Bug #80958 [NEW]: null dereference in setlocale

From: zengyhkyle at asu dot edu Operating system: Linux PHP version: 8.0.3 Package: Reproducible crash Bug Type: Bug Bug description:null dereference in setlocale Description: ------------ In current implementation, setlocale does not handle non-primitive types correctly. if the second argument to setlocal is not a primitive type, zval_try_get_string returns NULL and crashes try_setlocale_str during strcmp. potentially, it can be used to DOS a remote server. This bug is found by Yihui Zeng, Jayakrishna Menon, Steven Wirsz, and Gokul Krishna P from Arizona State University for class CSE598 Applied Vulnerability Research. a poc is attached Test script: --------------- <?php $a = xml_parser_create( ); setlocale(0, $a); ?> -- Edit bug report at https://bugs.php.net/bug.php?id=80958&edit=1 -- Fix committed: https://bugs.php.net/fix.php?id=80958&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=80958&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=80958&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=80958&r=needscript Try newer version: https://bugs.php.net/fix.php?id=80958&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=80958&r=support Expected behavior: https://bugs.php.net/fix.php?id=80958&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=80958&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=80958&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=80958&r=globals PHP version support discontinued: https://bugs.php.net/fix.php?id=80958&r=phptooold Daylight Savings: https://bugs.php.net/fix.php?id=80958&r=dst IIS Stability: https://bugs.php.net/fix.php?id=80958&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=80958&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=80958&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=80958&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=80958&r=mysqlcfg