php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Sec Bug #69720 Null pointer dereference in phar_get_fp_offset()
Submitted: 2015-05-28 12:06 UTC Modified: 2015-10-11 10:53 UTC
From: emmanuel dot law at gmail dot com Assigned: kaplan (profile)
Status: Closed Package: PHAR related
PHP Version: 5.6.9, 5.6.10 OS: *
Private report: No CVE-ID: 2015-7803
View Developer Edit
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: emmanuel dot law at gmail dot com
New email:
PHP Version: OS:

 

 [2015-05-28 12:06 UTC] emmanuel dot law at gmail dot com 
Description:
------------
If a Tar entry has the Link indicator set and points to an nonexisting file, phar_get_link_source() returns a NULL value phar/util.c:69:

            if (SUCCESS == zend_hash_find(&(entry->phar->manifest), entry->link, strlen(entry->link), (void **)&link_entry) || 
                    SUCCESS == zend_hash_find(&(entry->phar->manifest), link, strlen(link), (void **)&link_entry)) {
					.......		
			}else {       
					.......                                                         
					return NULL;
			}

The NULL value gets passed into phar_get_fp_offset() at util.c:497:
		(*ret)->zero = phar_get_fp_offset(phar_get_link_source(entry TSRMLS_CC) TSRMLS_CC);


The NULL pointer dereference occurs in phar_internal.h:444 where entry is NULL :
		if (!entry->is_persistent) 

This causes PHP to seg fault.


Proof Of Concept:
./php readphar.php Null_ptr_deref_in_phar_get_fp_offset.tar.phar
Segmentation fault


POC can be found here: https://www.dropbox.com/s/6hks64dopgcco9f/POC_Null_ptr_deref_in_phar_get_fp_offset.zip?dl=0


Actual result:
--------------
gdb-peda$ bt
#0  0x0000000000900df2 in phar_get_fp_offset (entry=0x0)
    at /home/elaw/php-5.6.8_patched_phar/ext/phar/phar_internal.h:444
#1  0x0000000000904460 in phar_get_entry_data (ret=0x7fffffff9570,
    fname=0x7ffff7f79bc8 "/home/elaw/php-5.6.8_patched_phar/sapi/cli/Modified_Tar.tar.phar", fname_len=0x40, path=0x7ffff7f77c80 "test.php", path_len=0x8, mode=0x155dd40 "r",
    allow_dir=0x0, error=0x7fffffff95b0, security=0x0)
    at /home/elaw/php-5.6.8_patched_phar/ext/phar/util.c:497
#2  0x000000000092de69 in phar_wrapper_open_url (
    wrapper=0x1a0bb40 <php_stream_phar_wrapper>,
    path=0x7ffff7f79d50 "phar:///home/elaw/php-5.6.8_patched_phar/sapi/cli/Modified_Tar.tar.phar/test.php", mode=0x15b7d60 "rb", options=0x0, opened_path=0x0,
    context=0x7ffff7f72e78) at /home/elaw/php-5.6.8_patched_phar/ext/phar/stream.c:286
#3  0x0000000000cf3926 in _php_stream_open_wrapper_ex (
    path=0x7ffff7f79d50 "phar:///home/elaw/php-5.6.8_patched_phar/sapi/cli/Modified_Tar.tar.phar/test.php", mode=0x15b7d60 "rb", options=0x8, opened_path=0x0,
    context=0x7ffff7f72e78)
    at /home/elaw/php-5.6.8_patched_phar/main/streams/streams.c:2064
#4  0x0000000000b0491e in zif_file_get_contents (ht=0x1, return_value=0x7ffff7f79d20,
    return_value_ptr=0x7ffff7f3c980, this_ptr=0x0, return_value_used=0x1)
    at /home/elaw/php-5.6.8_patched_phar/ext/standard/file.c:548
#5  0x00000000009353e2 in phar_file_get_contents (ht=0x1, return_value=0x7ffff7f79d20,
    return_value_ptr=0x7ffff7f3c980, this_ptr=0x0, return_value_used=0x1)
    at /home/elaw/php-5.6.8_patched_phar/ext/phar/func_interceptors.c:225
#6  0x0000000000eeaeec in zend_do_fcall_common_helper_SPEC (execute_data=0x7ffff7f3cc18)
    at /home/elaw/php-5.6.8_patched_phar/Zend/zend_vm_execute.h:558
#7  0x0000000000f0441e in ZEND_DO_FCALL_SPEC_CONST_HANDLER (execute_data=0x7ffff7f3cc18)
    at /home/elaw/php-5.6.8_patched_phar/Zend/zend_vm_execute.h:2599
#8  0x0000000000ee63d4 in execute_ex (execute_data=0x7ffff7f3cc18)
    at /home/elaw/php-5.6.8_patched_phar/Zend/zend_vm_execute.h:363
#9  0x0000000000ee7d7c in zend_execute (op_array=0x7ffff7f70d00)
    at /home/elaw/php-5.6.8_patched_phar/Zend/zend_vm_execute.h:388
#10 0x0000000000e1e55b in zend_execute_scripts (type=0x8, retval=0x0, file_count=0x3)
    at /home/elaw/php-5.6.8_patched_phar/Zend/zend.c:1341
#11 0x0000000000ca9dec in php_execute_script (primary_file=0x7fffffffcd10)
    at /home/elaw/php-5.6.8_patched_phar/main/main.c:2597
#12 0x0000000001190280 in do_cli (argc=0x5, argv=0x60400000ded0)
    at /home/elaw/php-5.6.8_patched_phar/sapi/cli/php_cli.c:994
#13 0x0000000001192ee7 in main (argc=0x5, argv=0x60400000ded0)
    at /home/elaw/php-5.6.8_patched_phar/sapi/cli/php_cli.c:1378
#14 0x00007ffff4b0db45 in __libc_start_main (main=0x1191984 <main>, argc=0x5,
    argv=0x7fffffffe2a8, init=<optimized out>, fini=<optimized out>,
    rtld_fini=<optimized out>, stack_end=0x7fffffffe298) at libc-start.c:287
#15 0x0000000000428d79 in _start ()

