Repository navigation
ext/snmp: Attempted free on non-malloced address #23453
Description
Description
Originally reported by @TristanInSec
The following code:
$session = new SNMP(SNMP::VERSION_3, 'localhost', 'user');
$session->setSecurity(
'authPriv', 'SHA', 'authpassword12345', 'AES', 'privpassword12345',
'myContext', str_repeat('aa', 33) // 66 hex chars = 33 bytes > 32-byte buffer
);Produces an ASan error:
=================================================================
==41704==ERROR: AddressSanitizer: attempting free on address which was not malloc()-ed: 0x00010c64d440 in thread T0
#0 0x000104fb5350 in realloc+0x80 (libclang_rt.asan_osx_dynamic.dylib:arm64e+0x41350)
#1 0x000104855348 in snmp_realloc+0x4c (libnetsnmp.45.dylib:arm64+0x29348)
#2 0x000104855b38 in netsnmp_hex_to_binary+0xf8 (libnetsnmp.45.dylib:arm64+0x29b38)
#3 0x0001030f8ebc in snmp_session_set_security snmp.c:1210
#4 0x0001030f87cc in zim_SNMP_setSecurity snmp.c:1751
#5 0x000103703830 in ZEND_DO_FCALL_SPEC_RETVAL_UNUSED_TAILCALL_HANDLER zend_vm_execute.h
#6 0x00010355b034 in execute_ex zend_vm_execute.h:110551
#7 0x00010355b790 in zend_execute zend_vm_execute.h:115989
#8 0x00010390a280 in zend_execute_script zend.c:1980
#9 0x00010331c58c in php_execute_script_ex main.c:2589
#10 0x00010390f664 in do_cli php_cli.c:933
#11 0x00010390d08c in do_php_cli php_cli.c:1346
#12 0x000189c884e0 in start+0x1b4c (dyld:arm64e+0x204e0)
Address 0x00010c64d440 is a wild pointer inside of access range of size 0x000000000001.
SUMMARY: AddressSanitizer: bad-free (libnetsnmp.45.dylib:arm64+0x29348) in snmp_realloc+0x4c
==41704==ABORTING
contextEngineID is a SnmpEngineID type as defined by RFC 3411, and its length must be between 5 and 32 bytes. We should process the value gracefully.
PHP Version
All maintained versions
Operating System
No response
Activity
Use a behavioural description in the phpGH-23453 test title
Fix phpGH-23453: bad free with a context engine ID longer than 32 bytes
Merge branch 'PHP-8.4' into PHP-8.5
Merge branch 'PHP-8.5'