Bug #79149 [Asn]: SEGV caused by zif_mb_convert_encoding with non-string encodings

Edit report at https://bugs.php.net/bug.php?id=79149&edit=1 ID: 79149 Updated by: nikic@php.net Reported by: wxhusst at gmail dot com Summary: SEGV caused by zif_mb_convert_encoding with non-string encodings Status: Assigned Type: Bug Package: mbstring related Operating System: linux PHP Version: master-Git-2020-01-21 (Git) Assigned To: cmb Block user comment: N Private report: N New Comment: Patch LGTM. Previous Comments: ------------------------------------------------------------------------ [2020-01-21 17:16:49] cmb@php.net Suggested fix for PHP 7.4: <https://gist.github.com/cmb69/080acb60a50d40f76bc7b628b376b5e4>. For PHP 7.3 we should also replace the convert_to_string_ex()[1], which can modify passed arguments. Regarding exploitability: mb_convert_encoding($_GET['text'], 'UTF-8', $_GET['encodings']) would be vulnerable. However, that would be a userland bug, in my opionion. [1] <https://github.com/php/php-src/blob/php-7.3.14/ext/mbstring/mbstring.c#L3236> ------------------------------------------------------------------------ [2020-01-21 16:55:05] wxhusst at gmail dot com I also think this don't seem like a realistic pathway for remote exploitation, :) ------------------------------------------------------------------------ [2020-01-21 16:31:44] nikic@php.net In https://github.com/php/php-src/blob/a3e29ba34add1f06089b749802728c30aa70e5e9/ext/mbstring/mbstring.c#L2882 and a few places below we use Z_STRVAL_P(hash_entry), while we should be using encoding_str. This doesn't seem like a realistic pathway for remote exploitation though. ------------------------------------------------------------------------ [2020-01-21 16:30:56] cmb@php.net Then this is likely a duplicate of bug #79150. I already have a working patch. ------------------------------------------------------------------------ [2020-01-21 16:28:06] nikic@php.net I can reproduce this. Here's a reduction: <?php mb_convert_encoding("", "UTF-8", [0]); Presumably non-string encodings are not handled correctly. ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=79149 -- Edit this bug report at https://bugs.php.net/bug.php?id=79149&edit=1