Bug #78549 [NEW]: Stack overflow due to nested serialized input

From: marc dot schoenefeld at gmx dot org Operating system: CentOS 7 / Generic PHP version: 7.3.9 Package: Reproducible crash Bug Type: Bug Bug description:Stack overflow due to nested serialized input Description: ------------ php 7.3.9 (tested with locally compiled build on CentOS 7) can be DoSed with serialized data, causing a stack overflow scenario [see below]. Test script: --------------- <?php $filehandle = fopen($argv[1], "r") or die("Unable to open file!"); $data = fread($filehandle,filesize($argv[1])); fclose($filehandle); $string = unserialize($data); ?> Expected result: ---------------- No crash Actual result: -------------- php-7.3.9/sapi/cli/php sertest.php php_7_3_9_stack_overflow.ser Program received signal SIGSEGV, Segmentation fault. php_var_unserialize_internal (rval=rval@entry=0x7fb2a70dd240, p=p@entry=0x7ffe3f34b120, max=max@entry=0x7fb2a833ad95 "", var_hash=var_hash@entry=0x7ffe3f34b128, as_key=as_key@entry=0) at /php/linux_build/php-7.3.9/ext/standard/var_unserializer.c:1345 1345 zend_long elements = parse_iv(start + 2); Missing separate debuginfos, use: debuginfo-install libxml2-2.9.1-6.el7_2.3.x86_64 xz-libs-5.2.2-1.el7.x86_64 (gdb) bt #0 php_var_unserialize_internal (rval=rval@entry=0x7fb2a70dd240, p=p@entry=0x7ffe3f34b120, max=max@entry=0x7fb2a833ad95 "", var_hash=var_hash@entry=0x7ffe3f34b128, as_key=as_key@entry=0) at php/linux_build/php-7.3.9/ext/standard/var_unserializer.c:1345 #1 0x00000000006ca221 in process_nested_data (objprops=0, elements=0, ht=0x7fb2a70df268, var_hash=0x7ffe3f34b128, max=0x7fb2a833ad95 "", p=0x7ffe3f34b120, rval=0x7fb2a70dd240) at /php/linux_build/php-7.3.9/ext/standard/var_unserializer.c:502 #2 php_var_unserialize_internal (rval=rval@entry=0x7fb2a70dd100, p=p@entry=0x7ffe3f34b120, max=max@entry=0x7fb2a833ad95 "", var_hash=var_hash@entry=0x7ffe3f34b128, as_key=as_key@entry=0) at /php/linux_build/php-7.3.9/ext/standard/var_unserializer.c:1370 #3 0x00000000006ca221 in process_nested_data (objprops=0, elements=0, ht=0x7fb2a70df230, var_hash=0x7ffe3f34b128, max=0x7fb2a833ad95 "", p=0x7ffe3f34b120, rval=0x7fb2a70dd100) at /php/linux_build/php-7.3.9/ext/standard/var_unserializer.c:502 #4 php_var_unserialize_internal (rval=rval@entry=0x7fb2a70dcfc0, p=p@entry=0x7ffe3f34b120, max=max@entry=0x7fb2a833ad95 "", var_hash=var_hash@entry=0x7ffe3f34b128, as_key=as_key@entry=0) at /php/linux_build/php-7.3.9/ext/standard/var_unserializer.c:1370 #5 0x00000000006ca221 in process_nested_data (objprops=0, elements=0, ht=0x7fb2a70df1f8, var_hash=0x7ffe3f34b128, max=0x7fb2a833ad95 "", p=0x7ffe3f34b120, rval=0x7fb2a70dcfc0) at /php/linux_build/php-7.3.9/ext/standard/var_unserializer.c:502 #6 php_var_unserialize_internal (rval=rval@entry=0x7fb2a70dce80, p=p@entry=0x7ffe3f34b120, max=max@entry=0x7fb2a833ad95 "", var_hash=var_hash@entry=0x7ffe3f34b128, as_key=as_key@entry=0) at /php/linux_build/php-7.3.9/ext/standard/var_unserializer.c:1370 #7 0x00000000006ca221 in process_nested_data (objprops=0, elements=0, ht=0x7fb2a70df1c0, var_hash=0x7ffe3f34b128, max=0x7fb2a833ad95 "", p=0x7ffe3f34b120, rval=0x7fb2a70dce80) at /php/linux_build/php-7.3.9/ext/standard/var_unserializer.c:502 #8 php_var_unserialize_internal (rval=rval@entry=0x7fb2a70dcd40, p=p@entry=0x7ffe3f34b120, max=max@entry=0x7fb2a833ad95 "", var_hash=var_hash@entry=0x7ffe3f34b128, as_key=as_key@entry=0) at /php/linux_build/php-7.3.9/ext/standard/var_unserializer.c:1370 #9 0x00000000006ca221 in process_nested_data (objprops=0, elements=0, ht=0x7fb2a70df188, var_hash=0x7ffe3f34b128, max=0x7fb2a833ad95 "", p=0x7ffe3f34b120, rval=0x7fb2a70dcd40) at /php/linux_build/php-7.3.9/ext/standard/var_unserializer.c:502 #10 