php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Sec Bug #73371 crash in locale_get_keywords function
Submitted: 2016-10-22 09:58 UTC Modified: 2016-11-14 11:44 UTC
From: nguyenluan dot vnn at gmail dot com Assigned: stas (profile)
Status: Closed Package: intl (PECL)
PHP Version: 7.0.13 OS:
Private report: No CVE-ID: None
View Add Comment Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
You can add a comment by following this link or if you reported this bug, you can edit this bug over here.
Block user comment
Status: Assign to:
Package:
Bug Type:
Summary:
From: nguyenluan dot vnn at gmail dot com
New email:
PHP Version: OS:

 

 [2016-10-22 09:58 UTC] nguyenluan dot vnn at gmail dot com
Description:
------------
In function locale_get_keywords:

PHP_FUNCTION( locale_get_keywords )
{
    UEnumeration*   e        = NULL;
    UErrorCode      status   = U_ZERO_ERROR;

    ...
    ...

    /* Get the keywords */
    e = uloc_openKeywords( loc_name, &status );  // crash here when loc_name larger than 2Gb
    if( e != NULL )

    ...
    ...
}

If "loc_name" is larger than 2Gb PHP 7 will crash.

Test script:
---------------
<?php
    ini_set('memory_limit', -1);
    
    $str = str_repeat('a', 0x8ff00000);
    locale_get_keywords($str);
?>

Expected result:
----------------
No crash.

Actual result:
--------------
gdb-peda$ r ../test/string/test_collator_sort.php 
Starting program: /home/user/Desktop/php-7.0.12/sapi/cli/php ../test/string/test_collator_sort.php
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".

Program received signal SIGSEGV, Segmentation fault.

 [----------------------------------registers-----------------------------------]
RAX: 0x61 ('a')
RBX: 0x0 
RCX: 0x7fffffffa510 --> 0x7fff5b800018 ('a' <repeats 200 times>...)
RDX: 0x20 (' ')
RSI: 0x0 
RDI: 0x61 ('a')
RBP: 0x0 
RSP: 0x7fffffffa4c0 --> 0x7fff00616161 
RIP: 0x7ffff4351327 (<ulocimp_getLanguage_55+183>:	mov    BYTE PTR [r15],al)
R8 : 0xffff 
R9 : 0x7fffffffa524 --> 0xf42ccd2800000000 
R10: 0x672 
R11: 0x7ffff4351860 (<uloc_openKeywords_55>:	push   r12)
R12: 0x7fffffffa510 --> 0x7fff5b800018 ('a' <repeats 200 times>...)
R13: 0x80000000 
R14: 0x7fffdb800018 ('a' <repeats 200 times>...)
R15: 0x80000000
EFLAGS: 0x10a12 (carry parity ADJUST zero sign trap INTERRUPT direction OVERFLOW)
[-------------------------------------code-------------------------------------]
   0x7ffff435131c <ulocimp_getLanguage_55+172>:	
    jle    0x7ffff43512f0 <ulocimp_getLanguage_55+128>
   0x7ffff435131e <ulocimp_getLanguage_55+174>:	
    call   0x7ffff436b2d0 <uprv_asciitolower_55>
   0x7ffff4351323 <ulocimp_getLanguage_55+179>:	cmp    r13d,0x2
=> 0x7ffff4351327 <ulocimp_getLanguage_55+183>:	mov    BYTE PTR [r15],al
   0x7ffff435132a <ulocimp_getLanguage_55+186>:	
    jg     0x7ffff43512f6 <ulocimp_getLanguage_55+134>
   0x7ffff435132c <ulocimp_getLanguage_55+188>:	movsx  edi,BYTE PTR [r14]
   0x7ffff4351330 <ulocimp_getLanguage_55+192>:	
    call   0x7ffff436b2d0 <uprv_asciitolower_55>
   0x7ffff4351335 <ulocimp_getLanguage_55+197>:	movsxd rdx,r13d
[------------------------------------stack-------------------------------------]
0000| 0x7fffffffa4c0 --> 0x7fff00616161 
0008| 0x7fffffffa4c8 --> 0x53debe1001879100 
0016| 0x7fffffffa4d0 --> 0x8b5b800000 
0024| 0x7fffffffa4d8 --> 0x7fff5b800018 ('a' <repeats 200 times>...)
0032| 0x7fffffffa4e0 --> 0x7fffffffa704 --> 0x0 
0040| 0x7fffffffa4e8 --> 0x447580 (<_start>:	xor    ebp,ebp)
0048| 0x7fffffffa4f0 --> 0x7fffffffe1a0 --> 0x2 
0056| 0x7fffffffa4f8 --> 0x7fffebc14030 --> 0x7fffebc82160 --> 0xad8472 (<ZEND_DO_ICALL_SPEC_HANDLER>:	push   rbp)
[------------------------------------------------------------------------------]
Legend: code, data, rodata, value
Stopped reason: SIGSEGV
0x00007ffff4351327 in ulocimp_getLanguage_55 ()
   from /usr/lib/x86_64-linux-gnu/libicuuc.so.55

