# Integer Overflow in php_html_entities()

php_html_entities truncates size_t new_len to signed int, producing a corrupted string ZVAL that overflows on string ops, enabling memory corruption/RCE.

- Payout: hidden
- Severity: high
- Program: Internet Bug Bounty
- Found by: ryat
- Disclosed: 2019-10-13
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/140865
- Library page: https://bugbountylibrary.com/r/h1%3A140865
- Tags: area:oss domain:oss impact:integrity impact:rce kind:bounty platform:hackerone sev:high tech:php technique:source-review vuln:memory-corruption vuln:rce

**Target:** PHP core htmlspecialchars/htmlentities string handling
**Root cause:** new_len is size_t but cast to (int) in RETVAL_STRINGL, so oversized input wraps to a negative length and creates a corrupted string-typed ZVAL.
**Steps:**
1. Set `ini_set('memory_limit', -1)`
2. Build input `str_repeat('&', 0xffffffff/5)`
3. Call `htmlspecialchars()` on it to trigger the size_t->int truncation
4. Pass the corrupted ZVAL to a string function like `md5($str)` to trigger integer overflow/memory corruption
**How found:** Code review of php_html_entities spotted the size_t new_len being cast to signed int in RETVAL_STRINGL, hypothesizing negative length on large input.
**Exploitation:** Attacker-controlled input passed to htmlspecialchars/htmlentities (e.g. Phabricator's htmlentities($_POST['account_name'])) produces a corrupted ZVAL; subsequent string operations overflow and corrupt memory, potentially leading to RCE.
**Escalation:** Chaining the corrupted ZVAL into many internal functions (md5, class_exists, date, collator_create, etc.) broadens the memory-corruption surface.
**Insight:** Audit type-width mismatches where size_t lengths are cast to int in ZVAL/string constructors; oversized inputs near 2^32/5 can wrap lengths and corrupt ZVALs consumed by many internal functions.