php_var_unserialize_internal (rval=rval@entry=0x7fb2a70dcc00, p=p@entry=0x7ffe3f34b120, max=max@entry=0x7fb2a833ad95 "", var_hash=var_hash@entry=0x7ffe3f34b128, as_key=as_key@entry=0) at /php/linux_build/php-7.3.9/ext/standard/var_unserializer.c:1370 #11 0x00000000006ca221 in process_nested_data (objprops=0, elements=0, ht=0x7fb2a70df150, var_hash=0x7ffe3f34b128, max=0x7fb2a833ad95 "", p=0x7ffe3f34b120, rval=0x7fb2a70dcc00) at /php/linux_build/php-7.3.9/ext/standard/var_unserializer.c:502 #12 php_var_unserialize_internal (rval=rval@entry=0x7fb2a70dcac0, p=p@entry=0x7ffe3f34b120, max=max@entry=0x7fb2a833ad95 "", var_hash=var_hash@entry=0x7ffe3f34b128, as_key=as_key@entry=0) at /php/linux_build/php-7.3.9/ext/standard/var_unserializer.c:1370 #13 0x00000000006ca221 in process_nested_data (objprops=0, elements=0, ht=0x7fb2a70df118, var_hash=0x7ffe3f34b128, max=0x7fb2a833ad95 "", p=0x7ffe3f34b120, rval=0x7fb2a70dcac0) at /php/linux_build/php-7.3.9/ext/standard/var_unserializer.c:502 #14 php_var_unserialize_internal (rval=rval@entry=0x7fb2a70dc980, p=p@entry=0x7ffe3f34b120, max=max@entry=0x7fb2a833ad95 "", var_hash=var_hash@entry=0x7ffe3f34b128, as_key=as_key@entry=0) at /php/linux_build/php-7.3.9/ext/standard/var_unserializer.c:1370 #15 0x00000000006ca221 in process_nested_data (objprops=0, elements=0, ht=0x7fb2a70df0e0, var_hash=0x7ffe3f34b128, max=0x7fb2a833ad95 "", p=0x7ffe3f34b120, rval=0x7fb2a70dc980) at /php/linux_build/php-7.3.9/ext/standard/var_unserializer.c:502 #16 php_var_unserialize_internal (rval=rval@entry=0x7fb2a70dc840, p=p@entry=0x7ffe3f34b120, max=max@entry=0x7fb2a833ad95 "", var_hash=var_hash@entry=0x7ffe3f34b128, as_key=as_key@entry=0) at /php/linux_build/php-7.3.9/ext/standard/var_unserializer.c:1370 #17 0x00000000006ca221 in process_nested_data (objprops=0, elements=0, ht=0x7fb2a70df0a8, var_hash=0x7ffe3f34b128, max=0x7fb2a833ad95 "", p=0x7ffe3f34b120, rval=0x7fb2a70dc840) at /php/linux_build/php-7.3.9/ext/standard/var_unserializer.c:502 ---Type <return> to continue, or q <return> to quit--- q Quit (gdb) disass $pc-12,$pc+10 Dump of assembler code from 0x6ca14e to 0x6ca164: 0x00000000006ca14e <php_var_unserialize_internal+2430>: jne 0x6c9928 <php_var_unserialize_internal+344> 0x00000000006ca154 <php_var_unserialize_internal+2436>: xor esi,esi 0x00000000006ca156 <php_var_unserialize_internal+2438>: add r12,0x3 => 0x00000000006ca15a <php_var_unserialize_internal+2442>: call 0x42ca21 <parse_iv2> 0x00000000006ca15f <php_var_unserialize_internal+2447>: test rbx,rbx 0x00000000006ca162 <php_var_unserialize_internal+2450>: mov r13,rax End of assembler dump. -- Edit bug report at https://bugs.php.net/bug.php?id=78549&edit=1 -- Fix committed: https://bugs.php.net/fix.php?id=78549&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=78549&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=78549&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=78549&r=needscript Try newer version: https://bugs.php.net/fix.php?id=78549&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=78549&r=support Expected behavior: https://bugs.php.net/fix.php?id=78549&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=78549&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=78549&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=78549&r=globals PHP version support discontinued: https://bugs.php.net/fix.php?id=78549&r=phptooold Daylight Savings: https://bugs.php.net/fix.php?id=78549&r=dst IIS Stability: https://bugs.php.net/fix.php?id=78549&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=78549&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=78549&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=78549&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=78549&r=mysqlcfg