# NULL Pointer Dereference in exif_process_user_comment

PHP exif_read_data with a crafted JIS-tagged JPEG passes a NULL encoding pointer into mbstring's converter, causing a NULL pointer dereference crash.

- Payout: hidden
- Severity: medium
- Program: Internet Bug Bounty
- Found by: hoangnguyen
- Disclosed: 2016-08-30
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/152232
- Library page: https://bugbountylibrary.com/r/h1%3A152232
- Tags: area:oss domain:oss impact:dos kind:bounty platform:hackerone sev:medium tech:php technique:source-review vuln:dos vuln:memory-corruption

**Target:** exif_read_data / exif_process_user_comment in PHP ext/exif
**Root cause:** encode_jis INI defaults to empty string, so zend_multibyte_fetch_encoding returns NULL; that NULL is passed unchecked as the 'to' encoding into mbfl_buffer_converter_new2, which dereferences convd->to->no_encoding.
**Steps:**
1. Craft a JPEG whose EXIF UserComment starts with the 8-byte marker `JIS\0\0\0\0\0` followed by data.
2. Run `<?php $exif = exif_read_data('null.jpg'); var_dump($exif); ?>` on a PHP build with mbstring enabled.
3. zend_multibyte_encoding_converter is called with encode_jis (empty string) resolving to NULL.
4. mbfl_buffer_converter_new2 dereferences convd->to->no_encoding in mbfl_convert_filter_get_vtbl, crashing.
**How found:** Reading the exif_process_user_comment JIS branch, noticed encode_jis is initialized to an empty string in PHP_INI_BEGIN, so fetch_encoding returns NULL; traced that NULL through the converter into mbstring and confirmed the missing NULL check by crashing with a crafted JPEG.
**Insight:** When a code path fetches an encoding/config object from an INI value that can be empty, check whether the fetch returns NULL and whether downstream C code dereferences it without validation; EXIF tag branches that switch encodings are a good place to look.