Hacktoberfest 2026: die Issues, die Maintainer für den Oktober markiert haben – offen und einsteigerfreundlich. Hacktoberfest-Issues durchsuchen

Variant analysis: 1 unfixed sibling safety gap in php-src

Offen Anfängerfreundlich
  • Stimmt etwas nicht?
#23,958 0 Kommentare 0 Reaktionen 1 zugewiesene Person Auf GitHub ansehen

Maintainer antworten meist innerhalb von 1 Tag

Dieses Issue hat noch niemand übernommen.

Bewertung

Schwierigkeit
2/5
Geschätzter Aufwand
1-3 Stunden
Anfängerfreundlichkeit
72/100
Issue-Typ
Bug
Klarheit
Klar beschrieben
Aktivitätsstatus
Aktiv
Tech-Stack
c, php
Bereich
security

Rechercherichtung

Beginne in ext/mbstring/libmbfl/mbfilter.c bei mbfl_name2encoding_ex(), insbesondere beim strncasecmp-Aufruf für die Hash-Suche nahe Zeile 335. Vergleiche ihn mit den beiden abgesicherten Aufrufstellen der Schwester und führe den php_php-fuzz-parser-Harness oder relevante mbstring-Operationen aus, um den gemeldeten Pfad zu untersuchen. Als erledigt gilt die Aufgabe, wenn die übersehene Schwester konsistent behandelt wird und das gemeldete Verhalten beim Lesen außerhalb der Grenzen verifiziert oder widerlegt wurde.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Beschreibung

Summary

Variant analysis of historical fixes in php-src identified 1 code site where an integer-overflow guard, bounds check, or safe-allocation wrapper exists at one location but is missing at a structurally identical sibling location (same file, same function, or same pattern family) elsewhere in the codebase.

Each finding below is code-confirmed against the current HEAD (verified by cloning the repository fresh and checking the pattern is still present), with the exact file/line locations, the root cause, a description of the trigger path, and — where available — ASan/execution verification output or a proof-of-concept.

Note on origin: these were surfaced by an automated variant-analysis pipeline that diffs historical fix commits against sibling code paths, then has each candidate manually reviewed. I'm posting them together per-project rather than as separate issues to respect maintainer time. Happy to split, close, or reprioritize any of these as you see fit.

Finding 1: PHP — mbfl_name2encoding_ex() hash-path OOB read (sibling of strncasecmp strlen fix)

Verified against HEAD: e64029962d0e3378a41e6948557992c7ddae503d (2026-09-25)

*- Project: PHP (php/php-src)

  • Class: Heap-buffer-overflow read (strncasecmp past buffer end via hash-path bypass of strlen guard)
  • Status: Code-confirmed, exec-blocked
  • Sibling of: CVE-2026-6104 fix — added strlen guards to 2 of 3 strncasecmp call sites in same function*

Discovery method

Variant analysis. The CVE-2026-6104 fix added strlen() guards before strncasecmp() calls in mbfl_name2encoding_ex() to prevent reading past the input string. Two of the three call sites were fixed — the third, in the hash-lookup fast path, was missed.

Vulnerable code

ext/mbstring/libmbfl/mbfl/mbfilter.c, line ~335 — mbfl_name2encoding_ex():

// VULNERABLE — hash-lookup fast path:
const mbfl_encoding *mbfl_name2encoding_ex(const char *name, size_t name_len) {
    // ... hash computation on name ...
    
    // FIXED paths (2 call sites): guard with strlen(name) before strncasecmp
    // MISSED path (1 call site, line ~335):
    if (!strncasecmp(name, enc->name, name_len)) {  // OOB read!
        // enc->name could be shorter than name_len
        // strncasecmp reads min(strlen(name), name_len, strlen(enc->name)) bytes
        // if enc->name is "\0" (1 byte) and name_len = 23, reads 1 byte past enc->name
    }
}

FIXED siblings (same function, other call sites):

// SAFE — explicit strlen guard:
if (strlen(enc_name) == name_len && !strncasecmp(name, enc_name, name_len)) {
    // strlen guard prevents OOB
}

Root cause

strncasecmp(s1, s2, n) reads up to n bytes from BOTH s1 and s2. It stops early if either string is shorter — but only AFTER comparing the shorter string's bytes. If s2 (encoding name from the table) is shorter than name_len, strncasecmp reads strlen(s2) bytes and stops. This is safe. But the hash path resolves to a name WITHOUT checking that enc->name length >= name_len. If the hash collision produces an encoding entry whose name is longer or equal, it's safe. If shorter, OOB read of whatever bytes follow enc->name in the data section.

The existing fixes added strlen(enc_name) == name_len before the strncasecmp call — a mechanical guard that the hash path lacks.

Trigger path

  1. Crafted mb_convert_encoding() or mb_detect_encoding() call with a specifically chosen encoding name
  2. → name hashes to an encoding table entry with a shorter name
  3. → strncasecmp reads past enc->name into adjacent static data → OOB read

Fuzz harness: php_php-fuzz-parser (an OSS-Fuzz/fuzzbench harness) — exercises PHP parsing including mbstring operations.

Sibling-gap quality

Excellent. Same function, same strncasecmp pattern, same strlen guard. Two call sites fixed, one missed. The fix is a one-line copy.

Analysis date: 2026-09-22. Code-confirmed, not execution-verified.

Methodology

For each historical vulnerability fix in the codebase, we identified the safe pattern the fix introduced (an overflow guard, a safe allocator wrapper, a bounds check) and searched the rest of the codebase for structurally identical code that predates or postdates the fix but never received it. Each candidate was then manually verified against the current HEAD listed above.

Happy to provide anything else that would help triage — additional PoC inputs, a minimal patch following the existing safe-sibling pattern, or a written reproduction script.

Vorherrschende Sprache
C
Sterne
40.4k
Forks
8.2k
Ø Merge
3 T. 10 Min.
Gemergte PRs (30 T.)
142

Entwicklungsumgebung

Erste Schritte

  1. Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
  2. Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
  3. Forken Sie das Repository und arbeiten Sie in einem Branch.
  4. Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.

Mehr aus php/php-src

Alle Issues in php/php-src

Ähnliche Issues

Weitere Issues zu C

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.