Edit report at https://bugs.php.net/bug.php?id=73533&edit=1
ID: 73533
Updated by: cmb@php.net
Reported by: ahihibughunter at gmail dot com
Summary: Invalid memory access in php_libxml_xmlCheckUTF8
-Status: Verified
+Status: Closed
Type: Bug
Package: XML related
Operating System: ALL
PHP Version: 7.0.13
Assigned To: cmb
Block user comment: N
Private report: N
New Comment:
Automatic comment on behalf of cmbecker69@gmx.de
Revision: http://git.php.net/?p=php-src.git;a=commit;h=498eb8e0529fbe1dd8a91ae3ee8592eda868d3aa
Log: Fix #73533: Invalid memory access in php_libxml_xmlCheckUTF8
Previous Comments:
------------------------------------------------------------------------
[2021-03-23 15:19:15] cmb@php.net
The following pull request has been associated:
Patch Name: Fix #73533: Invalid memory access in php_libxml_xmlCheckUTF8
On GitHub: https://github.com/php/php-src/pull/6802
Patch: https://github.com/php/php-src/pull/6802.patch
------------------------------------------------------------------------
[2016-11-18 14:37:14] krakjoe@php.net
This issue does not meet the criteria to be considered a security issue.
Please review: https://wiki.php.net/security
------------------------------------------------------------------------
[2016-11-16 03:08:13] ahihibughunter at gmail dot com
Description:
------------
in function php_libxml_xmlCheckUTF8
int php_libxml_xmlCheckUTF8(const unsigned char *s)
{
int i;
unsigned char c;
for (i = 0; (c = s[i++]);) {
if ((c & 0x80) == 0) {
,,,,
}
when input string (s) may have very big size leach to i become negative value and
cause php7 crash.
Test script:
---------------
<?php
ini_set('memory_limit', -1);
class TestSoapClient extends SoapClient {}
$client = new TestSoapClient(dirname(__FILE__).'/ahihi.wsdl');
$strA = 'ahihi';
$strB = str_repeat('a',0x80001000);
$res = $client->Test(array('strA'=>$strA, 'strB'=>$strB));
?>
U can using any valid wsdl file to reproduce this bug.
Expected result:
----------------
No crash
Actual result:
--------------
$ gdb ../../../php7new/php-src-PHP-7.0.13/sapi/cli/php
....
(gdb) r test.php
Starting program: /home/zx/zx/php/php7new/php-src-PHP-7.0.13/sapi/cli/php test.php
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Program received signal SIGSEGV, Segmentation fault.
0x000000000049117c in php_libxml_xmlCheckUTF8 (s=0x7ffeec000000 'a' <repeats 200
times>...) at /home/zx/zx/php/php7new/php-src-PHP-7.0.13/ext/libxml/libxml.c:1143
1143 for (i = 0; (c = s[i++]);) {
(gdb) bt
#0 0x000000000049117c in php_libxml_xmlCheckUTF8 (s=0x7ffeec000000 'a' <repeats 200
times>...) at /home/zx/zx/php/php7new/php-src-PHP-7.0.13/ext/libxml/libxml.c:1143
#1 0x000000000081ddb3 in to_xml_string (type=0x13e4d90 <defaultEncoding+112>,
data=0x7fffed65f6c0, style=2, parent=0x15f1cd0) at
/home/zx/zx/php/php7new/php-src-PHP-7.0.13/ext/soap/php_encoding.c:864
#2 0x000000000081c2ed in master_to_xml_int (encode=0x13e4d90 <defaultEncoding+112>,
data=0x7fffed65f6c0, style=2, parent=0x15f1cd0, check_class_map=1)
at /home/zx/zx/php/php7new/php-src-PHP-7.0.13/ext/soap/php_encoding.c:501
#3 0x000000000081c36a in master_to_xml (encode=0x13e4d90 <defaultEncoding+112>,
data=0x7fffed65f6c0, style=2, parent=0x15f1cd0) at
