# PHP-FPM fpm_log.c memory leak and buffer overflow

PHP-FPM access log format string with oversized %{...}e env field caused snprintf length miscalculation, leading to out-of-bounds read and write of a newline byte.

- Payout: hidden
- Severity: medium
- Program: Internet Bug Bounty
- Found by: imrerad
- Disclosed: 2019-11-12
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/112723
- Library page: https://bugbountylibrary.com/r/h1%3A112723
- Tags: area:web domain:web impact:data-leak impact:dos kind:bounty platform:hackerone sev:medium tech:php technique:source-review vuln:dos vuln:info-disclosure vuln:memory-corruption

**Target:** PHP-FPM SAPI access logging (fpm_log.c / php-fpm.c)
**Root cause:** snprintf returns the would-be length, not the truncated length; code added len2 to len without clamping, so len exceeded FPM_LOG_BUFFER and subsequent buffer[len]='\n' wrote out of bounds.
**Steps:**
1. Configure access.format with a %{ENV_VAR}e field whose value exceeds remaining FPM_LOG_BUFFER space.
2. Set the corresponding environment variable to a long string.
3. Trigger a request so FPM compiles the log line: `len2 = snprintf(b, FPM_LOG_BUFFER - len, "%s", env ? env : "-");` returns full would-be length.
4. `len += len2` pushes len past FPM_LOG_BUFFER.
5. `buffer[len] = '\n'; write(fpm_log_fd, buffer, len + 1);` performs OOB read and writes newline outside allocation.
**How found:** Code review of the log-line compilation in php-fpm.c, noticing snprintf's return-value semantics were used without bounds checking before indexing buffer[len].
**Exploitation:** Attacker who can influence an environment variable referenced in access.format (or a long field) causes OOB read of adjacent memory into the log and a one-byte OOB write of '\n', potentially crashing or leaking memory via logs.
**Insight:** When building log lines with snprintf into a fixed buffer, the return value is the untruncated length; always clamp or check remaining space before using it as an index or offset.