Description:
------------
php 7.3.9 (tested with locally compiled build on CentOS 7) can be DoSed with serialized data, causing a stack overflow scenario [see below]. 
 


Test script:
---------------
<?php
$filehandle = fopen($argv[1], "r") or die("Unable to open file!");
$data = fread($filehandle,filesize($argv[1]));
fclose($filehandle);

$string = unserialize($data);
?>

Expected result:
----------------
No crash

Actual result:
--------------
php-7.3.9/sapi/cli/php sertest.php php_7_3_9_stack_overflow.ser 

 

Program received signal SIGSEGV, Segmentation fault.

php_var_unserialize_internal (rval=rval@entry=0x7fb2a70dd240, p=p@entry=0x7ffe3f34b120, max=max@entry=0x7fb2a833ad95 "", 

    var_hash=var_hash@entry=0x7ffe3f34b128, as_key=as_key@entry=0)

    at /php/linux_build/php-7.3.9/ext/standard/var_unserializer.c:1345

1345 zend_long elements = parse_iv(start + 2);

Missing separate debuginfos, use: debuginfo-install libxml2-2.9.1-6.el7_2.3.x86_64 xz-libs-5.2.2-1.el7.x86_64

(gdb) bt

#0  php_var_unserialize_internal (rval=rval@entry=0x7fb2a70dd240, p=p@entry=0x7ffe3f34b120, max=max@entry=0x7fb2a833ad95 "", 

    var_hash=var_hash@entry=0x7ffe3f34b128, as_key=as_key@entry=0)

    at php/linux_build/php-7.3.9/ext/standard/var_unserializer.c:1345

#1  0x00000000006ca221 in process_nested_data (objprops=0, elements=0, ht=0x7fb2a70df268, var_hash=0x7ffe3f34b128, max=0x7fb2a833ad95 "", 

    p=0x7ffe3f34b120, rval=0x7fb2a70dd240) at /php/linux_build/php-7.3.9/ext/standard/var_unserializer.c:502

#2  php_var_unserialize_internal (rval=rval@entry=0x7fb2a70dd100, p=p@entry=0x7ffe3f34b120, max=max@entry=0x7fb2a833ad95 "", 

    var_hash=var_hash@entry=0x7ffe3f34b128, as_key=as_key@entry=0)

    at /php/linux_build/php-7.3.9/ext/standard/var_unserializer.c:1370

#3  0x00000000006ca221 in process_nested_data (objprops=0, elements=0, ht=0x7fb2a70df230, var_hash=0x7ffe3f34b128, max=0x7fb2a833ad95 "", 

    p=0x7ffe3f34b120, rval=0x7fb2a70dd100) at /php/linux_build/php-7.3.9/ext/standard/var_unserializer.c:502

#4  php_var_unserialize_internal (rval=rval@entry=0x7fb2a70dcfc0, p=p@entry=0x7ffe3f34b120, max=max@entry=0x7fb2a833ad95 "", 

    var_hash=var_hash@entry=0x7ffe3f34b128, as_key=as_key@entry=0)

    at /php/linux_build/php-7.3.9/ext/standard/var_unserializer.c:1370

#5  0x00000000006ca221 in process_nested_data (objprops=0, elements=0, ht=0x7fb2a70df1f8, var_hash=0x7ffe3f34b128, max=0x7fb2a833ad95 "", 

    p=0x7ffe3f34b120, rval=0x7fb2a70dcfc0) at /php/linux_build/php-7.3.9/ext/standard/var_unserializer.c:502

#6  php_var_unserialize_internal (rval=rval@entry=0x7fb2a70dce80, p=p@entry=0x7ffe3f34b120, max=max@entry=0x7fb2a833ad95 "", 

    var_hash=var_hash@entry=0x7ffe3f34b128, as_key=as_key@entry=0)

    at /php/linux_build/php-7.3.9/ext/standard/var_unserializer.c:1370

#7  0x00000000006ca221 in process_nested_data (objprops=0, elements=0, ht=0x7fb2a70df1c0, var_hash=0x7ffe3f34b128, max=0x7fb2a833ad95 "", 

    p=0x7ffe3f34b120, rval=0x7fb2a70dce80) at /php/linux_build/php-7.3.9/ext/standard/var_unserializer.c:502

