PHP :: Bug #77456 :: stack overflow in get_min

Bug #77456

stack overflow in get_min_len

Submitted:

2019-01-14 09:58 UTC

Modified:

2019-03-18 05:47 UTC

Votes:	1
Avg. Score:	3.0 ± 0.0
Reproduced:	0 of 0 (0.0%)

From:

zhihua dot yao at dbappsecurity dot com dot cn

Assigned:

hirokawa (profile)

Status:

Assigned

Package:

mbstring related

PHP Version:

7.2.14

OS:

stack overflow

Private report:

CVE-ID:

None

View Add Comment Developer Edit

Welcome! If you don't have a Git account, you can't do anything here.
You can add a comment by following this link or if you reported this bug, you can edit this bug over here.

php.net Username: php.net Password:

Quick Fix:	(description)
	Block user comment
Status:		Assign to:
Package:
Bug Type:
Summary:
From:	zhihua dot yao at dbappsecurity dot com dot cn
New email:
PHP Version:		OS:

New/Additional Comment:

[2019-01-14 09:58 UTC] zhihua dot yao at dbappsecurity dot com dot cn

Description:
------------
When using this poc, a stack overflow will occur, causing a denial of service.
use this file
https://drive.google.com/file/d/1XPqv8c9FrsiZo_vLiqhbIzpU2QYMhMcG/view?usp=sharing

I tested 7.2.14 and 7.2.13.


Test script:
---------------
./php-7.2.13/sapi/cli/php -r 'var_dump(mb_ereg(file_get_contents("./out3/crashes/id:000000,sig:06,src:003281,op:havoc,rep:2"),""));'

Actual result:
--------------
=================================================================
==41216==ERROR: AddressSanitizer: stack-overflow on address 0x7ffcf1e7aff8 (pc 0x0000009a0976 bp 0x7ffcf1e7b0e0 sp 0x7ffcf1e7aff0 T0)
    #0 0x9a0975 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2501
    #1 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #2 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #3 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #4 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #5 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #6 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #7 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #8 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #9 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #10 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #11 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #12 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #13 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #14 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #15 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #16 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #17 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #18 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #19 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #20 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #21 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #22 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #23 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #24 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #25 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #26 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #27 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #28 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #29 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #30 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #31 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #32 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #33 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #34 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #35 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #36 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #37 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #38 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #39 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #40 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #41 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #42 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #43 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #44 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #45 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #46 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #47 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #48 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #49 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #50 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #51 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #52 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #53 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #54 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #55 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #56 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #57 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #58 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #59 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #60 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #61 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #62 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #63 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #64 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #65 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #66 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #67 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #68 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #69 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #70 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #71 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #72 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #73 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #74 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #75 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #76 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #77 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #78 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #79 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #80 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #81 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #82 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #83 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #84 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #85 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #86 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #87 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #88 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #89 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #90 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #91 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #92 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #93 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #94 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #95 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #96 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #97 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #98 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #99 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #100 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #101 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #102 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #103 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #104 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #105 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #106 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #107 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #108 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #109 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #110 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #111 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #112 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #113 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #114 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #115 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #116 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #117 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #118 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #119 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #120 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #121 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #122 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #123 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #124 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #125 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #126 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #127 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #128 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #129 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #130 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #131 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #132 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #133 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #134 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #135 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #136 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #137 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #138 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #139 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #140 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #141 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #142 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #143 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #144 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #145 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #146 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #147 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #148 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #149 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #150 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #151 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #152 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #153 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #154 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #155 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #156 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #157 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #158 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #159 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #160 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #161 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #162 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #163 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #164 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #165 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #166 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #167 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #168 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #169 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #170 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #171 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #172 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #173 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #174 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #175 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #176 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #177 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #178 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #179 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #180 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #181 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #182 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #183 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #184 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #185 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #186 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #187 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #188 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #189 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #190 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #191 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #192 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #193 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #194 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #195 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #196 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #197 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #198 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #199 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #200 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #201 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #202 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #203 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #204 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #205 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #206 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #207 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #208 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #209 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #210 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #211 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #212 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #213 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #214 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #215 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #216 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #217 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #218 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #219 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #220 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #221 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #222 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #223 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #224 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #225 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #226 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #227 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #228 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #229 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #230 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #231 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #232 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #233 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #234 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #235 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #236 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #237 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #238 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #239 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #240 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #241 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #242 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #243 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #244 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #245 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #246 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #247 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #248 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #249 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #250 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #251 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582

SUMMARY: AddressSanitizer: stack-overflow /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2501 get_min_len
==41216==ABORTING

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports

[2019-02-10 01:58 UTC] stas@php.net

-Type: Security +Type: Bug -Assigned To: +Assigned To: hirokawa

[2019-02-10 01:58 UTC] stas@php.net

This looks like an artificial pattern which is not likely to appear in common code, but has to be specifically crafted to cause this specific problem. I don't think importing arbitrary patterns and running them is a common scenario for PHP apps, and regular expressions are known to have runaway patterns. So I don't think there is a security issue here. There might be a case for adding some limits for recursion depth, etc. - I know PCRE has some but don't see much in mbstring - but otherwise doesn't seem to be security issue here.

[2019-03-18 05:47 UTC] stas@php.net

Related to bug #72777

[2019-03-18 06:25 UTC] spam2 at rhsoft dot net

> This looks like an artificial pattern which is not likely to 
> appear in common code, but has to be specifically crafted 
> to cause this specific problem. I don't think importing 
> arbitrary patterns and running them is a common scenario 
> for PHP apps

when it comes to security you guys completly ignore hosting where either dumb customers or hacked customer sftp/ftp accounts place arbitary code

hecne as sysadmin you want as less as possible attack vectros on your system (no known bugs leading to memory corruption to begin with, disable_functions, restrict access to shell binaries to force disable exec and friends....)

	php.net \| support \| documentation \| report a bug \| advanced search \| search howto \| statistics \| random bug \| login
go to bug id or search bugs for


Copyright © 2001-2019 The PHP Group All rights reserved.	Last updated: Wed Jul 24 06:01:27 2019 UTC