Description:
------------
While fuzzing PHP 7.0.0-dev (cli) (built: Jul 12 2015 03:27:06) I came across a script that causes a segfault (and possible stack corruption) in zend_call_function (zend_execute_API.c:696). It also appears to affect PHP 5.4.41-0+deb7u1 (cli) (built: May 22 2015 12:49:18).



Test script:
---------------
<?php
class wp0{private$d;function __get($e){$wp0=new wp0;$wp0->e;}}function c(){(0);}$wp0=new wp0;$wp0->i;

Expected result:
----------------
No crash.

Actual result:
--------------
==12935== Stack overflow in thread 1: can't grow stack to 0x7fe801fe8
==12935==
==12935== Process terminating with default action of signal 11 (SIGSEGV)
==12935==  Access not within mapped region at address 0x7FE801FE8
==12935==    at 0x1622978: zend_call_method (zend_interfaces.c:43)
==12935==  If you believe this happened as a result of a stack
==12935==  overflow in your program's main thread (unlikely but
==12935==  possible), you can try to increase the size of the
==12935==  main thread stack using the --main-stacksize= flag.
==12935==  The main thread stack size used in this run was 8388608.
==12935== Stack overflow in thread 1: can't grow stack to 0x7fe801fe0
==12935==
==12935== Process terminating with default action of signal 11 (SIGSEGV)
==12935==  Access not within mapped region at address 0x7FE801FE0
==12935==    at 0x4A226E0: _vgnU_freeres (vg_preloaded.c:58)
==12935==  If you believe this happened as a result of a stack
==12935==  overflow in your program's main thread (unlikely but
==12935==  possible), you can try to increase the size of the
==12935==  main thread stack using the --main-stacksize= flag.
==12935==  The main thread stack size used in this run was 8388608.
Segmentation fault

Starting program: /home/geeknik/php-src/sapi/cli/php test00-min
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".

Program received signal SIGSEGV, Segmentation fault.
0x00000000014d38f8 in zend_call_function (fci=0x7fffff7ff180,
    fci_cache=0x7fffff7ff150)
    at /home/geeknik/php-src/Zend/zend_execute_API.c:696
696             if (!EG(active)) {
(gdb) bt
#0  0x00000000014d38f8 in zend_call_function (fci=0x7fffff7ff180,
    fci_cache=0x7fffff7ff150)
    at /home/geeknik/php-src/Zend/zend_execute_API.c:696
#1  0x0000000065675f00 in ?? ()
#2  0x00007ffff5b04660 in ?? ()
#3  0x00007fffff7ff1d0 in ?? ()
#4  0x00007fffff7ff1d0 in ?? ()
#5  0x0000000000000000 in ?? ()
(gdb) i r
rax            0x7ffff5ab2dd0   140737315024336
rbx            0x7fffff7ff2a0   140737479963296
rcx            0x7ffff5b04660   140737315358304
rdx            0x65675f00       1701273344
rsi            0x7fffff7ff150   140737479962960
rdi            0x7fffff7ff180   140737479963008
rbp            0x1      0x1
rsp            0x7fffff7fef78   0x7fffff7fef78
r8             0x5      5
r9             0x7ffff6003118   140737320595736
r10            0x7ffff6003230   140737320596016
r11            0x5      5
r12            0x7fffff7ff180   140737479963008
r13            0x2056ba0        33909664
r14            0x0      0
r15            0x7ffff6003018   140737320595480
rip            0x14d38f8        0x14d38f8 <zend_call_function+136>
eflags         0x10202  [ IF RF ]
cs             0x33     51
ss             0x2b     43
ds             0x0      0
es             0x0      0
fs             0x0      0
gs             0x0      0
(gdb) exploitable
Description: Possible stack corruption
Short description: PossibleStackCorruption (7/22)
Hash: fdacf7bfdade269be71df9a402726823.9a75f6ab0bd3a6de69a05282ade5ee5d
Exploitability Classification: EXPLOITABLE
Explanation: GDB generated an error while unwinding the stack and/or the stack contained return addresses that were not mapped in the inferior's process address space and/or the stack pointer is pointing to a location outside the default stack region. These conditions likely indicate stack corruption, which is generally considered exploitable.
Other tags: DestAv (8/22), AccessViolation (21/22)