Bug #78549 [Opn]: Stack overflow due to nested serialized input

Edit report at https://bugs.php.net/bug.php?id=78549&edit=1 ID: 78549 Updated by: nikic@php.net Reported by: marc dot schoenefeld at gmx dot org Summary: Stack overflow due to nested serialized input Status: Open Type: Bug Package: Reproducible crash Operating System: CentOS 7 / Generic PHP Version: 7.3.9 Block user comment: N Private report: N New Comment: What are the contents of php_7_3_9_stack_overflow.ser? I can imagine, but if you already have the test case... Previous Comments: ------------------------------------------------------------------------ [2019-09-16 12:32:42] marc dot schoenefeld at gmx dot org Description: ------------ php 7.3.9 (tested with locally compiled build on CentOS 7) can be DoSed with serialized data, causing a stack overflow scenario [see below]. Test script: --------------- <?php $filehandle = fopen($argv[1], "r") or die("Unable to open file!"); $data = fread($filehandle,filesize($argv[1])); fclose($filehandle); $string = unserialize($data); ?> Expected result: ---------------- No crash Actual result: -------------- php-7.3.9/sapi/cli/php sertest.php php_7_3_9_stack_overflow.ser Program received signal SIGSEGV, Segmentation fault. php_var_unserialize_internal (rval=rval@entry=0x7fb2a70dd240, p=p@entry=0x7ffe3f34b120, max=max@entry=0x7fb2a833ad95 "", var_hash=var_hash@entry=0x7ffe3f34b128, as_key=as_key@entry=0) at /php/linux_build/php-7.3.9/ext/standard/var_unserializer.c:1345 1345 zend_long elements = parse_iv(start + 2); Missing separate debuginfos, use: debuginfo-install libxml2-2.9.1-6.el7_2.3.x86_64 xz-libs-5.2.2-1.el7.x86_64 (gdb) bt #0 php_var_unserialize_internal (rval=rval@entry=0x7fb2a70dd240, p=p@entry=0x7ffe3f34b120, max=max@entry=0x7fb2a833ad95 "", var_hash=var_hash@entry=0x7ffe3f34b128, as_key=as_key@entry=0) at php/linux_build/php-7.3.9/ext/standard/var_unserializer.c:1345 #1 0x00000000006ca221 in process_nested_data (objprops=0, elements=0, ht=0x7fb2a70df268, var_hash=0x7ffe3f34b128, max=0x7fb2a833ad95 "", p=0x7ffe3f34b120, rval=0x7fb2a70dd240) at /php/linux_build/php-7.3.9/ext/standard/var_unserializer.c:502 #2 php_var_unserialize_internal (rval=rval@entry=0x7fb2a70dd100, p=p@entry=0x7ffe3f34b120, max=max@entry=0x7fb2a833ad95 "", var_hash=var_hash@entry=0x7ffe3f34b128, as_key=as_key@entry=0) at /php/linux_build/php-7.3.9/ext/standard/var_unserializer.c:1370 #3 0x00000000006ca221 in process_nested_data (objprops=0, elements=0, ht=0x7fb2a70df230, var_hash=0x7ffe3f34b128, max=0x7fb2a833ad95 "", p=0x7ffe3f34b120, rval=0x7fb2a70dd100) at /php/linux_build/php-7.3.9/ext/standard/var_unserializer.c:502 #4 php_var_unserialize_internal (rval=rval@entry=0x7fb2a70dcfc0, p=p@entry=0x7ffe3f34b120, max=max@entry=0x7fb2a833ad95 "", var_hash=var_hash@entry=0x7ffe3f34b128, as_key=as_key@entry=0) at /php/linux_build/php-7.3.9/ext/standard/var_unserializer.c:1370 #5 0x00000000006ca221 in process_nested_data (objprops=0, elements=0, ht=0x7fb2a70df1f8, var_hash=0x7ffe3f34b128, max=0x7fb2a833ad95 "", p=0x7ffe3f34b120, rval=0x7fb2a70dcfc0) at /php/linux_build/php-7.3.9/ext/standard/var_unserializer.c:502 #6 php_var_unserialize_internal (rval=rval@entry=0x7fb2a70dce80, p=p@entry=0x7ffe3f34b120, max=max@entry=0x7fb2a833ad95 "", var_hash=var_hash@entry=0x7ffe3f34b128, as_key=as_key@entry=0) at /php/linux_build/php-7.3.9/ext/standard/var_unserializer.c:1370 #7 