Trivial age-old heap overflow in 32-bit PHP

How it was found

Given one is able to execute a PHP file there exists a trivial heap overflow in the ext/standard/iptc.c module, a module which exports the iptcembed and iptcparse functions. It should be noted that the implementation of these functions is - in some countries - allowed to drink beer and get driving lessons.

Initially implemented in the good ol' Internet bubble it has since been patched as the function showed too much power to the internet as it was mastering the heap in ways not seen before. Since then a number of clear improvements have been seen while still remaining heap master in disguise.

Following is a POC that will trigger a memory corruption. For those with more time on their hands it should be obvious that this can be exploited further on 32-bit versions of PHP. Unfortunately it'd appear that, since one is not able to ftruncate() a 0xffffffffffffffff-sized file on any filesystem (as far as I'm aware?), it is not possible to wraparound the 64-bit length variable that is allocated in 64-bit versions of PHP.

<?php

if(file_exists("heapyolo") == 0) {
    $fp = fopen("heapyolo", "wb");

    fwrite($fp, "\xff\xd8\xff\xe0\x00\x02\x00\xd9");
    for ($i = 0; $i < 4096; $i++) {
        fwrite($fp, str_repeat("A", 1024*1024));
    }

    fclose($fp);
}

iptcembed(str_repeat("A", 1024*1024), "heapyolo");
?>

The POC writes a legitimate iptc-compatible header followed by 4 GB of data. In combination with the constant integers and length of the iptcdata the filesize then overflows the 32-bit length field which is then allocated. By using the M_APP0 switch/case entry we're then able to overwrite heap memory with arbitrary values and arbitrary length as passed along by the iptcdata variable. It should be noted that this can be done multiple times - as long as PHP doesn't crash - and that we only have to write the 4GB file once due to this construct.

Well, that's enough The Internet for me for today. Thanks!