Edit report at https://bugs.php.net/bug.php?id=74960&edit=1
ID: 74960
Patch added by: cmb@php.net
Reported by: zhihua dot yao at dbappsecurity dot com dot cn
Summary: Heap buffer overflow via str_repeat
Status: Verified
Type: Bug
Package: Reproducible crash
PHP Version: 7.1.7
Assigned To: cmb
Block user comment: N
Private report: N
New Comment:
The following pull request has been associated:
Patch Name: Fix #74960: Heap buffer overflow via str_repeat
On GitHub: https://github.com/php/php-src/pull/7294
Patch: https://github.com/php/php-src/pull/7294.patch
Previous Comments:
------------------------------------------------------------------------
[2021-07-21 09:51:49] cmb@php.net
The following pull request has been associated:
Patch Name: Fix #74960: Integer overflow in zend_string_alloc()
On GitHub: https://github.com/php/php-src/pull/7252
Patch: https://github.com/php/php-src/pull/7252.patch
------------------------------------------------------------------------
[2021-07-16 15:45:19] cmb@php.net
See <https://bugs.php.net/75934#1524924818>.
------------------------------------------------------------------------
[2017-07-21 06:04:55] zhihua dot yao at dbappsecurity dot com dot cn
test script
<?php
ini_set("memory_limit",-1);
$str=str_repeat("A",0x7ffffff2);
$str.=$str;
?>
_____________________________
[----------------------------------registers-----------------------------------]
EAX: 0x80201000 ('A' <repeats 200 times>...)
EBX: 0x84efff0 (<concat_function>: push ebp)
ECX: 0x36a00000 --> 0x1
EDX: 0x36a00000 --> 0x1
ESI: 0xb6e14020 --> 0xb6e7c0fc --> 0x859b7ab
(<ZEND_ASSIGN_CONCAT_SPEC_CV_CV_HANDLER>: push ebp)
EDI: 0xb6e7c0fc --> 0x859b7ab (<ZEND_ASSIGN_CONCAT_SPEC_CV_CV_HANDLER>: push ebp)
EBP: 0xbfffb9f8 --> 0xbfffba38 --> 0xbfffba68 --> 0xbfffbae8 --> 0xbfffbb38 -->
0xbfffbb48 (--> ...)
ESP: 0xbfffb980 --> 0xb6e00040 --> 0x0
EIP: 0x84c70ed (<zend_mm_realloc_heap+1785>: mov eax,DWORD PTR [ebp+0x24])
EFLAGS: 0x200287 (CARRY PARITY adjust zero SIGN trap INTERRUPT direction overflow)
[-------------------------------------code-------------------------------------]
0x84c70e1 <zend_mm_realloc_heap+1773>: mov eax,DWORD PTR [ebp+0x8]
0x84c70e4 <zend_mm_realloc_heap+1776>: mov eax,DWORD PTR [eax+0x8c]
0x84c70ea <zend_mm_realloc_heap+1782>: mov DWORD PTR [ebp-0x10],eax
=> 0x84c70ed <zend_mm_realloc_heap+1785>: mov eax,DWORD PTR [ebp+0x24]
0x84c70f0 <zend_mm_realloc_heap+1788>: mov DWORD PTR [esp+0x14],eax
0x84c70f4 <zend_mm_realloc_heap+1792>: mov eax,DWORD PTR [ebp+0x20]
0x84c70f7 <zend_mm_realloc_heap+1795>: mov DWORD PTR [esp+0x10],eax
0x84c70fb <zend_mm_realloc_heap+1799>: mov eax,DWORD PTR [ebp+0x1c]
[------------------------------------stack-------------------------------------]
0000| 0xbfffb980 --> 0xb6e00040 --> 0x0
0004| 0xbfffb984 --> 0x36a00000 --> 0x1
0008| 0xbfffb988 --> 0x8b73aa0 ("/home/hjy/Desktop/php-7.1.7/Zend/zend_string.h")
0012| 0xbfffb98c --> 0xd0
0016| 0xbfffb990 --> 0x0
0020| 0xbfffb994 --> 0x0
0024| 0xbfffb998 --> 0x80001000 ('A' <repeats 200 times>...)
