PHP Substr_replace replacing a specified location character with a Memory Corruption Vulnerability _php Tutorial

PHP Tutorial Substr_replace Replacing a specified location character with a memory corruption vulnerability

Hints and Notes
Note: If start is negative and length is less than or equal to start, length is 0.

$username = "Zongzi";
Echo substr_replace ($username, ' * * ', ' 1 ', ' 2 ');

Definition and usage
The Substr_replace () function replaces part of a string with another string.

Grammar
Substr_replace (string,replacement,start,length) parameter description
string is required. Specifies the string to check.
Replacement required. Specifies the string to insert.
Start Required. Specifies where the string begins to be replaced.

Positive number-starts with the first offset
Negative number-replaces the start offset starting at the end of a string
0-Start the substitution at the first character in the string

Charlist is optional. Specifies the number of characters to replace.

Positive number-The length of the string being replaced
Negative-the number of characters to be replaced starting at the end of the string
0-Insert rather than replace

function with PHP substr_replace ()

' Parameters: replaced content, replacement content, starting bit, replacement length

function Substr_replace (Sourcecon,repcon,startx,lenx)
Dim reped
reped = Mid (Sourcecon,startx,lenx) ' Take out the original content the same length
Dim scleftx,scleft
SCLEFTX = startx-1
If Scleftx<1 Then
Scleft = ""
Else
Scleft = Left (SOURCECON,SCLEFTX)
End If
Substr_replace = replace (sourcecon,reped,repcon,startx,1)
Substr_replace = Scleft&substr_replace
End Function

() Interrupt Memory Corruption Vulnerability
Bugraq ID:
CVE id:cve-2010-2190
Cncve id:cncve-20102190

Issue date: 2010-05-31
Vulnerability Updated: 2010-06-28

Vulnerability causes
Design Error
Hazard rating
Low

Impact system
PHP 5.2 <= 5.2.13
PHP 5.3 <= 5.3.2

Non-affected systems

Harm
Remote attackers can exploit vulnerabilities to leak sensitive information.

Conditions required for the attack
An attacker would have to access an application that uses the Substr_replace () function.

Vulnerability Information
PHP is a popular network programming language.
There is an information disclosure problem with PHP's Substr_replace () function:

Php_function (Substr_replace)
{
...
if (Zend_parse_parameters (Zend_num_args () tsrmls_cc, "Zzz|z", &str, &repl, &from, &len) = = failure) {
Return
}

if (Z_TYPE_PP (str)! = Is_array) {
CONVERT_TO_STRING_EX (str);
}
if (Z_TYPE_PP (REPL)! = Is_array) {
CONVERT_TO_STRING_EX (REPL);
}
if (Z_TYPE_PP (from)! = Is_array) {
CONVERT_TO_LONG_EX (from);
}
if (argc > 3) {
Separate_zval (len);
if (z_type_pp (len) = Is_array) {
CONVERT_TO_LONG_EX (len);
L = z_lval_pp (len);
}
} else {
if (Z_TYPE_PP (str)! = Is_array) {
L = z_strlen_pp (str);
}
}
if (z_type_pp (str) = = is_string) {
if (
(argc = = 3 && z_type_pp (from) = = Is_array) | |
(argc = = 4 && z_type_pp (from)! = Z_TYPE_PP (len))
) {
Php_error_docref (null TSRMLS_CC, E_warning, "' from ' and ' Len ' should is of same type-numerical or array");
Return_stringl (Z_STRVAL_PP (str), Z_STRLEN_PP (str), 1);
}

Invoking the Substr_replace () function with different types of ' from ' and ' len ' arguments will trigger a e_warning error. If PHP is not removed by reference passing, the user space error handler will use this interrupt to change the ' str ' parameter type. If the ' str ' type is changed to an integer type, it can cause a leak of arbitrary memory, and if ' str ' is changed to an array, a hash table with significant memory offsets is allowed to be leaked.

http://www.bkjia.com/PHPjc/445368.html www.bkjia.com true http://www.bkjia.com/PHPjc/445368.html techarticle PHP tutorial Substr_replace replacing specified positional characters with memory corruption hints and comment comments: If start is negative and length is less than or equal to start, length is 0. $username = ...

