Description:
------------
Zeros in the libmagic database lead to buffer overflows
=======================================================

Functions that use libmagic (mime_content_type, finfo_buffer, finfo_file) incorrectly parse the magic database leading to a buffer overflow.

Reason
------

https://github.com/php/php-src/blob/master/ext/fileinfo/libmagic.patch#L3386

PHP patches libmagic to use its own regex functions. For this, there's a function `convert_libmagic_pattern`:

Relevant code:

     1   t = zend_string_alloc(len * 2 + 4, 0);
     2  
     3   ZSTR_VAL(t)[j++] = '~';
     4
     5   for (i = 0; i < len; i++, j++) {
     6       switch (val[i]) {
     7           case '~':
     8               ZSTR_VAL(t)[j++] = '\\';
     9               ZSTR_VAL(t)[j] = '~';
    10              break;
    11          case '\0':
    12              ZSTR_VAL(t)[j++] = '\\';
    13              ZSTR_VAL(t)[j++] = 'x';
    14              ZSTR_VAL(t)[j++] = '0';
    15              ZSTR_VAL(t)[j] = '0';
    16              break;


Line (1) allocates 2 bytes for each input byte, but a 0 in the input is expressed with 4 bytes. This leads to the buffer overflow.

Impact
------

I guess only a few PHP programs allow a user to supply their own magic database. (I can only think of online PHP interpreters).

However, it is also possible to trigger a warning (and thus often an exception) by supplying a file type that already has a 0-byte in the bundled mime-database. This is the case for .dex files in the Ubuntu 18.04 default installation:

```
<?php
file_put_contents("dex_file.dex", "dex\n");
echo mime_content_type("dex_file.dex");
```

which gives

```
PHP Warning:  mime_content_type(): Null byte in regex in Standard input code on line 3
PHP Warning:  mime_content_type(): Failed identify data 0:(null) in Standard input code on line 3
```

Test script:
---------------
<?php

file_put_contents("magic_db", "
0	regex	\\0\\0\\0\\0	Test
");

$finfo = new finfo(FILEINFO_NONE, "magic_db");
echo $finfo->buffer("buffer\n");

Actual result:
--------------
segmentation fault or warning:

PHP Warning:  mime_content_type(): Null byte in regex in php shell code on line 1
PHP Warning:  mime_content_type(): Failed identify data 0:(null) in php shell code on line 1