/home/zx/zx/php/php7new/php-src-PHP-7.0.13/ext/soap/php_encoding.c:512
#4 0x000000000082249b in to_xml_object (type=0x7fffed6588a0, data=0x7fffed663300, style=2,
parent=0x15f1c30) at /home/zx/zx/php/php7new/php-src-PHP-7.0.13/ext/soap/php_encoding.c:1927
#5 0x000000000082728c in sdl_guess_convert_xml (enc=0x7fffed6588a0, data=0x7fffed663300, style=2,
parent=0x15f1c30) at /home/zx/zx/php/php7new/php-src-PHP-7.0.13/ext/soap/php_encoding.c:3285
#6 0x000000000081c2ed in master_to_xml_int (encode=0x7fffed6588a0, data=0x7fffed663300, style=2,
parent=0x15f1c30, check_class_map=1) at
/home/zx/zx/php/php7new/php-src-PHP-7.0.13/ext/soap/php_encoding.c:501
#7 0x000000000081c36a in master_to_xml (encode=0x7fffed6588a0, data=0x7fffed663300, style=2,
parent=0x15f1c30) at /home/zx/zx/php/php7new/php-src-PHP-7.0.13/ext/soap/php_encoding.c:512
#8 0x0000000000818bb7 in serialize_zval (val=0x7fffed663300, param=0x7fffed67a280,
paramName=0x7fffed6632a0 "parameters", style=2, parent=0x15f1c30)
at /home/zx/zx/php/php7new/php-src-PHP-7.0.13/ext/soap/soap.c:4467
#9 0x0000000000818a1a in serialize_parameter (param=0x7fffed67a280, param_val=0x7fffed663300,
index=0, name=0x0, style=2, parent=0x15f1c30) at
/home/zx/zx/php/php7new/php-src-PHP-7.0.13/ext/soap/soap.c:4439
#10 0x0000000000818239 in serialize_function_call (this_ptr=0x7fffed6131d0, function=0x7fffed658c00,
function_name=0x0, uri=0x0, arguments=0x7fffed663300, arg_count=1, version=1, soap_headers=0x0)
at /home/zx/zx/php/php7new/php-src-PHP-7.0.13/ext/soap/soap.c:4302
#11 0x0000000000811bfe in do_soap_call (execute_data=0x7fffed6131b0, this_ptr=0x7fffed6131d0,
function=0x7fffed67a2d8 "Test", function_len=4, arg_count=1, real_args=0x7fffed663300,
return_value=0x7fffed613190,
location=0x7fffed658ba0 "http://localhost:8080/~dmitry/bug38004/server.php",
soap_action=0x0, call_uri=0x0, soap_headers=0x0, output_headers=0x0)
at /home/zx/zx/php/php7new/php-src-PHP-7.0.13/ext/soap/soap.c:2734
#12 0x0000000000812e55 in zim_SoapClient___call (execute_data=0x7fffed6131b0,
return_value=0x7fffed613190) at /home/zx/zx/php/php7new/php-src-PHP-7.0.13/ext/soap/soap.c:2954
#13 0x0000000000a6b519 in ZEND_CALL_TRAMPOLINE_SPEC_HANDLER () at
/home/zx/zx/php/php7new/php-src-PHP-7.0.13/Zend/zend_vm_execute.h:1788
#14 0x0000000000a67085 in execute_ex (ex=0x7fffed613030) at
/home/zx/zx/php/php7new/php-src-PHP-7.0.13/Zend/zend_vm_execute.h:414
#15 0x0000000000a67196 in zend_execute (op_array=0x7fffed684000, return_value=0x0) at
/home/zx/zx/php/php7new/php-src-PHP-7.0.13/Zend/zend_vm_execute.h:458
#16 0x0000000000a0812d in zend_execute_scripts (type=8, retval=0x0, file_count=3) at
/home/zx/zx/php/php7new/php-src-PHP-7.0.13/Zend/zend.c:1427
#17 0x00000000009701fc in php_execute_script (primary_file=0x7fffffffcaa0) at
/home/zx/zx/php/php7new/php-src-PHP-7.0.13/main/main.c:2494
#18 0x0000000000ad06dc in do_cli (argc=2, argv=0x141c670) at
/home/zx/zx/php/php7new/php-src-PHP-7.0.13/sapi/cli/php_cli.c:974
#19 0x0000000000ad18aa in main (argc=2, argv=0x141c670) at
/home/zx/zx/php/php7new/php-src-PHP-7.0.13/sapi/cli/php_cli.c:1344
(gdb) print i
$1 = -2147483647
(gdb)
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=73533&edit=1