Bug #79015 [Ver->Csd]: undefined-behavior in php_date.c

Edit report at https://bugs.php.net/bug.php?id=79015&edit=1 ID: 79015 Updated by: cmb@php.net Reported by: reza at iseclab dot org Summary: undefined-behavior in php_date.c -Status: Verified +Status: Closed Type: Bug Package: Date/time related Operating System: Ubuntu 16.04 PHP Version: 7.3.13 Block user comment: N Private report: N New Comment: Automatic comment on behalf of cmbecker69@gmx.de Revision: http://git.php.net/?p=php-src.git;a=commit;h=b48f2625b57f70eea858033e623e6bf13b595e3b Log: Fix #79015: undefined-behavior in php_date.c Previous Comments: ------------------------------------------------------------------------ [2019-12-23 13:06:53] cmb@php.net The following pull request has been associated: Patch Name: Fix #79015: undefined-behavior in php_date.c On GitHub: https://github.com/php/php-src/pull/5031 Patch: https://github.com/php/php-src/pull/5031.patch ------------------------------------------------------------------------ [2019-12-23 10:40:43] cmb@php.net Indeed, a check for the valid range should be done before assigning the double to a signed integer[1]. [1] <https://github.com/php/php-src/blob/php-7.3.13/ext/date/php_date.c#L4395> ------------------------------------------------------------------------ [2019-12-22 00:35:24] reza at iseclab dot org Description: ------------ While I was fuzzing with LibFuzzer, I got this UB. The source code is instrumented with UBSanitizer. This is the version of PHP: --- php --version PHP 8.0.0-dev (cli) (built: Dec 19 2019 13:24:08) ( NTS ) Copyright (c) The PHP Group Zend Engine v4.0.0-dev, Copyright (c) Zend Technologies --- Here is the Poc file that triggers the UB. O:12:"DateInterval":1:1s:1:"f";i:9999999999990; Test script: --------------- php -r 'unserialize(file_get_contents("php://stdin"));' < PoC Actual result: -------------- Notice: unserialize(): Error at offset 47 of 48 bytes in Command line code on line 1 php-src-master/ext/date/php_date.c:4026:26: runtime error: 1e+19 is outside the range of representable values of type 'long long' #0 0x5be918 in php_date_interval_initialize_from_hash (php-src-master/sapi/cli/php+0x5be918) #1 0x5c54ef in zim_DateInterval___wakeup (php-src-master/sapi/cli/php+0x5c54ef) #2 0x2848646 in zend_call_function (php-src-master/sapi/cli/php+0x2848646) #3 0x283d21e in _call_user_function_ex (php-src-master/sapi/cli/php+0x283d21e) #4 0x216ccc3 in var_destroy (php-src-master/sapi/cli/php+0x216ccc3) #5 0x216b270 in php_var_unserialize_destroy (php-src-master/sapi/cli/php+0x216b270) #6 0x207ec9e in zif_unserialize (php-src-master/sapi/cli/php+0x207ec9e) #7 0x37ca76a in ZEND_DO_ICALL_SPEC_RETVAL_UNUSED_HANDLER (php-src-master/sapi/cli/php+0x37ca76a) #8 0x2ee704a in execute_ex (php-src-master/sapi/cli/php+0x2ee704a) #9 0x2eea2d3 in zend_execute (php-src-master/sapi/cli/php+0x2eea2d3) #10 0x285545b in zend_eval_stringl (php-src-master/sapi/cli/php+0x285545b) #11 0x2856ce0 in zend_eval_stringl_ex (php-src-master/sapi/cli/php+0x2856ce0) #12 0x2856ec3 in zend_eval_string_ex (php-src-master/sapi/cli/php+0x2856ec3) #13 0x3aee302 in do_cli (php-src-master/sapi/cli/php+0x3aee302) #14 0x3ae9270 in main (php-src-master/sapi/cli/php+0x3ae9270) #15 0x7ffff640082f in __libc_start_main /build/glibc-LK5gWL/glibc-2.23/csu/../csu/libc-start.c:291 #16 0x43f608 in _start (php-src-master/sapi/cli/php+0x43f608) SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior php-src-master/ext/date/php_date.c:4026:26 in ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=79015&edit=1