#8  php_var_unserialize_internal (rval=rval@entry=0x7fb2a70dcd40, p=p@entry=0x7ffe3f34b120, max=max@entry=0x7fb2a833ad95 "", 

    var_hash=var_hash@entry=0x7ffe3f34b128, as_key=as_key@entry=0)

    at /php/linux_build/php-7.3.9/ext/standard/var_unserializer.c:1370

#9  0x00000000006ca221 in process_nested_data (objprops=0, elements=0, ht=0x7fb2a70df188, var_hash=0x7ffe3f34b128, max=0x7fb2a833ad95 "", 

    p=0x7ffe3f34b120, rval=0x7fb2a70dcd40) at /php/linux_build/php-7.3.9/ext/standard/var_unserializer.c:502

#10 php_var_unserialize_internal (rval=rval@entry=0x7fb2a70dcc00, p=p@entry=0x7ffe3f34b120, max=max@entry=0x7fb2a833ad95 "", 

    var_hash=var_hash@entry=0x7ffe3f34b128, as_key=as_key@entry=0)

    at /php/linux_build/php-7.3.9/ext/standard/var_unserializer.c:1370

#11 0x00000000006ca221 in process_nested_data (objprops=0, elements=0, ht=0x7fb2a70df150, var_hash=0x7ffe3f34b128, max=0x7fb2a833ad95 "", 

    p=0x7ffe3f34b120, rval=0x7fb2a70dcc00) at /php/linux_build/php-7.3.9/ext/standard/var_unserializer.c:502

#12 php_var_unserialize_internal (rval=rval@entry=0x7fb2a70dcac0, p=p@entry=0x7ffe3f34b120, max=max@entry=0x7fb2a833ad95 "", 

    var_hash=var_hash@entry=0x7ffe3f34b128, as_key=as_key@entry=0)

    at /php/linux_build/php-7.3.9/ext/standard/var_unserializer.c:1370

#13 0x00000000006ca221 in process_nested_data (objprops=0, elements=0, ht=0x7fb2a70df118, var_hash=0x7ffe3f34b128, max=0x7fb2a833ad95 "", 

    p=0x7ffe3f34b120, rval=0x7fb2a70dcac0) at /php/linux_build/php-7.3.9/ext/standard/var_unserializer.c:502

#14 php_var_unserialize_internal (rval=rval@entry=0x7fb2a70dc980, p=p@entry=0x7ffe3f34b120, max=max@entry=0x7fb2a833ad95 "", 

    var_hash=var_hash@entry=0x7ffe3f34b128, as_key=as_key@entry=0)

    at /php/linux_build/php-7.3.9/ext/standard/var_unserializer.c:1370

#15 0x00000000006ca221 in process_nested_data (objprops=0, elements=0, ht=0x7fb2a70df0e0, var_hash=0x7ffe3f34b128, max=0x7fb2a833ad95 "", 

    p=0x7ffe3f34b120, rval=0x7fb2a70dc980) at /php/linux_build/php-7.3.9/ext/standard/var_unserializer.c:502

#16 php_var_unserialize_internal (rval=rval@entry=0x7fb2a70dc840, p=p@entry=0x7ffe3f34b120, max=max@entry=0x7fb2a833ad95 "", 

    var_hash=var_hash@entry=0x7ffe3f34b128, as_key=as_key@entry=0)

    at /php/linux_build/php-7.3.9/ext/standard/var_unserializer.c:1370

#17 0x00000000006ca221 in process_nested_data (objprops=0, elements=0, ht=0x7fb2a70df0a8, var_hash=0x7ffe3f34b128, max=0x7fb2a833ad95 "", 

    p=0x7ffe3f34b120, rval=0x7fb2a70dc840) at /php/linux_build/php-7.3.9/ext/standard/var_unserializer.c:502

---Type <return> to continue, or q <return> to quit---  q

Quit

(gdb) disass $pc-12,$pc+10

Dump of assembler code from 0x6ca14e to 0x6ca164:

   0x00000000006ca14e <php_var_unserialize_internal+2430>: jne    0x6c9928 <php_var_unserialize_internal+344>

   0x00000000006ca154 <php_var_unserialize_internal+2436>: xor    esi,esi

   0x00000000006ca156 <php_var_unserialize_internal+2438>: add    r12,0x3

=> 0x00000000006ca15a <php_var_unserialize_internal+2442>: call   0x42ca21 <parse_iv2>

   0x00000000006ca15f <php_var_unserialize_internal+2447>: test   rbx,rbx

   0x00000000006ca162 <php_var_unserialize_internal+2450>: mov    r13,rax

End of assembler dump.