Internet Bug Bounty · Report #476168
Heap overflow in utf32be_mbc_to_code
Validstatus
criticalseverity
$1,500bounty
3upvotes
9 Nov 2020disclosed
How it was found
https://bugs.php.net/bug.php?id=77418
Buffer overflow in mbc_to_code functions for UTF32BE, UTF32LE, UTF16BE, and UTF16LE due to incorrect length assumptions of a buffer. Provided a patch that was adapted to check the length of the buffer prior to using it.
Impact
Memory leakage and/or corruption