gdb-peda$ bt
#0  0x00007ffff4351327 in ulocimp_getLanguage_55 ()
   from /usr/lib/x86_64-linux-gnu/libicuuc.so.55
#1  0x00007ffff43518ed in uloc_openKeywords_55 ()
   from /usr/lib/x86_64-linux-gnu/libicuuc.so.55
#2  0x00000000006ee9e3 in zif_locale_get_keywords (
    execute_data=0x7fffebc140e0, return_value=0x7fffebc140d0)
    at /home/user/Desktop/php-7.0.12/ext/intl/locale/locale_methods.c:721
#3  0x0000000000ad8506 in ZEND_DO_ICALL_SPEC_HANDLER ()
    at /home/user/Desktop/php-7.0.12/Zend/zend_vm_execute.h:586
#4  0x0000000000ad7f32 in execute_ex (ex=0x7fffebc14030)
    at /home/user/Desktop/php-7.0.12/Zend/zend_vm_execute.h:414
#5  0x0000000000ad8043 in zend_execute (op_array=0x7fffebc81000, 
    return_value=0x0)
    at /home/user/Desktop/php-7.0.12/Zend/zend_vm_execute.h:458
#6  0x0000000000a78cfc in zend_execute_scripts (type=0x8, retval=0x0, 
    file_count=0x3) at /home/user/Desktop/php-7.0.12/Zend/zend.c:1427
#7  0x00000000009e11d5 in php_execute_script (primary_file=0x7fffffffce20)
    at /home/user/Desktop/php-7.0.12/main/main.c:2494
#8  0x0000000000b412f8 in do_cli (argc=0x2, argv=0x14a6630)
    at /home/user/Desktop/php-7.0.12/sapi/cli/php_cli.c:974
#9  0x0000000000b424c6 in main (argc=0x2, argv=0x14a6630)
    at /home/user/Desktop/php-7.0.12/sapi/cli/php_cli.c:1344
#10 0x00007ffff38b3830 in __libc_start_main (main=0xb41cbb <main>, argc=0x2, 
    argv=0x7fffffffe1a8, init=<optimized out>, fini=<optimized out>, 
    rtld_fini=<optimized out>, stack_end=0x7fffffffe198)
    at ../csu/libc-start.c:291
#11 0x00000000004475a9 in _start ()


Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2016-11-04 03:06 UTC] stas@php.net
-PHP Version: 7.0.12 +PHP Version: 5.6.27
 [2016-11-04 06:01 UTC] stas@php.net
-Status: Open +Status: Closed -Assigned To: +Assigned To: stas
 [2016-11-04 06:01 UTC] stas@php.net
The fix for this bug has been committed.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.

 For Windows:

http://windows.php.net/snapshots/
 
Thank you for the report, and for helping us make PHP better.
 [2016-11-11 12:50 UTC] nguyenluan dot vnn at gmail dot com
-Status: Closed +Status: Assigned -PHP Version: 5.6.27 +PHP Version: 7.0.13
 [2016-11-11 12:50 UTC] nguyenluan dot vnn at gmail dot com
Still crashes in version 7.0.13. Please check it again.
 [2016-11-11 12:51 UTC] nguyenluan dot vnn at gmail dot com
-Status: Assigned +Status: Open
 [2016-11-11 12:51 UTC] nguyenluan dot vnn at gmail dot com
Open this issue again.
 [2016-11-14 11:44 UTC] nguyenluan dot vnn at gmail dot com
-Status: Open +Status: Closed
 [2016-11-14 11:44 UTC] nguyenluan dot vnn at gmail dot com
Fixed in PHP 7.1.0 RC6. Please close.

Thanks.
 
PHP Copyright © 2001-2020 The PHP Group
All rights reserved.
Last updated: Wed Oct 21 17:01:23 2020 UTC