0x00000000006ca221 in process_nested_data (objprops=0, elements=0, ht=0x7fb2a70df1c0, var_hash=0x7ffe3f34b128, max=0x7fb2a833ad95 "", p=0x7ffe3f34b120, rval=0x7fb2a70dce80) at /php/linux_build/php-7.3.9/ext/standard/var_unserializer.c:502 #8 php_var_unserialize_internal (rval=rval@entry=0x7fb2a70dcd40, p=p@entry=0x7ffe3f34b120, max=max@entry=0x7fb2a833ad95 "", var_hash=var_hash@entry=0x7ffe3f34b128, as_key=as_key@entry=0) at /php/linux_build/php-7.3.9/ext/standard/var_unserializer.c:1370 #9 0x00000000006ca221 in process_nested_data (objprops=0, elements=0, ht=0x7fb2a70df188, var_hash=0x7ffe3f34b128, max=0x7fb2a833ad95 "", p=0x7ffe3f34b120, rval=0x7fb2a70dcd40) at /php/linux_build/php-7.3.9/ext/standard/var_unserializer.c:502 #10 php_var_unserialize_internal (rval=rval@entry=0x7fb2a70dcc00, p=p@entry=0x7ffe3f34b120, max=max@entry=0x7fb2a833ad95 "", var_hash=var_hash@entry=0x7ffe3f34b128, as_key=as_key@entry=0) at /php/linux_build/php-7.3.9/ext/standard/var_unserializer.c:1370 #11 0x00000000006ca221 in process_nested_data (objprops=0, elements=0, ht=0x7fb2a70df150, var_hash=0x7ffe3f34b128, max=0x7fb2a833ad95 "", p=0x7ffe3f34b120, rval=0x7fb2a70dcc00) at /php/linux_build/php-7.3.9/ext/standard/var_unserializer.c:502 #12 php_var_unserialize_internal (rval=rval@entry=0x7fb2a70dcac0, p=p@entry=0x7ffe3f34b120, max=max@entry=0x7fb2a833ad95 "", var_hash=var_hash@entry=0x7ffe3f34b128, as_key=as_key@entry=0) at /php/linux_build/php-7.3.9/ext/standard/var_unserializer.c:1370 #13 0x00000000006ca221 in process_nested_data (objprops=0, elements=0, ht=0x7fb2a70df118, var_hash=0x7ffe3f34b128, max=0x7fb2a833ad95 "", p=0x7ffe3f34b120, rval=0x7fb2a70dcac0) at /php/linux_build/php-7.3.9/ext/standard/var_unserializer.c:502 #14 php_var_unserialize_internal (rval=rval@entry=0x7fb2a70dc980, p=p@entry=0x7ffe3f34b120, max=max@entry=0x7fb2a833ad95 "", var_hash=var_hash@entry=0x7ffe3f34b128, as_key=as_key@entry=0) at /php/linux_build/php-7.3.9/ext/standard/var_unserializer.c:1370 #15 0x00000000006ca221 in process_nested_data (objprops=0, elements=0, ht=0x7fb2a70df0e0, var_hash=0x7ffe3f34b128, max=0x7fb2a833ad95 "", p=0x7ffe3f34b120, rval=0x7fb2a70dc980) at /php/linux_build/php-7.3.9/ext/standard/var_unserializer.c:502 #16 php_var_unserialize_internal (rval=rval@entry=0x7fb2a70dc840, p=p@entry=0x7ffe3f34b120, max=max@entry=0x7fb2a833ad95 "", var_hash=var_hash@entry=0x7ffe3f34b128, as_key=as_key@entry=0) at /php/linux_build/php-7.3.9/ext/standard/var_unserializer.c:1370 #17 0x00000000006ca221 in process_nested_data (objprops=0, elements=0, ht=0x7fb2a70df0a8, var_hash=0x7ffe3f34b128, max=0x7fb2a833ad95 "", p=0x7ffe3f34b120, rval=0x7fb2a70dc840) at /php/linux_build/php-7.3.9/ext/standard/var_unserializer.c:502 ---Type <return> to continue, or q <return> to quit--- q Quit (gdb) disass $pc-12,$pc+10 Dump of assembler code from 0x6ca14e to 0x6ca164: 0x00000000006ca14e <php_var_unserialize_internal+2430>: jne 0x6c9928 <php_var_unserialize_internal+344> 0x00000000006ca154 <php_var_unserialize_internal+2436>: xor esi,esi 0x00000000006ca156 <php_var_unserialize_internal+2438>: add r12,0x3 => 0x00000000006ca15a <php_var_unserialize_internal+2442>: call 0x42ca21 <parse_iv2> 0x00000000006ca15f <php_var_unserialize_internal+2447>: test rbx,rbx 0x00000000006ca162 <php_var_unserialize_internal+2450>: mov r13,rax End of assembler dump. ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=78549&edit=1