Описание
Out-of-bounds write in bccomp() via crafted operand and scale
A call to bccomp() with attacker-supplied inputs can lead to an out-of-bounds write to either stack or heap memory. The bug occurs in bc_str2num() when the scale truncates a number whose trailing zeros are subsequently trimmed.
str_scale later determines the number of digits after the decimal point in the resulting string.
The string is later populated using bc_copy_and_toggle_bcd(nptr, fractional_ptr, fractional_end).
Note that we have shortened the allocated string (str_scale -= fractional_end - fractional_new_end;) but have not adjusted fractional_end itself. Consequently, bc_copy_and_toggle_bcd(nptr, fractional_ptr, fractional_end) will copy the original, untruncated string into a buffer that is too small, leading to an out-of-bounds write.
BCMath uses a small stack-allocated arena for numbers before falling back to heap allocation, enabling both stack and heap corruption, depending on where the buffer is allocated.
The patch adds fractional_end = fractional_new_end; after the zero truncation.
Пакеты
php
>=8.4.0, <8.4.24
8.4.24
php
>=8.5.0, <8.5.9
8.5.9
Связанные уязвимости
Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and from 8.5.* before 8.5.9.
Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and from 8.5.* before 8.5.9.
Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and from 8.5.* before 8.5.9.
Attacker-provided inputs to bccomp() could lead to an out-of-bounds wr ...