0028| 0xbfffb99c --> 0x80000006 ('A' <repeats 200 times>...)
[------------------------------------------------------------------------------]
Legend: code, data, rodata, value
Breakpoint 1, zend_mm_realloc_heap (heap=0xb6e00040, ptr=0x36a00000, size=0xc,
copy_size=0xfffffff8,
__zend_filename=0x8b73aa0 "/home/hjy/Desktop/php-7.1.7/Zend/zend_string.h",
__zend_lineno=0xd0, __zend_orig_filename=0x0, __zend_orig_lineno=0x0)
at /home/hjy/Desktop/php-7.1.7/Zend/zend_alloc.c:1610
1610 ret = zend_mm_alloc_heap(heap, size ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
gdb-peda$ p/x size
$1 = 0xc
gdb-peda$ n
[----------------------------------registers-----------------------------------]
EAX: 0xb6e5d060 --> 0xb6e5d080 --> 0xb6e5d0a0 --> 0xb6e5d0c0 --> 0xb6e5d0e0 -->
0xb6e5d100 (--> ...)
EBX: 0x84efff0 (<concat_function>: push ebp)
ECX: 0x7
EDX: 0x0
ESI: 0xb6e14020 --> 0xb6e7c0fc --> 0x859b7ab
(<ZEND_ASSIGN_CONCAT_SPEC_CV_CV_HANDLER>: push ebp)
EDI: 0xb6e7c0fc --> 0x859b7ab (<ZEND_ASSIGN_CONCAT_SPEC_CV_CV_HANDLER>: push ebp)
EBP: 0xbfffb9f8 --> 0xbfffba38 --> 0xbfffba68 --> 0xbfffbae8 --> 0xbfffbb38 -->
0xbfffbb48 (--> ...)
ESP: 0xbfffb980 --> 0xb6e00040 --> 0x0
EIP: 0x84c711e (<zend_mm_realloc_heap+1834>: mov eax,DWORD PTR [ebp-0x58])
EFLAGS: 0x200286 (carry PARITY adjust zero SIGN trap INTERRUPT direction overflow)
[-------------------------------------code-------------------------------------]
0x84c7113 <zend_mm_realloc_heap+1823>: mov DWORD PTR [esp],eax
0x84c7116 <zend_mm_realloc_heap+1826>:
call 0x84c6674 <zend_mm_alloc_heap>
0x84c711b <zend_mm_realloc_heap+1831>: mov DWORD PTR [ebp-0xc],eax
=> 0x84c711e <zend_mm_realloc_heap+1834>: mov eax,DWORD PTR [ebp-0x58]
0x84c7121 <zend_mm_realloc_heap+1837>: cmp DWORD PTR [ebp+0x14],eax
0x84c7124 <zend_mm_realloc_heap+1840>: cmovbe eax,DWORD PTR [ebp+0x14]
0x84c7128 <zend_mm_realloc_heap+1844>: mov DWORD PTR [esp+0x8],eax
0x84c712c <zend_mm_realloc_heap+1848>: mov eax,DWORD PTR [ebp+0xc]
[------------------------------------stack-------------------------------------]
0000| 0xbfffb980 --> 0xb6e00040 --> 0x0
0004| 0xbfffb984 --> 0x20 (' ')
0008| 0xbfffb988 --> 0x8b73aa0 ("/home/hjy/Desktop/php-7.1.7/Zend/zend_string.h")
0012| 0xbfffb98c --> 0xd0
0016| 0xbfffb990 --> 0x0
0020| 0xbfffb994 --> 0x0
0024| 0xbfffb998 --> 0x80001000 ('A' <repeats 200 times>...)
0028| 0xbfffb99c --> 0x80000006 ('A' <repeats 200 times>...)
[------------------------------------------------------------------------------]
Legend: code, data, rodata, value
1611 memcpy(ret, ptr, MIN(old_size, copy_size));
gdb-peda$ p/x old_size
$2 = 0x80001000
gdb-peda$ p/x copy_size
$2 = 0xfffffff8
gdb-peda$ n
Program received signal SIGSEGV, Segmentation fault.
[----------------------------------registers-----------------------------------]
EAX: 0x36ba3020 ('A' <repeats 200 times>...)
