php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #37947 zend_ptr_stack reallocation problem
Submitted: 2006-06-28 14:17 UTC Modified: 2006-07-10 14:03 UTC
Votes:2
Avg. Score:5.0 ± 0.0
Reproduced:2 of 2 (100.0%)
Same Version:1 (50.0%)
Same OS:1 (50.0%)
From: wmeler at wp dot pl Assigned: dmitry
Status: Closed Package: Scripting Engine problem
PHP Version: 5.1.5CVS OS: Linux
Private report: No CVE-ID:
 [2006-06-28 14:17 UTC] wmeler at wp dot pl
Description:
------------
Argument stack reallocations may cause heap corruption or segmentation faults.

Functions that accept arguments through zend_get_parameters (zval ** - pointer to zend_ptr_stack element) and running user callbacks that may need more stack space are affected.

So unserialize (__wakeup), sort functions in 4.4 version, and so on.

Also using complicated user error handler is quite risky.

Reproduce code:
---------------
<?
class test {
        function extend_zend_ptr_stack($count,$a,$b,$c,$d,$e) {
                if ($count>0) $this->extend_zend_ptr_stack($count - 1,$a,$b,$c,$d,$e);
        }

        function __wakeup() {
                $this->extend_zend_ptr_stack(10,'a','b','c','d','e');
        }
}

$str='a:2:{i:0;O:4:"test":0:{}junk';
var_dump(unserialize($str));


Expected result:
----------------
bool(false)


Actual result:
--------------
#0  0x081be837 in zif_unserialize (ht=1, return_value=0x9b97ddc, return_value_ptr=0x0, this_ptr=0x0, return_value_used=1) at /root/cvs/php_5_1/ext/standard/var.c:860
#1  0x08234f10 in zend_do_fcall_common_helper_SPEC (execute_data=0xbfec6c80) at /root/cvs/php_5_1/Zend/zend_vm_execute.h:192
#2  0x082348a1 in execute (op_array=0x9ba611c) at /root/cvs/php_5_1/Zend/zend_vm_execute.h:92
#3  0x0821acb2 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /root/cvs/php_5_1/Zend/zend.c:1101
#4  0x081e2804 in php_execute_script (primary_file=0xbfec9180) at /root/cvs/php_5_1/main/main.c:1719
#5  0x08285f9e in main (argc=2, argv=0xbfec9254) at /root/cvs/php_5_1/sapi/cli/php_cli.c:1090


Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2006-06-28 20:19 UTC] tony2001@php.net
Dmitry, could you plz check it out?
 [2006-07-10 14:03 UTC] dmitry@php.net
Fixed in CVS HEAD and PHP_5_2.
 
PHP Copyright © 2001-2014 The PHP Group
All rights reserved.
Last updated: Fri Apr 18 23:01:58 2014 UTC