PHP :: Bug #77456 :: stack overflow in get_min

Bug #77456

stack overflow in get_min_len

Submitted:

2019-01-14 09:58 UTC

Modified:

2021-08-26 17:00 UTC

Votes:	2
Avg. Score:	3.0 ± 0.0
Reproduced:	0 of 0 (0.0%)

From:

zhihua dot yao at dbappsecurity dot com dot cn

Assigned:

cmb (profile)

Status:

Closed

Package:

mbstring related

PHP Version:

7.2.14

OS:

stack overflow

Private report:

CVE-ID:

None

View Add Comment Developer Edit

Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If this is not your bug, you can add a comment by following this link.
If this is your bug, but you forgot your password, you can retrieve your password here.

Password:

Status:
Package:
Bug Type:
Summary:
From:	zhihua dot yao at dbappsecurity dot com dot cn
New email:
PHP Version:		OS:

New Comment:

[2019-01-14 09:58 UTC] zhihua dot yao at dbappsecurity dot com dot cn

Description:
------------
When using this poc, a stack overflow will occur, causing a denial of service.
use this file
https://drive.google.com/file/d/1XPqv8c9FrsiZo_vLiqhbIzpU2QYMhMcG/view?usp=sharing

I tested 7.2.14 and 7.2.13.


Test script:
---------------
./php-7.2.13/sapi/cli/php -r 'var_dump(mb_ereg(file_get_contents("./out3/crashes/id:000000,sig:06,src:003281,op:havoc,rep:2"),""));'

Actual result:
--------------
=================================================================
==41216==ERROR: AddressSanitizer: stack-overflow on address 0x7ffcf1e7aff8 (pc 0x0000009a0976 bp 0x7ffcf1e7b0e0 sp 0x7ffcf1e7aff0 T0)
    #0 0x9a0975 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2501
    #1 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #2 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #3 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #4 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #5 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #6 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #7 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #8 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #9 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #10 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #11 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #12 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #13 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #14 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #15 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #16 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #17 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #18 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #19 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #20 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #21 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #22 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #23 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #24 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #25 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #26 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #27 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #28 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #29 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #30 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #31 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #32 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #33 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #34 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #35 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #36 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #37 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #38 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #39 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #40 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #41 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #42 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #43 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #44 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #45 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #46 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #47 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #48 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #49 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #50 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #51 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #52 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #53 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #54 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #55 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #56 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #57 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #58 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #59 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #60 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #61 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #62 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #63 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #64 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #65 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #66 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #67 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #68 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #69 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #70 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #71 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #72 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #73 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #74 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #75 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #76 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #77 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #78 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #79 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #80 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #81 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #82 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #83 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #84 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #85 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #86 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #87 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #88 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #89 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #90 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #91 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #92 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #93 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #94 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #95 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #96 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #97 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #98 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #99 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #100 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #101 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #102 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #103 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #104 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #105 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #106 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #107 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #108 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #109 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #110 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #111 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #112 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #113 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #114 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #115 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #116 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #117 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #118 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #119 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #120 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #121 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #122 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #123 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #124 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #125 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #126 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #127 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #128 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #129 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #130 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #131 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #132 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #133 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #134 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #135 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #136 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #137 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #138 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #139 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #140 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #141 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #142 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #143 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #144 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #145 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #146 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #147 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #148 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #149 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #150 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #151 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #152 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #153 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #154 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #155 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #156 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #157 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #158 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #159 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #160 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #161 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #162 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #163 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #164 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #165 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #166 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #167 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #168 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #169 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #170 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #171 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #172 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #173 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #174 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #175 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #176 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #177 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #178 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #179 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #180 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #181 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #182 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #183 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #184 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #185 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #186 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #187 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #188 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #189 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #190 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #191 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #192 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #193 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #194 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #195 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #196 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #197 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #198 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #199 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #200 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #201 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #202 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #203 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #204 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #205 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #206 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #207 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #208 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #209 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #210 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #211 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #212 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #213 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #214 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #215 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #216 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #217 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #218 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #219 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #220 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #221 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #222 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #223 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #224 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #225 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #226 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #227 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #228 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #229 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #230 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #231 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #232 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #233 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #234 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #235 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #236 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #237 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #238 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #239 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #240 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #241 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #242 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #243 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #244 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #245 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #246 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #247 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #248 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #249 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582
    #250 0x9a1a55 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2613
    #251 0x9a1581 in get_min_len /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2582

SUMMARY: AddressSanitizer: stack-overflow /home/hackyzh/Desktop/php-7.2.13/ext/mbstring/oniguruma/src/regcomp.c:2501 get_min_len
==41216==ABORTING

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports

[2019-02-10 01:58 UTC] stas@php.net

-Type: Security +Type: Bug -Assigned To: +Assigned To: hirokawa

[2019-02-10 01:58 UTC] stas@php.net

This looks like an artificial pattern which is not likely to appear in common code, but has to be specifically crafted to cause this specific problem. I don't think importing arbitrary patterns and running them is a common scenario for PHP apps, and regular expressions are known to have runaway patterns. So I don't think there is a security issue here. There might be a case for adding some limits for recursion depth, etc. - I know PCRE has some but don't see much in mbstring - but otherwise doesn't seem to be security issue here.

[2019-03-18 05:47 UTC] stas@php.net

Related to bug #72777

[2019-03-18 06:25 UTC] spam2 at rhsoft dot net

> This looks like an artificial pattern which is not likely to 
> appear in common code, but has to be specifically crafted 
> to cause this specific problem. I don't think importing 
> arbitrary patterns and running them is a common scenario 
> for PHP apps

when it comes to security you guys completly ignore hosting where either dumb customers or hacked customer sftp/ftp accounts place arbitary code

hecne as sysadmin you want as less as possible attack vectros on your system (no known bugs leading to memory corruption to begin with, disable_functions, restrict access to shell binaries to force disable exec and friends....)

[2021-08-26 17:00 UTC] cmb@php.net

-Status: Assigned +Status: Closed -Assigned To: hirokawa +Assigned To: cmb

[2021-08-26 17:00 UTC] cmb@php.net

With PHP-7.4 and Oniguruma 6.9.5, I get:

    Warning: mb_ereg(): Pattern is not valid under UTF-8 encoding in …

So this issue appears to have been fixed.  Since liboniguruma is
unbundled as of PHP 7.4.0, this ticket is obsolete anyway.

	php.net \| support \| documentation \| report a bug \| advanced search \| search howto \| statistics \| random bug \| login
go to bug id or search bugs for


Copyright © 2001-2024 The PHP Group All rights reserved.	Last updated: Thu Apr 25 22:01:29 2024 UTC