php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #67241 AddressSanitizer: global-buffer-overflow in phar_build
Submitted: 2014-05-09 22:10 UTC Modified: 2014-05-11 12:46 UTC
From: crrodriguez at opensuse dot org Assigned: felipe (profile)
Status: Closed Package: PHAR related
PHP Version: master-Git-2014-05-09 (Git) OS: linux
Private report: No CVE-ID: None
View Developer Edit
 [2014-05-09 22:10 UTC] crrodriguez at opensuse dot org 
Description:
------------
There is an off-by-one in phar_build, misuse of estrndup

Test script:
---------------
running the phar test suite with -fsanitize=address + gcc 4.9

Expected result:
----------------
No error

Actual result:
--------------
==90012==ERROR: AddressSanitizer: global-buffer-overflow on address 0x0000011699c9 at pc 0xad1269 bp 0x7ffffd831c70 sp 0x7ffffd831c68
READ of size 1 at 0x0000011699c9 thread T0
    #0 0xad1268 in memcpy /usr/include/bits/string3.h:51
    #1 0xad1268 in _estrndup /home/crrodriguez/scm/php-src/Zend/zend_alloc.c:2655
    #2 0x80682e in phar_build /home/crrodriguez/scm/php-src/ext/phar/phar_object.c:1480
    #3 0x89ce86 in spl_iterator_apply /home/crrodriguez/scm/php-src/ext/spl/spl_iterators.c:3454
    #4 0x801dba in zim_Phar_buildFromIterator /home/crrodriguez/scm/php-src/ext/phar/phar_object.c:1919
    #5 0xd8bf2e in zend_do_fcall_common_helper_SPEC /home/crrodriguez/scm/php-src/Zend/zend_vm_execute.h:558
    #6 0xc07060 in execute_ex /home/crrodriguez/scm/php-src/Zend/zend_vm_execute.h:363
    #7 0xb4c26b in zend_execute_scripts /home/crrodriguez/scm/php-src/Zend/zend.c:1330
    #8 0xa3b8c3 in php_execute_script /home/crrodriguez/scm/php-src/main/main.c:2549
    #9 0xd901d1 in do_cli /home/crrodriguez/scm/php-src/sapi/cli/php_cli.c:994
    #10 0x4387c2 in main /home/crrodriguez/scm/php-src/sapi/cli/php_cli.c:1378
    #11 0x7f123098eb04 in __libc_start_main (/lib64/libc.so.6+0x21b04)
    #12 0x438f86 (/home/crrodriguez/scm/php-src/sapi/cli/php+0x438f86)

Patches

overflow_in_phar_build (last revision 2014-05-09 22:11 UTC by crrodriguez at opensuse dot org)

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2014-05-11 12:46 UTC] felipe@php.net
-Status: Open +Status: Closed -Assigned To: +Assigned To: felipe
 [2014-05-11 12:46 UTC] felipe@php.net 
The fix for this bug has been committed.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.

 For Windows:

http://windows.php.net/snapshots/
 
Thank you for the report, and for helping us make PHP better.
 
PHP Copyright © 2001-2026 The PHP Group
All rights reserved. 		Last updated: Wed Oct 07 17:00:02 2026 UTC