[php-src] Issue #15257: OVERFLOW_AFTER_CHECK in sljitNativeX86_common.c
| From: | ellena13 | Date: | Tue, 06 Aug 2024 15:10:22 +0000 |
| Subject: | [php-src] Issue #15257: OVERFLOW_AFTER_CHECK in sljitNativeX86_common.c | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-247445@lists.php.net to get a copy of this message | ||
Issue: https://github.com/php/php-src/issues/15257
Author: ellena13
### Description
The static analyzer has detected OVERFLOW\_AFTER\_CHECK: the checker OVERFLOW\_AFTER\_CHECK finds
situations where first, a variable is compared to some value, indicating what the possible values of
the variable are, and then it’s used to access a buffer in such a way that one of the possible
values indicated by the check lies out of bounds.
_dst\_r_ (at sljitNativeX86_common.c:1790) is used as an index _dst_ for accessing an array's
element in function _emit\_mov_ (at sljitNativeX86_common.c:919).
https://github.com/php/php-src/blob/ca84662c8798ce96dc2dffc7562b2c0d96c1a6f3/ext/pcre/pcre2lib/sljit/sljitNativeX86_common.c#L1788-L1793
https://github.com/php/php-src/blob/ca84662c8798ce96dc2dffc7562b2c0d96c1a6f3/ext/pcre/pcre2lib/sljit/sljitNativeX86_common.c#L911-L919C
_dst\_r_ can have value _17 and other <63_, which is out of range
https://github.com/php/php-src/blob/ca84662c8798ce96dc2dffc7562b2c0d96c1a6f3/ext/pcre/pcre2lib/sljit/sljitNativeX86_common.c#L1773
Here we found _TMP\_REG1_ and _reg\_map[17]_
https://github.com/php/php-src/blob/6713d516319074bc2481b8e7db82b10841c230f7/ext/pcre/pcre2lib/sljit/sljitNativeX86_common.c#L92-L102
Here we found _FAST\_IS\_REG_
https://github.com/php/php-src/blob/6713d516319074bc2481b8e7db82b10841c230f7/ext/pcre/pcre2lib/sljit/sljitLir.c#L124-L130
Found by Linux Verification Center (portal.linuxtesting.ru) with SVACE.
Author E. Bykhanova (e.bykhanova@fobos-nt.ru).
### PHP Version
PHP 8.2
### Operating System
_No response_