EBX: 0xb7a8b000 --> 0x1aada8
ECX: 0x7fe5df60 ('A' <repeats 200 times>...)
EDX: 0xb7000000
ESI: 0xb6e14020 --> 0xb6e7c0fc ('A' <repeats 200 times>...)
EDI: 0xb6e7c0fc ('A' <repeats 200 times>...)
EBP: 0xbfffb9f8 --> 0xbfffba38 --> 0xbfffba68 --> 0xbfffbae8 --> 0xbfffbb38 -->
0xbfffbb48 (--> ...)
ESP: 0xbfffb978 --> 0x84efff0 (<concat_function>: push ebp)
EIP: 0xb7a14fe9 (<__memcpy_ssse3_rep+3481>: movntdq XMMWORD PTR [edx],xmm0)
EFLAGS: 0x210206 (carry PARITY adjust zero sign trap INTERRUPT direction overflow)
[-------------------------------------code-------------------------------------]
0xb7a14fda <__memcpy_ssse3_rep+3466>: lea eax,[eax+0x80]
0xb7a14fe0 <__memcpy_ssse3_rep+3472>: lfence
0xb7a14fe3 <__memcpy_ssse3_rep+3475>: sub ecx,0x80
=> 0xb7a14fe9 <__memcpy_ssse3_rep+3481>: movntdq XMMWORD PTR [edx],xmm0
0xb7a14fed <__memcpy_ssse3_rep+3485>:
movntdq XMMWORD PTR [edx+0x10],xmm1
0xb7a14ff2 <__memcpy_ssse3_rep+3490>:
movntdq XMMWORD PTR [edx+0x20],xmm2
0xb7a14ff7 <__memcpy_ssse3_rep+3495>:
movntdq XMMWORD PTR [edx+0x30],xmm3
0xb7a14ffc <__memcpy_ssse3_rep+3500>:
movntdq XMMWORD PTR [edx+0x40],xmm4
[------------------------------------stack-------------------------------------]
0000| 0xbfffb978 --> 0x84efff0 (<concat_function>: push ebp)
0004| 0xbfffb97c --> 0x84c713e (<zend_mm_realloc_heap+1866>: mov eax,DWORD PTR
[ebp+0x24])
0008| 0xbfffb980 --> 0xb6e5d060 --> 0x1
0012| 0xbfffb984 --> 0x36a00000 --> 0x1
0016| 0xbfffb988 --> 0x80001000 ('A' <repeats 200 times>...)
0020| 0xbfffb98c --> 0xd0
0024| 0xbfffb990 --> 0x0
0028| 0xbfffb994 --> 0x0
[------------------------------------------------------------------------------]
Legend: code, data, rodata, value
Stopped reason: SIGSEGV
__memcpy_ssse3_rep () at ../sysdeps/i386/i686/multiarch/memcpy-ssse3-rep.S:1294
1294 ../sysdeps/i386/i686/multiarch/memcpy-ssse3-rep.S: No such file or directory.
