Project: php-src (php/php-src), language: c++
Vulnerability instance: php.cve-2018-12882
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: PHP Bugs
## URL: https://bugs.php.net/bug.php?id=76409
## Description:
PHP Bug ID: 76409
Summary: heap use after free in _php_stream_free
Status: Closed
PHP Version: 7.2Git-2018-06-02 (Git)
Assigned: stas (profile)
CVE-ID: 2018-12882

Description:
Description:
------------
USE_ZEND_ALLOC=0 ./php-e147eb2 -r 'exif_read_data(file_get_contents("/full/path/to/test.jpg"));'

echo "Lw==" | base64 -d > test.jpg

od -tx1 test.jpg
0000000 2f
0000001

Expected result:
----------------
No crash.

Actual result:
--------------
==15865==ERROR: AddressSanitizer: heap-use-after-free on address 0x611000000ad0 at pc 0x0000013d8100 bp 0x7fff9778bda0 sp 0x7fff9778bd98
READ of size 8 at 0x611000000ad0 thread T0
    #0 0x13d80ff in _php_stream_free /root/php-7.2.6/main/streams/streams.c:373:13
    #1 0xe4a08f in exif_read_from_file /root/php-7.2.6/ext/exif/exif.c:4411:2
    #2 0xe4a08f in zif_exif_read_data /root/php-7.2.6/ext/exif/exif.c:4482
    #3 0x18692f5 in ZEND_DO_ICALL_SPEC_RETVAL_UNUSED_HANDLER /root/php-7.2.6/Zend/zend_vm_execute.h:573:2
    #4 0x1683367 in execute_ex /root/php-7.2.6/Zend/zend_vm_execute.h:59723:7
    #5 0x1683aa5 in zend_execute /root/php-7.2.6/Zend/zend_vm_execute.h:63760:2
    #6 0x14fdb5c in zend_eval_stringl /root/php-7.2.6/Zend/zend_execute_API.c:1082:4
    #7 0x14fe3a7 in zend_eval_stringl_ex /root/php-7.2.6/Zend/zend_execute_API.c:1123:11
    #8 0x14fe3a7 in zend_eval_string_ex /root/php-7.2.6/Zend/zend_execute_API.c:1134
    #9 0x196fd32 in do_cli /root/php-7.2.6/sapi/cli/php_cli.c:1042:8
    #10 0x196dd4f in main /root/php-7.2.6/sapi/cli/php_cli.c:1404:18
    #11 0x7fb432b3382f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291
    #12 0x43bd68 in _start (/root/php-7.2.6/sapi/cli/php+0x43bd68)

0x611000000ad0 is located 144 bytes inside of 224-byte region [0x611000000a40,0x611000000b20)
freed by thread T0 here:
    #0 0x4e2c32 in free /b/build/slave/linux_upload_clang/build/src/third_party/llvm/compiler-rt/lib/asan/asan_malloc_linux.cc:78:3
    #1 0x13d7f53 in _php_stream_free /root/php-7.2.6/main/streams/streams.c:511:3

previously allocated by thread T0 here:
    #0 0x4e2f73 in __interceptor_malloc /b/build/slave/linux_upload_clang/build/src/third_party/llvm/compiler-rt/lib/asan/asan_malloc_linux.cc:98:3
    #1 0x147855a in __zend_malloc /root/php-7.2.6/Zend/zend_alloc.c:2829:14
    #2 0x13ed4b3 in _php_stream_fopen_from_fd_int /root/php-7.2.6/main/streams/plain_wrapper.c:186:9
    #3 0x13ed4b3 in _php_stream_fopen_from_fd /root/php-7.2.6/main/streams/plain_wrapper.c:248

SUMMARY: AddressSanitizer: heap-use-after-free /root/php-7.2.6/main/streams/streams.c:373:13 in _php_stream_free

Comments:

[Comment 1] [2018-06-03 12:08 UTC] cmb@php.net
Thanks for reporting this issue.

It seems to me the avoid-double-free.patch fixes the bug.

[Comment 2] [2018-06-03 12:08 UTC] cmb@php.net
The following patch has been added/updated:

Patch Name: avoid-double-free.patch
Revision:   1528027735
URL:        https://bugs.php.net/patch-display.php?bug=76409&patch=avoid-double-free.patch&revision=1528027735
Links: https://bugs.php.net/patch-display.php?bug=76409&patch=avoid-double-free.patch&revision=1528027735

[Comment 4] [2018-06-09 16:39 UTC] geeknik at protonmail dot ch
FYI, this affects the 7.2.6 release as well, but I haven't tested other versions.

[Comment 5] [2018-06-09 16:55 UTC] cmb@php.net
Indeed, PHP-7.2 as well as master have been affected (but not
earlier version branches), and both have been fixed.

[Comment 6] [2018-06-26 02:52 UTC] geeknik at protonmail dot ch
CVE-2018-12882 has been assigned to this bug.

[Comment 7] [2018-06-26 08:45 UTC] cmb@php.net
Requesting a CVE for a bug which had been reported and discussed
publicly is pretty strange.

Stas, would do you think?

[Comment 8] [2018-06-26 23:45 UTC] stas@php.net
I don't think CVE has something to do with publicity. CVE is an issue identifier, which allows to track it across distributions, builds, etc. and which is issued for security issues. It doesn't matter whether it was disclosed publicly or not and which version fixes it - CVE allows to track security issues in every version and thus to have a picture which issue is fixed where. 
It looks like this one also should be a security issue since exif bugs usually deal with external data. Not sure where this fix has been applied and whether it need a backport, will check.

[Comment 9] [2018-06-27 09:27 UTC] cmb@php.net
The fix has been committed to PHP-7.2 and master (older branches
are not affected); it has missed PHP 7.2.7, though, since it has
not been regarded as security fix.

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
./buildconf --force
./configure \
        --enable-option-checking=fatal \
        --disable-libxml \
        --disable-dom \
        --disable-simplexml \
        --disable-xml \
        --disable-xmlreader \
        --disable-xmlwriter \
        --without-pear \
        --enable-exif \
        --disable-phpdbg \
        --disable-cgi
make -j$(nproc)

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y make autoconf automake libtool bison re2c make ca-certificates curl xz-utils dpkg-dev file libc-dev pkg-config libcurl4-openssl-dev libedit-dev libsqlite3-dev libssl-dev zlib1g-dev
RUN git clone https://github.com/php/php-src php-src
RUN git -C php-src checkout 8148cbb78841c8ec0759c0836e7f35dec799d300
WORKDIR $SRC/php-src
COPY build.sh $SRC/

Additional files: