Bug #80958 [Opn->Ver]: null dereference in setlocale

From: Date: Fri, 16 Apr 2021 03:38:44 +0000
Subject: Bug #80958 [Opn->Ver]: null dereference in setlocale
References: 1  Groups: php.bugs 
Request: Send a blank email to php-bugs+get-233451@lists.php.net to get a copy of this message 
Edit report at https://bugs.php.net/bug.php?id=80958&edit=1

 ID:                 80958
 Updated by:         twosee@php.net
 Reported by:        zengyhkyle at asu dot edu
 Summary:            null dereference in setlocale
-Status:             Open
+Status:             Verified
 Type:               Bug
 Package:            Reproducible crash
 Operating System:   Linux
 PHP Version:        8.0.3
 Block user comment: N
 Private report:     N



Previous Comments:
------------------------------------------------------------------------
[2021-04-15 22:27:44] zengyhkyle at asu dot edu

Description:
------------
In current implementation, setlocale does not handle non-primitive types correctly.
if the second argument to setlocal is not a primitive type, zval_try_get_string returns NULL and
crashes try_setlocale_str during strcmp.

potentially, it can be used to DOS a remote server.

This bug is found by Yihui Zeng, Jayakrishna Menon, Steven Wirsz, and Gokul Krishna P from Arizona
State University for class CSE598 Applied Vulnerability Research.

a poc is attached

Test script:
---------------
<?php
$a = xml_parser_create( );
setlocale(0, $a);
?>



------------------------------------------------------------------------



--
Edit this bug report at https://bugs.php.net/bug.php?id=80958&edit=1

Thread (6 messages)

« previous php.bugs (#233451) next »