php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #80183 Stack Overflow in zend_try_compile_cv
Submitted: 2020-10-04 03:19 UTC Modified: 2020-10-05 09:05 UTC
From: m dot aldofirmansyah at gmail dot com Assigned:
Status: Not a bug Package: Scripting Engine problem
PHP Version: 8.0.0rc1 OS: Ubuntu 16.04.1
Private report: No CVE-ID: None
View Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
If you reported this bug, you can edit this bug over here.
(description)
Block user comment
Status: Assign to:
Package:
Bug Type:
Summary:
From: m dot aldofirmansyah at gmail dot com
New email:
PHP Version: OS:

 

 [2020-10-04 03:19 UTC] m dot aldofirmansyah at gmail dot com 
Description:
------------
When fuzzing I found crashes, here is one of them

And here is the crash summary using crashwalk and exploitable, with ASAN_OPTIONS="abort_on_error=1:symbolize=0"

---CRASH SUMMARY---
Filename: /root/fuzzing-crash-file/php/crash/id:000010,sig:06,src:007382,op:havoc,rep:16
SHA1: 65a6543bc15dc15f6ecaa6444d1c8b1eac649822
Classification: EXPLOITABLE
Hash: c6369cca9f5b474eb58f64460df8222e.69512d8e0fd694d7e12e80288baeaca8
Command: /root/php/SRC/build/bin/php /root/fuzzing-crash-file/php/crash/id:000010,sig:06,src:007382,op:havoc,rep:16
Faulting Frame:
   zend_try_compile_cv @ 0x0000000001e4d36c: in /root/php/SRC/build/bin/php
Disassembly:
Stack Head (1000 entries):
   zend_try_compile_cv       @ 0x0000000001e4d36c: in /root/php/SRC/build/bin/php
   zend_compile_simple_var   @ 0x0000000001ee7048: in /root/php/SRC/build/bin/php
   zend_compile_var_inner    @ 0x0000000001ee6710: in /root/php/SRC/build/bin/php
   zend_compile_var          @ 0x0000000001e4f754: in /root/php/SRC/build/bin/php
   zend_compile_expr_inner   @ 0x0000000001ee4a72: in /root/php/SRC/build/bin/php
   zend_compile_expr         @ 0x0000000001e44cbc: in /root/php/SRC/build/bin/php
   zend_compile_simple_var_n @ 0x0000000001e4d740: in /root/php/SRC/build/bin/php
   zend_compile_simple_var   @ 0x0000000001ee70a5: in /root/php/SRC/build/bin/php
   zend_compile_var_inner    @ 0x0000000001ee6710: in /root/php/SRC/build/bin/php
   zend_compile_var          @ 0x0000000001e4f754: in /root/php/SRC/build/bin/php
   zend_compile_expr_inner   @ 0x0000000001ee4a72: in /root/php/SRC/build/bin/php
   zend_compile_expr         @ 0x0000000001e44cbc: in /root/php/SRC/build/bin/php
   zend_compile_simple_var_n @ 0x0000000001e4d740: in /root/php/SRC/build/bin/php
   zend_compile_simple_var   @ 0x0000000001ee70a5: in /root/php/SRC/build/bin/php
   zend_compile_var_inner    @ 0x0000000001ee6710: in /root/php/SRC/build/bin/php
   zend_compile_var          @ 0x0000000001e4f754: in /root/php/SRC/build/bin/php
Registers:
rax=0x00007ffd9f7b7040 rbx=0x00000ff39e018274 rcx=0x00007ffd9f7b6fe0 rdx=0x00000000049806c0 
rsi=0x00000ff39e01828f rdi=0x00007ffd9f7b7000 rbp=0x00007ffd9f7b70f0 rsp=0x00007ffd9f7b6fe0 
 r8=0x00007ffd9f7b6ff0  r9=0x00007ffd9f7b6fe0 r10=0x00007ffd9f7b76e0 r11=0x00007f9cf00c1398 
r12=0x00000ff39e018200 r13=0x0000000000000018 r14=0x00007f9cf00c1398 r15=0x0000000004974188 
rip=0x0000000001e4d36c efl=0x0000000000010282  cs=0x0000000000000033  ss=0x000000000000002b 
 ds=0x0000000000000000  es=0x0000000000000000  fs=0x0000000000000000  gs=0x0000000000000000 
Extra Data:
   Description: Possible stack corruption
   Short description: PossibleStackCorruption (7/22)
   Explanation: GDB generated an error while unwinding the stack and/or the stack contained return addresses that were not mapped in the inferior's process address space and/o
r the stack pointer is pointing to a location outside the default stack region. These conditions likely indicate stack corruption, which is generally considered exploitable.
---END SUMMARY---

Test script:
---------------
https://gist.github.com/TheCrott/2b0b159f5965b30f5706b78bf4596f5a/raw/1d771d62773335499aec06145d295260e77d79aa/poc3.php

Actual result:
--------------
I don't know how to run this file as it return error

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2020-10-04 03:25 UTC] stas@php.net
-Type: Security +Type: Bug -Package: Unknown/Other Function +Package: Scripting Engine problem
 [2020-10-05 09:05 UTC] nikic@php.net
-Status: Open +Status: Not a bug
 [2020-10-05 09:05 UTC] nikic@php.net 
Test script look like a hex dump with lots of \x24 in a row, aka $. This is compiler stack overflow from a deeply nested AST, and as such uninteresting.
 [2020-10-05 10:27 UTC] cmb@php.net 
Related To: Bug #80182
 [2020-10-05 10:28 UTC] cmb@php.net 
Related To: Bug #80181
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved. 		Last updated: Sun Dec 22 01:01:30 2024 UTC