gdb-peda$ bt
#0 __memcpy_ssse3_rep ()
at ../sysdeps/i386/i686/multiarch/memcpy-ssse3-rep.S:1294
#1 0x084c713e in zend_mm_realloc_heap (heap=0xb6e00040, ptr=0x36a00000,
size=0xc, copy_size=0xfffffff8,
__zend_filename=0x8b73aa0 "/home/hjy/Desktop/php-7.1.7/Zend/zend_string.h",
__zend_lineno=0xd0, __zend_orig_filename=0x0, __zend_orig_lineno=0x0)
at /home/hjy/Desktop/php-7.1.7/Zend/zend_alloc.c:1611
#2 0x084c8bcd in _erealloc (ptr=0x36a00000, size=0xfffffff8,
__zend_filename=0x8b73aa0 "/home/hjy/Desktop/php-7.1.7/Zend/zend_string.h",
__zend_lineno=0xd0, __zend_orig_filename=0x0, __zend_orig_lineno=0x0)
at /home/hjy/Desktop/php-7.1.7/Zend/zend_alloc.c:2446
#3 0x084e774f in zend_string_extend (s=0x36a00000, len=0xffffffe4,
persistent=0x0) at /home/hjy/Desktop/php-7.1.7/Zend/zend_string.h:208
#4 0x084f04ba in concat_function (result=0xb6e14050, op1=0xb6e14050,
op2=0xb6e14050) at /home/hjy/Desktop/php-7.1.7/Zend/zend_operators.c:1759
#5 0x0859b599 in zend_binary_assign_op_helper_SPEC_CV_CV (
binary_op=0x84efff0 <concat_function>)
at /home/hjy/Desktop/php-7.1.7/Zend/zend_vm_execute.h:44196
#6 0x0859b7bb in ZEND_ASSIGN_CONCAT_SPEC_CV_CV_HANDLER ()
at /home/hjy/Desktop/php-7.1.7/Zend/zend_vm_execute.h:44613
#7 0x08548973 in execute_ex (ex=0xb6e14020)
at /home/hjy/Desktop/php-7.1.7/Zend/zend_vm_execute.h:429
#8 0x08548a36 in zend_execute (op_array=0xb6e6c1e0, return_value=0x0)
at /home/hjy/Desktop/php-7.1.7/Zend/zend_vm_execute.h:474
#9 0x084f74a1 in zend_execute_scripts (type=0x8, retval=0x0, file_count=0x3)
at /home/hjy/Desktop/php-7.1.7/Zend/zend.c:1476
#10 0x08479d1f in php_execute_script (primary_file=0xbfffdeb4)
at /home/hjy/Desktop/php-7.1.7/main/main.c:2537
#11 0x085b9dbe in do_cli (argc=0x3, argv=0x8c4d068)
at /home/hjy/Desktop/php-7.1.7/sapi/cli/php_cli.c:993
#12 0x085bac75 in main (argc=0x3, argv=0x8c4d068)
at /home/hjy/Desktop/php-7.1.7/sapi/cli/php_cli.c:1381
#13 0xb78f9a83 in __libc_start_main (main=0x85ba68d <main>, argc=0x3,
argv=0xbffff154, init=0x85c3cd0 <__libc_csu_init>,
fini=0x85c3d40 <__libc_csu_fini>, rtld_fini=0xb7fed180 <_dl_fini>,
stack_end=0xbffff14c) at libc-start.c:287
#14 0x08070f21 in _start ()
The heap size is 0xc.Then old_size and copy_size are bigger than heap size.
------------------------------------------------------------------------
[2017-07-21 04:58:59] zhihua dot yao at dbappsecurity dot com dot cn
Program received signal SIGSEGV, Segmentation fault.
[----------------------------------registers-----------------------------------]
EAX: 0xb6e5f981 --> 0x0
EBX: 0xb7a8b000 --> 0x1aada8
ECX: 0x7ffffff6
EDX: 0x36e5f980
ESI: 0x36e5f977
EDI: 0xb6e5f981 --> 0x0
EBP: 0xbfffbae8 --> 0xbfffbb38 --> 0xbfffbb48 --> 0xbfffbb68 --> 0xbfffbba8 -->
0xbfffbbd8 (--> ...)
