. Description

. Analysis

http://www.chinaz.com/news/2015/0520/407861.shtml

https://portal.nsfocus.com/vulnerability/list/

SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_post_handler) /* {{{ */

{

    ..

    while (!multipart_buffer_eof(mbuff))

    {

        char buff[FILLUNIT];

        char *cd = NULL, *param = NULL, *filename = NULL, *tmp = NULL;

        size_t blen = , wlen = ;

        zend_off_t offset;

        zend_llist_clean(&header);

        if (!multipart_buffer_headers(mbuff, &header)) {

            goto fileupload_done;

        }

        ..

/* parse headers */

static int multipart_buffer_headers(multipart_buffer *self, zend_llist *header)

{

    char *line;

    mime_header_entry prev_entry = {}, entry;

    int prev_len, cur_len;

    /* didn't find boundary, abort */

    if (!find_boundary(self, self->boundary))

    {

        return ;

    }

    /* get lines of text, or CRLF_CRLF */

    //1. Step 1. The multipart_buffer_headers executes while loop cycle to parse current body part headers, if the boundary string was found.

    while( (line = get_line(self)) && line[] != '\0' )

    {

        /*

        2. When parseing current body part headers which is represented as (header, value),

        the multipart_buffer_headers function firstly call get_line function to read a line of characters, but get_line return a line when it meets character '\n', not '\r\n'.

        After getting a line which is stored in the variable 'line', the multipart_buffer_headers function parses the variable line.

        /* add header to table

        PHP每次读取HTTP body header中的一行

        */

        char *key = line;

        char *value = NULL;

        if (php_rfc1867_encoding_translation())

        {

            self->input_encoding = zend_multibyte_encoding_detector((const unsigned char *) line, strlen(line), self->detect_order, self->detect_order_size);

        }

        /* space in the beginning means same header */

        if (!isspace(line[]))

        {

            //寻找":"作为key-value的分界符

            value = strchr(line, ':');

        }

        if (value)

        {

            *value = ;

            do { value++; } while(isspace(*value));

            entry.value = estrdup(value);

            entry.key = estrdup(key);

        }

        //3. And then, it calls zend_llist_add_element function to store entry

        else if (zend_llist_count(header))

        {

            /* If no ':' on the line, add to previous line */

            /*

            4. In this step, the multipart_buffer_headers function thinks current line is not a new header,

            and current line should be append to value of prev_entry. Thus, prev_entry and current line merge into a new entry by executing the following codes:

            */

            prev_len = (int)strlen(prev_entry.value);

            cur_len = (int)strlen(line);

            entry.value = emalloc(prev_len + cur_len + );

            memcpy(entry.value, prev_entry.value, prev_len);

            memcpy(entry.value + prev_len, line, cur_len);

            entry.value[cur_len + prev_len] = '\0';

            entry.key = estrdup(prev_entry.key);

            //// free memory

            zend_llist_remove_tail(header);

        } else {

            continue;

        }

        zend_llist_add_element(header, &entry);

        prev_entry = entry;

    }

    return ;

}

. If value of body part header consists of n lines

. and first character of each line is not blank character

. and each line did constains character ':'

. executes string copy operation twice, frees memory once.

. Each time mergence of entry.value increase length of body part header's value. 每次申请的内存在不断扩大

. thus string copy operations will cause the consumption of CPU resources, and then the service is not available.

//If n is the length of body part header's value, and copying one byte is the unit time complexity，the time complexity of multipart_buffer_headers function is O(n*m) 

------WebKitFormBoundarypE33TmSNWwsMphqz

Content-Disposition: form-data; name="file"; filename="s

a

a

a

a"

Content-Type: application/octet-stream 

<?php phpinfo();?>

------WebKitFormBoundarypE33TmSNWwsMphqz 

. The first time execution copys  bytes

. The second execution copys  bytes

. The third time execution copys  bytes

. The fourth time execution copys  bytes

. Thus, the multipart_buffer_headers function executes  times byte copy operation. 

https://bugs.php.net/bug.php?id=69364