Edit report at https://bugs.php.net/bug.php?id=77962&edit=1
ID: 77962
Updated by: stas@php.net
Reported by: radimre83 at gmail dot com
Summary: finfo_open crafted magic parsing SIGFPE
Status: Open
-Type: Security
+Type: Bug
Package: Filesystem function related
Operating System: Linux
PHP Version: 7.3.5
Block user comment: N
Private report: Y
New Comment:
I don't think using user-supplied magic database is a common scenario for PHP users. So
doesn't look like a security issue.
Previous Comments:
------------------------------------------------------------------------
[2019-05-02 17:26:41] radimre83 at gmail dot com
Description:
------------
Fuzzing finfo_open with AFL identified the following issue; the PHP process receives a SIGFPE signal
and exits.
Test script:
---------------
root@fd7f809a8411:/build/php-7.3.5# /build/php-7.3.5/sapi/cli/php -r 'finfo_open(FILEINFO_NONE,
$argv[1]);' /repo-shared/fuzz-fileinfo1/id1
Floating point exception (core dumped)
Uploading id1 as the patch.
Expected result:
----------------
A PHP level error message refusing the invalid magic file.
Actual result:
--------------
root@fd7f809a8411:/build/php-7.3.5# /build/php-7.3.5/sapi/cli/php -r 'finfo_open(FILEINFO_NONE,
$argv[1]);' /repo-shared/fuzz-fileinfo1/id1
Floating point exception (core dumped)
root@fd7f809a8411:/build/php-7.3.5# gdb /build/php-7.3.5/sapi/cli/php core
GNU gdb (Debian 7.12-6) 7.12.0.20161007-git
Copyright (C) 2016 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /build/php-7.3.5/sapi/cli/php...done.
[New LWP 11038]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Core was generated by `/build/php-7.3.5/sapi/cli/php -r finfo_open(FILEINFO_NONE, $argv[1]);
/repo-sha'.
Program terminated with signal SIGFPE, Arithmetic exception.
#0 0x00007f588d2d5d13 in apprentice_magic_strength (m=0x7f5888295000) at
/build/php-7.3.5/ext/fileinfo/libmagic/apprentice.c:835
835 val += m->vallen * MAX(MULT / m->vallen, 1);
warning: File "/build/php-7.3.5/.gdbinit" auto-loading has been declined by your
`auto-load safe-path' set to "$debugdir:$datadir/auto-load".
To enable execution of this file add
add-auto-load-safe-path /build/php-7.3.5/.gdbinit
line to your configuration file "/root/.gdbinit".
To completely disable this security protection add
set auto-load safe-path /
line to your configuration file "/root/.gdbinit".
For more information about this security protection see the
"Auto-loading safe path" section in the GDB manual. E.g., run from the shell:
info "(gdb)Auto-loading safe path"
(gdb) bt
#0 0x00007f588d2d5d13 in apprentice_magic_strength (m=0x7f5888295000) at
/build/php-7.3.5/ext/fileinfo/libmagic/apprentice.c:835
#1 0x00007f588d2d5f19 in apprentice_sort (a=0x7f5888280040, b=0x7f5888280050) at
/build/php-7.3.5/ext/fileinfo/libmagic/apprentice.c:922
#2 0x00007f588b21ab70 in ?? () from /lib/x86_64-linux-gnu/libc.so.6
#3 0x00007f588b21aa82 in ?? () from /lib/x86_64-linux-gnu/libc.so.6
#4 0x00007f588b21aa98 in ?? () from /lib/x86_64-linux-gnu/libc.so.6
#5 0x00007f588b21afdf in qsort_r () from /lib/x86_64-linux-gnu/libc.so.6
#6 0x00007f588d2d73fc in apprentice_load (ms=0x7f5888267280, fn=0x7f5888270480
"/repo-shared/fuzz-fileinfo1/id1", action=0) at
/build/php-7.3.5/ext/fileinfo/libmagic/apprentice.c:1354
#7 0x00007f588d2d51ee in apprentice_1 (ms=0x7f5888267280, fn=0x7f5888270480
"/repo-shared/fuzz-fileinfo1/id1", action=0) at
/build/php-7.3.5/ext/fileinfo/libmagic/apprentice.c:435
#8 0x00007f588d2d59d9 in file_apprentice (ms=0x7f5888267280, fn=0x7f5888270480
"/repo-shared/fuzz-fileinfo1/id1", action=0) at
/build/php-7.3.5/ext/fileinfo/libmagic/apprentice.c:626
#9 0x00007f588d2e397f in magic_load (ms=0x7f5888267280, magicfile=0x7ffc5b40a8d0
"/repo-shared/fuzz-fileinfo1/id1") at /build/php-7.3.5/ext/fileinfo/libmagic/magic.c:133
#10 0x00007f588d2d404c in zif_finfo_open (execute_data=0x7f588821e0b0, return_value=0x7ffc5b40b930)
at /build/php-7.3.5/ext/fileinfo/fileinfo.c:355
#11 0x00007f588d6a289e in ZEND_DO_ICALL_SPEC_RETVAL_UNUSED_HANDLER () at
/build/php-7.3.5/Zend/zend_vm_execute.h:645
#12 0x00007f588d70aed0 in execute_ex (ex=0x7f588821e030) at
/build/php-7.3.5/Zend/zend_vm_execute.h:55461
#13 0x00007f588d710518 in zend_execute (op_array=0x7f5888279300, return_value=0x7ffc5b40bc30) at
/build/php-7.3.5/Zend/zend_vm_execute.h:60881
#14 0x00007f588d628d4a in zend_eval_stringl (str=0x7f588e71fef0 "finfo_open(FILEINFO_NONE,
$argv[1]);", str_len=36, retval_ptr=0x0, string_name=0x7f588defb034 "Command line
code")
at /build/php-7.3.5/Zend/zend_execute_API.c:1018
#15 0x00007f588d628efa in zend_eval_stringl_ex (str=0x7f588e71fef0 "finfo_open(FILEINFO_NONE,
$argv[1]);", str_len=36, retval_ptr=0x0, string_name=0x7f588defb034 "Command line
code",
handle_exceptions=1) at /build/php-7.3.5/Zend/zend_execute_API.c:1059
#16 0x00007f588d628f80 in zend_eval_string_ex (str=0x7f588e71fef0 "finfo_open(FILEINFO_NONE,
$argv[1]);", retval_ptr=0x0, string_name=0x7f588defb034 "Command line code",
handle_exceptions=1)
at /build/php-7.3.5/Zend/zend_execute_API.c:1070
#17 0x00007f588d7130b1 in do_cli (argc=4, argv=0x7f588e71fe70) at
/build/php-7.3.5/sapi/cli/php_cli.c:1028
#18 0x00007f588d713f21 in main (argc=4, argv=0x7f588e71fe70) at
/build/php-7.3.5/sapi/cli/php_cli.c:1389
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=77962&edit=1