Debian Bug report logs - #783108
file: OOM and/or segfault

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Henri Salo <henri@nerv.fi>

To: submit@bugs.debian.org

Subject: php5: Fileinfo on specific file causes spurious OOM and/or segfault

Date: Wed, 22 Apr 2015 11:35:45 +0300

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Source: php5
Version: 5.6.7+dfsg-1
Severity: grave
Tags: security, upstream, fixed-upstream

Hi,

the following vulnerability was published for PHP5,

"""
When calling finfo::file() or finfo::buffer() with a crafted string, PHP will
crash by either segfaulting or trying to allocate an large amount of memory
(4GiB).

This was found in the wild when a user uploaded a file (running finfo on
arbitrary files uploaded by users is one of its main use cases.). I've since
anonymised the file, and made it more minimal. At this stage, very small changes
to the string make it produce different behaviour - removing the remaining 'a',
's', or 'y' characters, for instance, will allow finfo to process it fine.
"""

For further information see:
  https://bugs.php.net/bug.php?id=68819
  https://git.php.net/?p=php-src.git;a=commitdiff;h=f938112c495b0d26572435c0be73ac0bfe642ecd

- -- 
Henri Salo
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBAgAGBQJVN11hAAoJECet96ROqnV0NFwP/1WyM6/jYhMkuyyjIDuGJLR6
5agci0HcM64R5It7Dvoy7HPtP431Qg5XvtJBn2P5YRq9Kgh1g0T7NeA4jbQIQEQs
lj/zO4zfBSnhCvkCbsqhLDYDASx1M2esXgfXy4EDejBPvVMSPtSr3GjVt9Ptufty
/GgA3FRf+XDDNNDebGsDVvkKH5pAvK7QN8R8UsmG8uiEYP9+vdlwdAK5pykrWsGa
yZEm7x/OXjETTnjIoz+0p89ExFBBuNyryhMQGVfiJxivTMHaHMBuZ/2BlBhIM0S2
VTf42JtlLTmG6NZW71OplY2kN1f+p+ADXy/OUtwbV700tuk58wIwt+r5Ymqa9wmA
crO2xyNm2CgA0K6Vew0vEYBWVc7fFQQuGhQX6lKOwng3OXaM3Xo9BzEvrOGVrTgz
sw7ilWb4kfUTjtZoAYVOqL0YTafMi3CzjmH3MzeFMyxMRtYlqgc7S+KrqJXWMX2A
TlqA2WhAOMIHNG8xxuXdwlzzVRoPakY0Jkgx5XdUlU9QdNmeIljcxdPAIXHAeEAj
IPSBQFUjAZABB7GWKgZcyJv6p2Z9nc5GkQ9RYm297QtGbPVYGUfmBZsJOloJfXIF
V4dRZWkVoonbaC5WtjaGPyOIHnl35AZ7Hl4MkQ5JMzScbN3u1BooY1+NXNBsHTPL
JLN2O58YQiTodP1AZWfx
=y0h8
-----END PGP SIGNATURE-----

Message #26 received at 783108@bugs.debian.org (full text, mbox, reply):

From: "Lennart Sorensen" <lsorense@csclub.uwaterloo.ca>

To: 783108@bugs.debian.org

Subject: Trivially reproducable

Date: Thu, 23 Apr 2015 10:53:09 -0400

Taken from testcase in php bug report and run on amd64 sid.

/tmp/test.php:

<?php

$string = '';

// These two in any order
$string .= "\r\n";
$string .= "''''";

// Total string length > 8192
$string .= str_repeat(chr(rand(32, 127)), 8184);

// Ending in this string
$string .= "say";

$finfo = new finfo();
$type = $finfo->buffer($string);
var_dump($type);

?>

Run as 'php5 /tmp/test.php' (using php5-cli) and you get:

Segmentation fault

Change 8184 to 4184 and you get:

string(60) "ASCII text, with very long lines, with CRLF line terminators"

So clearly this bug exists.

-- 
Len Sorensen

Message #31 received at 783108@bugs.debian.org (full text, mbox, reply):

From: "Lennart Sorensen" <lsorense@csclub.uwaterloo.ca>

To: 783108@bugs.debian.org

Subject: Upstream php fix appears to work

Date: Thu, 23 Apr 2015 11:32:10 -0400

Applying the patch linked to above
(https://git.php.net/?p=php-src.git;a=commitdiff;h=f938112c495b0d26572435c0be73ac0bfe642ecd)
makes the segfault go away and the expected output occur.

So this bug IS in php (and also exist in file apparently).  Reassigning to
file is wrong, given the bug exists in php as reported.  A separate bug
for file ought to be created if it can be reproduced there.

-- 
Len Sorensen

Message #36 received at 783108@bugs.debian.org (full text, mbox, reply):

From: Christoph Biedl <debian.axhn@manchmal.in-ulm.de>

To: Lennart Sorensen <lsorense@csclub.uwaterloo.ca>, 783108@bugs.debian.org

Subject: Re: Bug#783108: Upstream php fix appears to work

Date: Fri, 24 Apr 2015 10:01:19 +0200

[Message part 1 (text/plain, inline)]

Lennart Sorensen wrote...

> Applying the patch linked to above
> (https://git.php.net/?p=php-src.git;a=commitdiff;h=f938112c495b0d26572435c0be73ac0bfe642ecd)
> makes the segfault go away and the expected output occur.
> 
> So this bug IS in php (and also exist in file apparently).  Reassigning to
> file is wrong, given the bug exists in php as reported.  A separate bug
> for file ought to be created if it can be reproduced there.

The report against php5 is #783107. This is #783108 against file. However, do
you have any indication file is affected? I'd already written an analysis about
this but accidentially sent it to #783099, I could not reproduce the segfaults
using file.

If you have different information, please provide it.

    Christoph

[signature.asc (application/pgp-signature, inline)]

Message #41 received at 783108@bugs.debian.org (full text, mbox, reply):

From: "Lennart Sorensen" <lsorense@csclub.uwaterloo.ca>

To: Christoph Biedl <debian.axhn@manchmal.in-ulm.de>

Cc: 783108@bugs.debian.org

Subject: Re: Bug#783108: Upstream php fix appears to work

Date: Fri, 24 Apr 2015 09:44:30 -0400

On Fri, Apr 24, 2015 at 10:01:19AM +0200, Christoph Biedl wrote:
> The report against php5 is #783107. This is #783108 against file. However, do
> you have any indication file is affected? I'd already written an analysis about
> this but accidentially sent it to #783099, I could not reproduce the segfaults
> using file.
> 
> If you have different information, please provide it.

Well the report seemed to be against php5 initially and then changed
which seemed very confusing especially since there was no explanation
included with the changing of the bug.

I only noticed afterwards that the other bug against php5 existed.
So some time wasted because the state of the bug report was completely
confusing.

-- 
Len Sorensen

Message #46 received at 783108-done@bugs.debian.org (full text, mbox, reply):

From: Henri Salo <henri@nerv.fi>

To: 783108-done@bugs.debian.org

Subject: closing

Date: Sun, 13 Dec 2015 11:35:03 +0200

Hi,

I made the bug split, because in IRC conversation someone said that file should
be handled separately and I made the mistake not to make proper research before
creating new issue. For the current situation please see information from Debian
security tracker:

  https://security-tracker.debian.org/tracker/CVE-2015-4604
  https://security-tracker.debian.org/tracker/CVE-2015-4605

I am very sorry about the confusion and I will avoid it in the future as best as
I can.

-- 
Henri Salo

Send a report that this bug log contains spam.