|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
[2020-11-05 19:58 UTC] kak dot serpom dot po dot yaitsam at gmail dot com
Description: ------------ It crashes only with xdebug enabled on PHP 7.3.24-3+ubuntu18.04.1+deb.sury.org+1 If I replace anonymous functions with regular functions or methods (like [$this, 'callbackEnv']) then php_yaml_check_callbacks (https://github.com/php/pecl-file_formats-yaml/blob/2.1.0/yaml.c#L305) doesn't crash. Test script: --------------- $data = \yaml_parse_file( $file, 0, $ndocs, [ '!env' => function ($str) { }, '!path' => function ($str) { }, ] ); Expected result: ---------------- No segfault :) Actual result: -------------- Program terminated with signal SIGSEGV, Segmentation fault. #0 php_yaml_check_callbacks (callbacks=<optimized out>, callbacks=<optimized out>) at /tmp/pear/temp/yaml/yaml.c:305 305 /tmp/pear/temp/yaml/yaml.c: No such file or directory. (gdb) bt #0 php_yaml_check_callbacks (callbacks=<optimized out>, callbacks=<optimized out>) at /tmp/pear/temp/yaml/yaml.c:305 #1 0x00007f9fa33dd0b4 in zif_yaml_parse_file (execute_data=<optimized out>, return_value=0x7f9fb5a1eac0) at /tmp/pear/temp/yaml/yaml.c:415 #2 0x00007f9fb5266485 in xdebug_execute_internal (current_execute_data=0x7f9fb5a1eb90, return_value=0x7f9fb5a1eac0) at ./build-7.3/src/base/base.c:466 #3 0x0000563d30ea40df in ?? () #4 0x0000563d310dceb6 in execute_ex () #5 0x00007f9fb5265afc in xdebug_execute_ex (execute_data=0x7f9fb5a1e840) at ./build-7.3/src/base/base.c:380 #6 0x0000563d30ea3d29 in ?? () #7 0x0000563d310dceb6 in execute_ex () PatchesPull Requests
Pull requests:
HistoryAllCommentsChangesGit/SVN commits
|
|||||||||||||||||||||||||||
Copyright © 2001-2025 The PHP GroupAll rights reserved. |
Last updated: Wed Oct 29 14:00:01 2025 UTC |
It seems to me that sizeof(YAML_TIMESTAMP_TAG) is 29[1], so the memcmp() would cause an OOB read. Using strcmp() instead should solve the issue, but would not cater to embedded NUL bytes in the key. The proper solution would likely be if (zend_string_equals_literal(key, YAML_TIMESTAMP_TAG)) { However, zend_string_equals_literal() is only available as of PHP 7.0.0. [1] <https://github.com/yaml/libyaml/blob/acd6f6f014c25e46363e718381e0b35205df2d83/include/yaml.h#L677>