main thread stack using the --main-stacksize= flag. ==12279== The main thread stack size used in this run was 8388608. ==12279== ==12279== HEAP SUMMARY: ==12279== in use at exit: 922,587 bytes in 6,198 blocks ==12279== total heap usage: 6,622 allocs, 424 frees, 1,125,885 bytes allocated ==12279== ==12279== LEAK SUMMARY: ==12279== definitely lost: 0 bytes in 0 blocks ==12279== indirectly lost: 0 bytes in 0 blocks ==12279== possibly lost: 692,520 bytes in 5,249 blocks ==12279== still reachable: 230,067 bytes in 949 blocks ==12279== suppressed: 0 bytes in 0 blocks ==12279== Rerun with --leak-check=full to see details of leaked memory ==12279== ==12279== For counts of detected and suppressed errors, rerun with: -v ==12279== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0) ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=77736&edit=1