Bug #80958 [Ver->Csd]: null dereference in setlocale

Edit report at https://bugs.php.net/bug.php?id=80958&edit=1 ID: 80958 Updated by: git@php.net Reported by: zengyhkyle at asu dot edu Summary: null dereference in setlocale -Status: Verified +Status: Closed Type: Bug Package: Reproducible crash Operating System: Linux PHP Version: 8.0.3 Assigned To: twosee Block user comment: N Private report: N New Comment: Automatic comment on behalf of twose Revision: https://github.com/php/php-src/commit/ecc4bf14f0e5681eb893e9ff2d8c021796abe188 Log: Fixed bug #80958 Previous Comments: ------------------------------------------------------------------------ [2021-04-16 03:39:11] twosee@php.net The following pull request has been associated: Patch Name: Fixed bug #80958 On GitHub: https://github.com/php/php-src/pull/6871 Patch: https://github.com/php/php-src/pull/6871.patch ------------------------------------------------------------------------ [2021-04-15 22:27:44] zengyhkyle at asu dot edu Description: ------------ In current implementation, setlocale does not handle non-primitive types correctly. if the second argument to setlocal is not a primitive type, zval_try_get_string returns NULL and crashes try_setlocale_str during strcmp. potentially, it can be used to DOS a remote server. This bug is found by Yihui Zeng, Jayakrishna Menon, Steven Wirsz, and Gokul Krishna P from Arizona State University for class CSE598 Applied Vulnerability Research. a poc is attached Test script: --------------- <?php $a = xml_parser_create( ); setlocale(0, $a); ?> ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=80958&edit=1