# Trivial age-old heap overflow in 32-bit PHP

32-bit PHP iptcembed() integer overflow in ext/standard/iptc.c lets a crafted 4GB IPTC file overwrite heap memory with attacker-controlled data.

- Payout: hidden
- Severity: high
- Program: Internet Bug Bounty
- Found by: jbremer
- Disclosed: 2019-11-12
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/112863
- Library page: https://bugbountylibrary.com/r/h1%3A112863
- Tags: area:oss domain:oss impact:rce kind:bounty platform:hackerone sev:high tech:php technique:source-review vuln:memory-corruption

**Target:** ext/standard/iptc.c iptcembed/iptcparse functions
**Root cause:** File length plus constant IPTC header offsets overflow the 32-bit length field used for allocation, so a smaller buffer is allocated than the data written into it.
**Steps:**
1. Create a file `heapyolo` starting with a valid IPTC header `\xff\xd8\xff\xe0\x00\x02\x00\xd9` followed by 4GB of data (4096 * 1MB writes).
2. Call `iptcembed(str_repeat("A", 1024*1024), "heapyolo")` on 32-bit PHP.
3. The filesize plus iptcdata length overflows the 32-bit allocation length.
4. The M_APP0 switch/case copies attacker-controlled iptcdata past the undersized heap buffer.
**How found:** Code review of the ancient iptc.c module, noticing the length arithmetic and allocation at line 207 could overflow on 32-bit; confirmed by crafting a minimal valid IPTC header plus 4GB payload.
**Exploitation:** Attacker who can run a PHP script writes a 4GB file once, then repeatedly calls iptcembed with controlled data to overwrite heap memory with arbitrary values and length, potentially leading to code execution on 32-bit PHP.
**Escalation:** Repeated overwrites possible as long as PHP doesn't crash; heap corruption can be leveraged toward code execution on 32-bit builds.
**Insight:** Legacy ext/standard image-metadata parsers (iptc, exif) do unchecked size arithmetic on file lengths; on 32-bit builds a >4GB file wraps the allocation size, so audit old C extensions for int truncation rather than modern PHP code.