Bug #71220 [Csd]: Null pointer deref (segfault) in compact via ob_start
[email protected] ("hugh at allthethings dot co dot nz")
| Newsgroups | php.bugs |
|---|---|
| Message-ID | <[email protected]> |
Edit report at https://bugs.php.net/bug.php?id=71220&edit=1
ID: 71220
User updated by: hugh at allthethings dot co dot nz
Reported by: hugh at allthethings dot co dot nz
Summary: Null pointer deref (segfault) in compact via
ob_start
Status: Closed
Type: Bug
Package: Reproducible crash
Operating System: Linux
PHP Version: 7.0.1
Assigned To: laruence
Block user comment: N
Private report: N
New Comment:
Hi stas,
I mean functions that are defined in the Zend c language space rather than php userland which I assume is what ob_start is intended for. Here the compact is. Actually calling zif_compact and in the other vug reports they are also zif_ functions. Sorry about confusion about what I meant with Zend defined. Hopefully this clears it uo
Previous Comments:
------------------------------------------------------------------------
[2015-12-27 23:18:57] [email protected]
Hugh, what you mean by "zend defined functions"? compact() is a regular PHP function: http://php.net/manual/en/function.compact.php
------------------------------------------------------------------------
[2015-12-26 09:01:55] hugh at allthethings dot co dot nz
Just to make sure you understand. This requires a different patch to the one you did in bug #71221.
I'm a bit confused why the stance from php devs have changed since the comment from an in bug #70183?
In my opinion, the big issue here is that you are allowed to call zend defined functions via ob_start instead of just userland defined functions. So far I've filed three independent reports about this and got two patches in and awaiting a third here. I'm positive if I start fuzzing this again I'll find more. If you would like I'm happy collaborating with php to get a patch in that will fix that root issue if I can get guarantee that a patch of that nature would be accepted by upstream.
Cheers,
Hugh
------------------------------------------------------------------------
[2015-12-26 08:47:46] [email protected]
simple null pointer deref,and it require specific codes. I don't this this is a security issue.
and your patch has been committed, thus closed.
thanks
------------------------------------------------------------------------
[2015-12-26 05:47:32] hugh at allthethings dot co dot nz
Hi,
This is a null pointer deference, which is described on the common weakness enumeration (CWE) list as CWE-476 [1]. It can cause a denial of service, by causing the PHP process to crash unexpectedly (segmentation fault on linux systems).
It is similar to bug #70290 which you fixed promptly, and to earlier bugs I filed such as bug #70183 where ab said that similar bugs (null pointer derefence causing crashes) would count as security after PHP 7 was released, which it has.
If you would like me to label null pointer derefences as non security issues in future, let me know.
Cheers,
Hugh
[1] - https://cwe.mitre.org/data/definitions/476.html
------------------------------------------------------------------------
[2015-12-26 05:21:44] [email protected]
I think this is not a security issue, public it.
------------------------------------------------------------------------
The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
https://bugs.php.net/bug.php?id=71220
--
Edit this bug report at https://bugs.php.net/bug.php?id=71220&edit=1