Bug #80958 [Csd]: null dereference in setlocale
Edit report at https://bugs.php.net/bug.php?id=80958&edit=1
ID: 80958
User updated by: zengyhkyle at asu dot edu
Reported by: zengyhkyle at asu dot edu
Summary: null dereference in setlocale
Status: Closed
Type: Bug
Package: Reproducible crash
Operating System: Linux
PHP Version: 8.0.3
Assigned To: twosee
Block user comment: N
Private report: N
New Comment:
Will this get a cve? Since this is possible to get triggered remotely.
Previous Comments:
------------------------------------------------------------------------
[2021-04-16 08:22:36] git@php.net
Automatic comment on behalf of twose
Revision: https://github.com/php/php-src/commit/ecc4bf14f0e5681eb893e9ff2d8c021796abe188
Log: Fixed bug #80958
------------------------------------------------------------------------
[2021-04-16 03:39:11] twosee@php.net
The following pull request has been associated:
Patch Name: Fixed bug #80958
On GitHub: https://github.com/php/php-src/pull/6871
Patch: https://github.com/php/php-src/pull/6871.patch
------------------------------------------------------------------------
[2021-04-15 22:27:44] zengyhkyle at asu dot edu
Description:
------------
In current implementation, setlocale does not handle non-primitive types correctly.
if the second argument to setlocal is not a primitive type, zval_try_get_string returns NULL and
crashes try_setlocale_str during strcmp.
potentially, it can be used to DOS a remote server.
This bug is found by Yihui Zeng, Jayakrishna Menon, Steven Wirsz, and Gokul Krishna P from Arizona
State University for class CSE598 Applied Vulnerability Research.
a poc is attached
Test script:
---------------
<?php
$a = xml_parser_create( );
setlocale(0, $a);
?>
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=80958&edit=1
Thread (6 messages)