ESP: 0xbfffba60 --> 0xb6e14020 --> 0xb6e7c0fc --> 0x859b7ab
(<ZEND_ASSIGN_CONCAT_SPEC_CV_CV_HANDLER>: push ebp)
EIP: 0xb7a14f84 (<__memcpy_ssse3_rep+3380>: movdqu XMMWORD PTR [esi],xmm0)
EFLAGS: 0x210206 (carry PARITY adjust zero sign trap INTERRUPT direction overflow)
[-------------------------------------code-------------------------------------]
0xb7a14f77 <__memcpy_ssse3_rep+3367>: mov esi,esi
0xb7a14f79 <__memcpy_ssse3_rep+3369>: lea edi,[edi+eiz*1+0x0]
0xb7a14f80 <__memcpy_ssse3_rep+3376>: movdqu xmm1,XMMWORD PTR [eax]
=> 0xb7a14f84 <__memcpy_ssse3_rep+3380>: movdqu XMMWORD PTR [esi],xmm0
0xb7a14f88 <__memcpy_ssse3_rep+3384>: movntdq XMMWORD PTR [edx],xmm1
0xb7a14f8c <__memcpy_ssse3_rep+3388>: add eax,0x10
0xb7a14f8f <__memcpy_ssse3_rep+3391>: add edx,0x10
0xb7a14f92 <__memcpy_ssse3_rep+3394>: sub ecx,0x10
[------------------------------------stack-------------------------------------]
0000| 0xbfffba60 --> 0xb6e14020 --> 0xb6e7c0fc --> 0x859b7ab
(<ZEND_ASSIGN_CONCAT_SPEC_CV_CV_HANDLER>: push ebp)
0004| 0xbfffba64 --> 0xb6e7c0fc --> 0x859b7ab
(<ZEND_ASSIGN_CONCAT_SPEC_CV_CV_HANDLER>: push ebp)
0008| 0xbfffba68 --> 0x84efff0 (<concat_function>: push ebp)
0012| 0xbfffba6c --> 0x84f055d (<concat_function+1389>: mov edx,DWORD PTR [ebp-0x4c])
0016| 0xbfffba70 --> 0x36e5f977
0020| 0xbfffba74 --> 0xb6e5f978 --> 0x0
0024| 0xbfffba78 --> 0x7fffffff
0028| 0xbfffba7c --> 0x83a5df6 (<zend_string_safe_alloc+153>: mov eax,DWORD PTR
[ebp+0x8])
[------------------------------------------------------------------------------]
Legend: code, data, rodata, value
Stopped reason: SIGSEGV
__memcpy_ssse3_rep () at ../sysdeps/i386/i686/multiarch/memcpy-ssse3-rep.S:1269
1269 ../sysdeps/i386/i686/multiarch/memcpy-ssse3-rep.S: No such file or directory.
gdb-peda$ bt
#0 __memcpy_ssse3_rep ()
at ../sysdeps/i386/i686/multiarch/memcpy-ssse3-rep.S:1269
#1 0x084f055d in concat_function (result=0xb6e14050, op1=0xb6e14050,
op2=0xb6e14050) at /home/hjy/Desktop/php-7.1.7/Zend/zend_operators.c:1773
#2 0x0859b599 in zend_binary_assign_op_helper_SPEC_CV_CV (
binary_op=0x84efff0 <concat_function>)
at /home/hjy/Desktop/php-7.1.7/Zend/zend_vm_execute.h:44196
#3 0x0859b7bb in ZEND_ASSIGN_CONCAT_SPEC_CV_CV_HANDLER ()
at /home/hjy/Desktop/php-7.1.7/Zend/zend_vm_execute.h:44613
#4 0x08548973 in execute_ex (ex=0xb6e14020)
at /home/hjy/Desktop/php-7.1.7/Zend/zend_vm_execute.h:429
#5 0x08548a36 in zend_execute (op_array=0xb6e6c1e0, return_value=0x0)
at /home/hjy/Desktop/php-7.1.7/Zend/zend_vm_execute.h:474
#6 0x084f74a1 in zend_execute_scripts (type=0x8, retval=0x0, file_count=0x3)
at /home/hjy/Desktop/php-7.1.7/Zend/zend.c:1476
#7 0x08479d1f in php_execute_script (primary_file=0xbfffdeb4)
at /home/hjy/Desktop/php-7.1.7/main/main.c:2537
#8 0x085b9dbe in do_cli (argc=0x3, argv=0x8c4d068)
at /home/hjy/Desktop/php-7.1.7/sapi/cli/php_cli.c:993
#9 0x085bac75 in main (argc=0x3, argv=0x8c4d068)
at /home/hjy/Desktop/php-7.1.7/sapi/cli/php_cli.c:1381
#10 0xb78f9a83 in __libc_start_main (main=0x85ba68d <main>, argc=0x3,
argv=0xbffff154, init=0x85c3cd0 <__libc_csu_init>,
fini=0x85c3d40 <__libc_csu_fini>, rtld_fini=0xb7fed180 <_dl_fini>,
stack_end=0xbffff14c) at libc-start.c:287
#11 0x08070f21 in _start ()
------------------------------------------------------------------------
The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
https://bugs.php.net/bug.php?id=74960
--
Edit this bug report at https://bugs.php.net/bug.php?id=74960&edit=1