Heap Buffer Overflow in sqlite extension

[YuanchengJiang]

Description

The following code:

<?php
$dbfile = $GLOBALS[array_rand($GLOBALS)];
$db = new PDO('sqlite:'.$dbfile, null, null, array(PDO::ATTR_PERSISTENT => true));
?>

Resulted in this output:

==607979==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6020000029d6 at pc 0x55974681e7c6 bp 0x7ffdb1c71e00 sp 0x7ffdb1c715b0
READ of size 9 at 0x6020000029d6 thread T0
    #0 0x55974681e7c5 in MemcmpInterceptorCommon(void*, int (*)(void const*, void const*, unsigned long), void const*, void const*, unsigned long) (/usr/local/bin/php+0x1c1e7c5) (BuildId: c0213df21908f588a04dfadca2142af951d35e31)
    #1 0x55974681ecb9 in __interceptor_memcmp (/usr/local/bin/php+0x1c1ecb9) (BuildId: c0213df21908f588a04dfadca2142af951d35e31)
    #2 0x55974783274e in make_filename_safe /ext/pdo_sqlite/sqlite_driver.c:753:19
    #3 0x55974782cf74 in pdo_sqlite_handle_factory /ext/pdo_sqlite/sqlite_driver.c:805:13
    #4 0x559747783f39 in internal_construct /ext/pdo/pdo_dbh.c:450:6
    #5 0x55974777fb7b in zim_PDO___construct /ext/pdo/pdo_dbh.c:500:2
    #6 0x559748db8fa4 in ZEND_DO_FCALL_SPEC_RETVAL_UNUSED_HANDLER /Zend/zend_vm_execute.h:1879:4
    #7 0x559748b2e8f7 in execute_ex /Zend/zend_vm_execute.h:57125:7
    #8 0x559748b2fcc2 in zend_execute /Zend/zend_vm_execute.h:62752:2
    #9 0x55974897ba68 in zend_execute_script /Zend/zend.c:1888:3
    #10 0x5597484e6366 in php_execute_script_ex /main/main.c:2507:13
    #11 0x5597484e6c08 in php_execute_script /main/main.c:2547:9
    #12 0x5597498a4483 in do_cli /sapi/cli/php_cli.c:966:5
    #13 0x5597498a0a12 in main /sapi/cli/php_cli.c:1340:18
    #14 0x7f327b665d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #15 0x7f327b665e3f in __libc_start_main csu/../csu/libc-start.c:392:3
    #16 0x5597468031e4 in _start (/usr/local/bin/php+0x1c031e4) (BuildId: c0213df21908f588a04dfadca2142af951d35e31)

0x6020000029d6 is located 0 bytes to the right of 6-byte region [0x6020000029d0,0x6020000029d6)
allocated by thread T0 here:
    #0 0x559746872f43 in strdup (/usr/local/bin/php+0x1c72f43) (BuildId: c0213df21908f588a04dfadca2142af951d35e31)
    #1 0x5597487700c2 in __zend_strdup /Zend/zend_alloc.c:3115:14
    #2 0x559747783318 in internal_construct /ext/pdo/pdo_dbh.c:428:35
    #3 0x55974777fb7b in zim_PDO___construct /ext/pdo/pdo_dbh.c:500:2
    #4 0x559748db8fa4 in ZEND_DO_FCALL_SPEC_RETVAL_UNUSED_HANDLER /Zend/zend_vm_execute.h:1879:4
    #5 0x559748b2e8f7 in execute_ex /Zend/zend_vm_execute.h:57125:7
    #6 0x559748b2fcc2 in zend_execute /Zend/zend_vm_execute.h:62752:2
    #7 0x55974897ba68 in zend_execute_script /Zend/zend.c:1888:3
    #8 0x5597484e6366 in php_execute_script_ex /main/main.c:2507:13
    #9 0x5597484e6c08 in php_execute_script /main/main.c:2547:9
    #10 0x5597498a4483 in do_cli /sapi/cli/php_cli.c:966:5
    #11 0x5597498a0a12 in main /sapi/cli/php_cli.c:1340:18
    #12 0x7f327b665d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16

SUMMARY: AddressSanitizer: heap-buffer-overflow (/usr/local/bin/php+0x1c1e7c5) (BuildId: c0213df21908f588a04dfadca2142af951d35e31) in MemcmpInterceptorCommon(void*, int (*)(void const*, void const*, unsigned long), void const*, void const*, unsigned long)
Shadow bytes around the buggy address:
  0x0c047fff84e0: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
  0x0c047fff84f0: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
  0x0c047fff8500: fa fa 00 fa fa fa fd fa fa fa fd fd fa fa 00 fa
  0x0c047fff8510: fa fa 00 fa fa fa fd fd fa fa fd fa fa fa fd fd
  0x0c047fff8520: fa fa fd fd fa fa fd fa fa fa fd fd fa fa 00 fa
=>0x0c047fff8530: fa fa 00 fa fa fa 00 03 fa fa[06]fa fa fa fa fa
  0x0c047fff8540: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8550: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8560: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8570: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8580: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==607979==ABORTING

PHP Version

PHP 8.4.0-dev

Operating System

ubuntu 22.04

[nielsdos]

If you encounter something related to buffer overreads or overflows, please consider reporting them in private.
We can always decide there if something is okay to be public or not.
This particular case is unlikely to be exploitable as it's an overread for short file names (i.e. $GLOBALS[array_rand($GLOBALS)] resolves to Array and so the filename string is overread).

[devnexen]

Using proper string comparison instead of memcmp should do it I think.