[29517] in bugtraq
Re: @(#)Mordred Labs advisory - Integer overflow in PHP memory allocator
daemon@ATHENA.MIT.EDU (Dullien@gmx.de)
Thu Mar 27 20:00:10 2003
Date: Fri, 28 Mar 2003 00:57:41 +0100 (MET)
From: Dullien@gmx.de
To: Sir Mordred <mordred@s-mail.com>
MIME-Version: 1.0
Message-ID: <27636.1048809461@www17.gmx.net>
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: 8bit
Hey Mr. Mordred, all,
> In PHP emalloc() function implements the error safe wrapper around
> malloc().
> Unfortunately this function suffers from an integer overflow and
> considering the fact that emalloc() is used in many places around PHP
> source code, it may lead to many serious security issues.
IIRC this bug was mentioned in a talk at last summers Black Hat conference.
http://www.blackhat.com/html/bh-usa-02/bh-usa-02-speakers.html#Dowd
Cheers,
dullien@gmx.de
--
+++ GMX - Mail, Messaging & more http://www.gmx.net +++
Bitte lächeln! Fotogalerie online mit GMX ohne eigene Homepage!
