Vulnerability I am referring to is:


And here in more detail:


So basically what it amounts to is that in the code someone forgot to add an "else" statement and it allows an attacker-controlled string to be interpreted as a ZVAL struct. What I want to know is if an attacker could potentially store something else other than a hardcoded address in the string he/she controlls such as a pointer or register. I'm pretty sure this isn't possible, but if it was it would make code execution much easier.

1 Answer 1


This is a nasty vulnerability. In short, it allows a remote attacker to read and/or write to an arbitrary memory address. So you can't modify a register directly. Being able to read an arbitrary memory address is very important in modern exploitation because it allows you to read an ASLR'ed memory address. This is important because when you control the EIP, you can then point it to the exact memory location of the attacker's shell code. This vulnerability also bypasses canaries, its not a buffer overflow, the attacker can overwrite the return address directly on the stack which will become the EIP when a target function returns.

  • Well I guess its not a traditional overflow but it is an overflow in that you can provide a greater number of variables than was intended that causes unintended behavior. Jun 8, 2012 at 1:16
  • @user1424104 not really, it feels more like a dangling pointer than a buffer overflow to me. But its really neither, its abusing PHP's own strange behavior. This isn't the first ZVAL struct vulnerability found by Stefan Esser.
    – rook
    Jun 8, 2012 at 1:18
  • Could you explain what you mean by "that excludes a pointer to a pointer"? Presumably this vulnerability does allow to overwrite an address that happens to store another pointer. Not sure if that's what you meant by "pointer to a pointer".
    – D.W.
    Jun 8, 2012 at 16:55
  • @D.W. well it won't automatically resolve an address, yeah that was worded poorly. Sorry. Yeah you can overwrite an address no problem.
    – rook
    Jun 8, 2012 at 17:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .