# An integer overflow bug in php_implode() could lead heap overflow, make PHP to crash

Integer overflow in php_implode() on 32-bit PHP 7.1.0 lets attacker-controlled length wrap zend_string_alloc, causing heap overflow and crash, potentially memory leak.

- Payout: hidden
- Severity: high
- Program: Internet Bug Bounty
- Found by: blue9057
- Disclosed: 2019-11-12
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/113120
- Library page: https://bugbountylibrary.com/r/h1%3A113120
- Tags: area:oss domain:oss impact:data-leak impact:dos kind:bounty platform:hackerone sev:high tech:php technique:source-review vuln:info-disclosure vuln:memory-corruption

**Target:** PHP ext/standard/string.c php_implode()
**Root cause:** len + (numelems - 1) * ZSTR_LEN(delim) is computed without overflow check before zend_string_alloc(); on 32-bit the multiplication wraps, allocating a too-small buffer.
**Steps:**
1. Build 32-bit PHP 7.1.0-dev.
2. Create array of 65536 elements each 'aa'.
3. Set delimiter to str_repeat('ABCD', 16384) so (numelems-1)*delim_len overflows 32-bit.
4. Call `implode($text1, $arr)`.
5. Observe SIGSEGV in php_implode at string.c:1255 with eax/ecx = 0x44434241 (attacker-controlled delimiter bytes).
**How found:** Code review of ext/standard/string.c:1249 spotted missing overflow check on the length computation; confirmed via crafted implode() PoC under gdb on 32-bit build.
**Exploitation:** Attacker controls %eax and %ecx via delimiter content; the copy at php_implode+440 reads from address in %eax to %edx. With careful control of GOT/heap addresses, the string copy could be redirected over sensitive memory to leak data into a PHP string variable.
**Escalation:** Potential to target GOT entries or heap addresses to leak memory contents into a PHP string.
**Insight:** On 32-bit builds, audit length arithmetic like len + (n-1)*delim_len in string builders for wrap before allocation; delimiter bytes directly land in registers, giving control of copy source/dest.