Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Variant analysis: 1 unfixed sibling safety gap in php-src

Aperta Adatta ai principianti
  • Qualcosa non va?
#23,958 0 commenti 0 reazioni 1 assegnatario Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
2/5
Tempo stimato
1-3 ore
Idoneità per principianti
72/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
c, php
Ambito
security

Direzione di ricerca

Inizia in ext/mbstring/libmbfl/mbfilter.c, in mbfl_name2encoding_ex(), in particolare sulla chiamata a strncasecmp per la ricerca nell’hash vicino alla riga 335. Confrontala con i due siti di chiamata fratelli protetti ed esegui l’harness php_php-fuzz-parser o le operazioni mbstring pertinenti per esaminare il percorso segnalato. Il lavoro è completato quando il sito di chiamata fratello mancante viene gestito in modo coerente e il comportamento di lettura oltre i limiti segnalato viene verificato o confutato.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Summary

Variant analysis of historical fixes in php-src identified 1 code site where an integer-overflow guard, bounds check, or safe-allocation wrapper exists at one location but is missing at a structurally identical sibling location (same file, same function, or same pattern family) elsewhere in the codebase.

Each finding below is code-confirmed against the current HEAD (verified by cloning the repository fresh and checking the pattern is still present), with the exact file/line locations, the root cause, a description of the trigger path, and — where available — ASan/execution verification output or a proof-of-concept.

Note on origin: these were surfaced by an automated variant-analysis pipeline that diffs historical fix commits against sibling code paths, then has each candidate manually reviewed. I'm posting them together per-project rather than as separate issues to respect maintainer time. Happy to split, close, or reprioritize any of these as you see fit.

Finding 1: PHP — mbfl_name2encoding_ex() hash-path OOB read (sibling of strncasecmp strlen fix)

Verified against HEAD: e64029962d0e3378a41e6948557992c7ddae503d (2026-09-25)

*- Project: PHP (php/php-src)

  • Class: Heap-buffer-overflow read (strncasecmp past buffer end via hash-path bypass of strlen guard)
  • Status: Code-confirmed, exec-blocked
  • Sibling of: CVE-2026-6104 fix — added strlen guards to 2 of 3 strncasecmp call sites in same function*

Discovery method

Variant analysis. The CVE-2026-6104 fix added strlen() guards before strncasecmp() calls in mbfl_name2encoding_ex() to prevent reading past the input string. Two of the three call sites were fixed — the third, in the hash-lookup fast path, was missed.

Vulnerable code

ext/mbstring/libmbfl/mbfl/mbfilter.c, line ~335 — mbfl_name2encoding_ex():

// VULNERABLE — hash-lookup fast path:
const mbfl_encoding *mbfl_name2encoding_ex(const char *name, size_t name_len) {
    // ... hash computation on name ...
    
    // FIXED paths (2 call sites): guard with strlen(name) before strncasecmp
    // MISSED path (1 call site, line ~335):
    if (!strncasecmp(name, enc->name, name_len)) {  // OOB read!
        // enc->name could be shorter than name_len
        // strncasecmp reads min(strlen(name), name_len, strlen(enc->name)) bytes
        // if enc->name is "\0" (1 byte) and name_len = 23, reads 1 byte past enc->name
    }
}

FIXED siblings (same function, other call sites):

// SAFE — explicit strlen guard:
if (strlen(enc_name) == name_len && !strncasecmp(name, enc_name, name_len)) {
    // strlen guard prevents OOB
}

Root cause

strncasecmp(s1, s2, n) reads up to n bytes from BOTH s1 and s2. It stops early if either string is shorter — but only AFTER comparing the shorter string's bytes. If s2 (encoding name from the table) is shorter than name_len, strncasecmp reads strlen(s2) bytes and stops. This is safe. But the hash path resolves to a name WITHOUT checking that enc->name length >= name_len. If the hash collision produces an encoding entry whose name is longer or equal, it's safe. If shorter, OOB read of whatever bytes follow enc->name in the data section.

The existing fixes added strlen(enc_name) == name_len before the strncasecmp call — a mechanical guard that the hash path lacks.

Trigger path

  1. Crafted mb_convert_encoding() or mb_detect_encoding() call with a specifically chosen encoding name
  2. → name hashes to an encoding table entry with a shorter name
  3. → strncasecmp reads past enc->name into adjacent static data → OOB read

Fuzz harness: php_php-fuzz-parser (an OSS-Fuzz/fuzzbench harness) — exercises PHP parsing including mbstring operations.

Sibling-gap quality

Excellent. Same function, same strncasecmp pattern, same strlen guard. Two call sites fixed, one missed. The fix is a one-line copy.

Analysis date: 2026-09-22. Code-confirmed, not execution-verified.

Methodology

For each historical vulnerability fix in the codebase, we identified the safe pattern the fix introduced (an overflow guard, a safe allocator wrapper, a bounds check) and searched the rest of the codebase for structurally identical code that predates or postdates the fix but never received it. Each candidate was then manually verified against the current HEAD listed above.

Happy to provide anything else that would help triage — additional PoC inputs, a minimal patch following the existing safe-sibling pattern, or a written reproduction script.

Lingua principale
C
Stelle
40.4k
Fork
8.2k
Merge medio
3g 10m
PR unite (30g)
142

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di php/php-src

Tutte le issue di php/php-src

Issue simili

Altre issue su C

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.