php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #73023 fsockopen null dereference
Submitted: 2016-09-05 21:11 UTC Modified: 2017-01-22 04:22 UTC
From: fernando at null-life dot com Assigned:
Status: No Feedback Package: Sockets related
PHP Version: 7.0.10 OS: Windows
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If this is not your bug, you can add a comment by following this link.
If this is your bug, but you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: fernando at null-life dot com
New email:
PHP Version: OS:

 

 [2016-09-05 21:11 UTC] fernando at null-life dot com
Description:
------------
Attached test case causes an exception on Windows when running with USE_ZEND_ALLOC=0 


/*
 * Do format conversion placing the output in buffer
 */
static void xbuf_format_converter(void *xbuf, zend_bool is_char, const char *fmt, va_list ap) /* {{{ */
{
....
		if (adjust_width && adjust == RIGHT && min_width > s_len) {
				if (pad_char == '0' && prefix_char != NUL) {
					INS_CHAR(xbuf, *s, is_char);
					s++;
					s_len--;
					min_width--;
				}
				PAD_CHAR(xbuf, pad_char, min_width - s_len, is_char);
			}
			/*
			 * Print the string s.
			 */
--->			INS_STRING(xbuf, s, s_len, is_char);



Test script:
---------------
<?php

$v1=str_repeat(".", 0xffffffff/5);
fsockopen($v1);

Expected result:
----------------
No crash

Actual result:
--------------
(3780.3594): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
php7!xbuf_format_converter+0x2b9:
624e4e79 8b410c          mov     eax,dword ptr [ecx+0Ch] ds:002b:0000000c=????????
Processing initial command 'r;!exploitable -v'
0:000:x86> r;!exploitable -v
eax=00000000 ebx=3333334c ecx=00000000 edx=00000000 esi=33333333 edi=10016030
eip=624e4e79 esp=06a1da20 ebp=06a1e2ec iopl=0         nv up ei pl zr na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
php7!xbuf_format_converter+0x2b9:
624e4e79 8b410c          mov     eax,dword ptr [ecx+0Ch] ds:002b:0000000c=????????

!exploitable 1.6.0.0
HostMachine\HostUser
Executing Processor Architecture is x86
Debuggee is in User Mode
Debuggee is a live user mode debugging session on the local machine
Event Type: Exception
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\WINDOWS\SysWOW64\KERNEL32.DLL - 
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for ntdll.dll - 
Exception Faulting Address: 0xc
First Chance Exception Type: STATUS_ACCESS_VIOLATION (0xC0000005)
Exception Sub-Type: Read Access Violation

Faulting Instruction:624e4e79 mov eax,dword ptr [ecx+0ch]

Basic Block:
    624e4e79 mov eax,dword ptr [ecx+0ch]
       Tainted Input operands: 'ecx'
    624e4e7c add ecx,10h
       Tainted Input operands: 'ecx'
    624e4e7f add eax,ecx
       Tainted Input operands: 'eax','ecx'
    624e4e81 push eax
       Tainted Input operands: 'eax'
    624e4e82 call php7!memcpy (6279c896)
       Tainted Input operands: 'ecx','StackContents'

Exception Hash (Major/Minor): 0x222bde06.0x00ab3689

 Hash Usage : Stack Trace:
Major+Minor : php7!xbuf_format_converter+0x2b9
Major+Minor : php7!vstrpprintf+0x23
Major+Minor : php7!strpprintf+0x12
Major+Minor : php7!php_tcp_sockop_set_option+0x1cf
Major+Minor : php_openssl!php_openssl_sockop_set_option+0x3b1
Minor       : php7!_php_stream_set_option+0x3c
Minor       : php7!php_stream_xport_connect+0x67
Minor       : php7!_php_stream_xport_create+0x22d
Minor       : php7!php_fsockopen_stream+0x18c
Minor       : php7!zif_fsockopen+0xf
Minor       : php7!execute_ex+0xfb
Minor       : php7!zend_execute+0x124
Minor       : php7!zend_execute_scripts+0xe7
Minor       : php7!php_execute_script+0x372
Minor       : php!do_cli+0x3d3
Minor       : php!main+0x2cb
Minor       : php!__scrt_common_main_seh+0xf9
Minor       : KERNEL32!BaseThreadInitThunk+0x24
Excluded    : ntdll_77600000!RtlInitializeExceptionChain+0x8f
Excluded    : ntdll_77600000!RtlInitializeExceptionChain+0x5a
Instruction Address: 0x00000000624e4e79
Source File: c:\php-sdk\php70dev\vc14\x86\php-7.0.10\main\spprintf.c
Source Line: 818

Description: Read Access Violation near NULL
Short Description: ReadAVNearNull
Exploitability Classification: PROBABLY_NOT_EXPLOITABLE
Recommended Bug Title: Read Access Violation near NULL starting at php7!xbuf_format_converter+0x00000000000002b9 (Hash=0x222bde06.0x00ab3689)

This is a user mode read access violation near null, and is probably not exploitable.


Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2017-01-08 21:00 UTC] ab@php.net
-Status: Open +Status: Feedback
 [2017-01-08 21:00 UTC] ab@php.net
Thanks for the report. I don't reproduce this with the current dev trees. Either it's already fixed, or some parameter is missing. Could you please check?

Thanks.
 [2017-01-22 04:22 UTC] php-bugs at lists dot php dot net
No feedback was provided. The bug is being suspended because
we assume that you are no longer experiencing the problem.
If this is not the case and you are able to provide the
information that was requested earlier, please do so and
change the status of the bug back to "Re-Opened". Thank you.
 
PHP Copyright © 2001-2022 The PHP Group
All rights reserved.
Last updated: Sat May 21 04:05:45 2022 UTC