Edit report at https://bugs.php.net/bug.php?id=80183&edit=1
ID: 80183
Updated by: stas@php.net
Reported by: m dot aldofirmansyah at gmail dot com
Summary: Stack Overflow in zend_try_compile_cv
Status: Open
-Type: Security
+Type: Bug
-Package: Unknown/Other Function
+Package: Scripting Engine problem
Operating System: Ubuntu 16.04.1
PHP Version: 8.0.0rc1
Block user comment: N
Private report: Y
Previous Comments:
------------------------------------------------------------------------
[2020-10-04 03:19:37] m dot aldofirmansyah at gmail dot com
Description:
------------
When fuzzing I found crashes, here is one of them
And here is the crash summary using crashwalk and exploitable, with
ASAN_OPTIONS="abort_on_error=1:symbolize=0"
---CRASH SUMMARY---
Filename: /root/fuzzing-crash-file/php/crash/id:000010,sig:06,src:007382,op:havoc,rep:16
SHA1: 65a6543bc15dc15f6ecaa6444d1c8b1eac649822
Classification: EXPLOITABLE
Hash: c6369cca9f5b474eb58f64460df8222e.69512d8e0fd694d7e12e80288baeaca8
Command: /root/php/SRC/build/bin/php
/root/fuzzing-crash-file/php/crash/id:000010,sig:06,src:007382,op:havoc,rep:16
Faulting Frame:
zend_try_compile_cv @ 0x0000000001e4d36c: in /root/php/SRC/build/bin/php
Disassembly:
Stack Head (1000 entries):
zend_try_compile_cv @ 0x0000000001e4d36c: in /root/php/SRC/build/bin/php
zend_compile_simple_var @ 0x0000000001ee7048: in /root/php/SRC/build/bin/php
zend_compile_var_inner @ 0x0000000001ee6710: in /root/php/SRC/build/bin/php
zend_compile_var @ 0x0000000001e4f754: in /root/php/SRC/build/bin/php
zend_compile_expr_inner @ 0x0000000001ee4a72: in /root/php/SRC/build/bin/php
zend_compile_expr @ 0x0000000001e44cbc: in /root/php/SRC/build/bin/php
zend_compile_simple_var_n @ 0x0000000001e4d740: in /root/php/SRC/build/bin/php
zend_compile_simple_var @ 0x0000000001ee70a5: in /root/php/SRC/build/bin/php
zend_compile_var_inner @ 0x0000000001ee6710: in /root/php/SRC/build/bin/php
zend_compile_var @ 0x0000000001e4f754: in /root/php/SRC/build/bin/php
zend_compile_expr_inner @ 0x0000000001ee4a72: in /root/php/SRC/build/bin/php
zend_compile_expr @ 0x0000000001e44cbc: in /root/php/SRC/build/bin/php
zend_compile_simple_var_n @ 0x0000000001e4d740: in /root/php/SRC/build/bin/php
zend_compile_simple_var @ 0x0000000001ee70a5: in /root/php/SRC/build/bin/php
zend_compile_var_inner @ 0x0000000001ee6710: in /root/php/SRC/build/bin/php
zend_compile_var @ 0x0000000001e4f754: in /root/php/SRC/build/bin/php
Registers:
rax=0x00007ffd9f7b7040 rbx=0x00000ff39e018274 rcx=0x00007ffd9f7b6fe0 rdx=0x00000000049806c0
rsi=0x00000ff39e01828f rdi=0x00007ffd9f7b7000 rbp=0x00007ffd9f7b70f0 rsp=0x00007ffd9f7b6fe0
r8=0x00007ffd9f7b6ff0 r9=0x00007ffd9f7b6fe0 r10=0x00007ffd9f7b76e0 r11=0x00007f9cf00c1398
r12=0x00000ff39e018200 r13=0x0000000000000018 r14=0x00007f9cf00c1398 r15=0x0000000004974188
rip=0x0000000001e4d36c efl=0x0000000000010282 cs=0x0000000000000033 ss=0x000000000000002b
ds=0x0000000000000000 es=0x0000000000000000 fs=0x0000000000000000 gs=0x0000000000000000
Extra Data:
Description: Possible stack corruption
Short description: PossibleStackCorruption (7/22)
Explanation: GDB generated an error while unwinding the stack and/or the stack contained return
addresses that were not mapped in the inferior's process address space and/o
r the stack pointer is pointing to a location outside the default stack region. These conditions
likely indicate stack corruption, which is generally considered exploitable.
---END SUMMARY---
Test script:
---------------
https://gist.github.com/TheCrott/2b0b159f5965b30f5706b78bf4596f5a/raw/1d771d62773335499aec06145d295260e77d79aa/poc3.php
Actual result:
--------------
I don't know how to run this file as it return error
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=80183&edit=1