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2015-06-23 09:22 UTC] emmanuel dot law at gmail dot com
-PHP Version: 5.6.9 +PHP Version: 5.6.9, 5.6.10
 [2015-06-23 09:22 UTC] emmanuel dot law at gmail dot com 
Any update on this? latest 5.6.10 is still affected
 [2015-09-29 00:01 UTC] stas@php.net 
Automatic comment on behalf of stas
Revision: http://git.php.net/?p=php-src.git;a=commit;h=d698f0ae51f67c9cce870b09c59df3d6ba959244
Log: Fix bug #69720: Null pointer dereference in phar_get_fp_offset()
 [2015-09-29 00:01 UTC] stas@php.net
-Status: Open +Status: Closed
 [2015-09-29 00:01 UTC] stas@php.net 
Automatic comment on behalf of stas
Revision: http://git.php.net/?p=php-src.git;a=commit;h=2cacf5770daa13b0c498f48d1f7b20b6585a70bf
Log: Fix bug #69720: Null pointer dereference in phar_get_fp_offset()
 [2015-09-29 03:46 UTC] stas@php.net 
Automatic comment on behalf of stas
Revision: http://git.php.net/?p=php-src.git;a=commit;h=d698f0ae51f67c9cce870b09c59df3d6ba959244
Log: Fix bug #69720: Null pointer dereference in phar_get_fp_offset()
 [2015-09-29 13:10 UTC] ab@php.net 
Automatic comment on behalf of stas
Revision: http://git.php.net/?p=php-src.git;a=commit;h=d698f0ae51f67c9cce870b09c59df3d6ba959244
Log: Fix bug #69720: Null pointer dereference in phar_get_fp_offset()
 [2015-10-05 02:03 UTC] emmanuel dot law at gmail dot com 
Hi,

Can we assign a CVE for this? 
Thanks
 [2015-10-11 10:53 UTC] kaplan@php.net
-Assigned To: +Assigned To: kaplan -CVE-ID: +CVE-ID: 2015-7803
 [2016-04-18 09:30 UTC] bwoebi@php.net 
Automatic comment on behalf of stas
Revision: http://git.php.net/?p=php-src.git;a=commit;h=2cacf5770daa13b0c498f48d1f7b20b6585a70bf
Log: Fix bug #69720: Null pointer dereference in phar_get_fp_offset()
 [2016-07-20 11:36 UTC] davey@php.net 
Automatic comment on behalf of stas
Revision: http://git.php.net/?p=php-src.git;a=commit;h=2cacf5770daa13b0c498f48d1f7b20b6585a70bf
Log: Fix bug #69720: Null pointer dereference in phar_get_fp_offset()
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved. 		Last updated: Tue Dec 03 17:01:29 2024 UTC