CVE-2016-4473: Use After Free

Fixed bug (invalid free in pharextractfile()). (CVE-2016-4473)

— PHP

It was reported that invalid free may occur under certain conditions when processing phar-compatible archives in php 7.0.7 and 5.6.22.

Vulnerable code (php-7.0.7/ext/phar/pharobject.c):

| 4063 static int pharextractfile(zendbool overwrite, pharentryinfo entry, char dest, int destlen, char error) / {{{ / | 4064 { | .... | 4071 cwdstate newstate; | .... | 4084 newstate.cwd = (char)emalloc(2); // (1) | 4085 newstate.cwd[0] = DEFAULTSLASH; | 4086 newstate.cwd[1] = '\0'; | 4087 newstate.cwdlength = 1; | 4088 if (virtualfileex(&newstate, entry->filename, NULL, CWDEXPAND) != 0 || | 4089 newstate.cwdlength <= 1) { | .... | 4099 } | .... | 4163 | 4164 if (FAILURE == phpstreamstatpath(fullpath, &ssb)) { | 4165 if (entry->isdir) { | 4166 if (!phpstreammkdir(fullpath, entry->flags & PHARENTPERMMASK, PHPSTREAMMKDIRRECURSIVE, NULL)) { // (2) | .... | 4169 free(newstate.cwd); | .... | 4171 } | 4172 } else { | 4173 if (!phpstreammkdir(fullpath, 0777, PHPSTREAMMKDIRRECURSIVE, NULL)) { // (3) | .... | 4176 free(newstate.cwd); | .... | 4178 } | 4179 } | 4180 } | .... | 4246 }

newstate.cwd' is initially allocated through the internal zend allocator in (1) and is later reallocated as the file path is resolved.

In virtualfileex' (php-7.0.7/Zend/zendvirtualcwd.c):

| 1178 CWDAPI int virtualfileex(cwdstate state, const char path, verifypathfunc verifypath, int userealpath) / {{{ / | 1179 { | .... | 1336 if (verifypath) { | .... | 1342 tmp = erealloc(state->cwd, state->cwdlength+1); | .... | 1349 state->cwd = (char ) tmp; | 1350 | 1351 memcpy(state->cwd, resolvedpath, state->cwdlength+1); | .... | 1360 } else { | .... | 1362 tmp = erealloc(state->cwd, state->cwdlength+1); | .... | 1369 state->cwd = (char ) tmp; | 1370 | 1371 memcpy(state->cwd, resolvedpath, state->cwdlength+1); | .... | 1373 } | .... | 1379 }

If phpstreammkdir' fails in (2) or (3), cwd' is freed by the underlying libc allocator. If cwd' is user-controlled, this could potentially result in code execution.

— Red Hat