Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:70612
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain wikimedia.org designates 208.80.152.186 as permitted sender)
Message-ID: <52AA42AD.7080605@wikimedia.org>
Date: Fri, 13 Dec 2013 10:11:41 +1100
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Thunderbird/24.0
MIME-Version: 1.0
To: Pierre Joye <pierre.php@gmail.com>
CC: Stas Malyshev <smalyshev@sugarcrm.com>, 
 internals Mailing List <internals@lists.php.net>,
 Marcus Boerger <helly@php.net>
References: <5281AE1C.4040108@wikimedia.org>	<52A50402.6040303@sugarcrm.com>	<52A95137.4050505@wikimedia.org> <CAEZPtU4drXReQdDu3F6MqEkCL2b02kF_KaqtfJCFKgu6nz-AHg@mail.gmail.com>
In-Reply-To: <CAEZPtU4drXReQdDu3F6MqEkCL2b02kF_KaqtfJCFKgu6nz-AHg@mail.gmail.com>
OpenPGP: id=BF976370
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] EXIF integer overflow again
From: tstarling@wikimedia.org (Tim Starling)

On 12/12/13 17:07, Pierre Joye wrote:
> But generating it at runtime during the test run sounds like a good
> solution. While I am not sure yet about a good way to craft a TIFF
> to fit the crash requirements, we have no API to get the heap size
> (not sure it is displayed by bintools).

Not the heap size, the heap pointer, i.e. (size_t)ptr, the distance
between the start of address space and the pointer returned by
emalloc(). On Linux, malloc() will sometimes use brk(), which gives
you an address after .text, .data, etc., so it is dependent on the
size of the main binary (which could be Apache, php-fcgi, etc.) --
typically it is some tens of megabytes above the start of the address
space.

If malloc() decides to use mmap() instead, on a 64-bit system, the
address returned will typically be terabytes above the start of
address space, so the attack will be infeasible. Windows apparently
doesn't have brk(), so the attack there would probably be limited to
32-bit systems.

-- Tim Starling