# wddx_deserialize allows illegal memory access

Malformed WDDX dateTime with embedded \r causes wddx_deserialize to treat attacker-controlled timestamp bytes as a pointer, yielding illegal memory access and crash.

- Payout: $500
- Severity: high
- Program: Internet Bug Bounty
- Credited: fms
- Disclosed: 2019-10-31
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/161200
- Library page: https://bugbountylibrary.com/r/h1%3A161200
- Tags: domain:oss impact:dos kind:bounty platform:hackerone sev:high tech:php technique:fuzzing technique:source-review vuln:deserialization vuln:memory-corruption

**Target:** PHP ext/wddx wddx_deserialize dateTime parser
**Root cause:** The WDDX dateTime parser mishandles an embedded \r in the value, misparsing the timestamp and assigning the supplied value as the address of the created zval, producing a corrupted pointer.
**Steps:**
1. Craft WDDX packet with `<dateTime>2\r2004-09-10T05:52:49+00</dateTime>` inside a struct var.
2. Call `wddx_deserialize($xml)` on the packet.
3. Observe SIGSEGV in `php_var_dump` with RSI/RDI containing 0x41414131 (timestamp bytes) as the zval pointer.
4. Confirm via gdb that `struc->value.lval` equals 0x41414131, showing attacker control of the read register.
**How found:** Fuzzing PHP with phuzzer/ASAN; noticed the crash correlated with a \r inside the dateTime value, then used gdb to confirm the timestamp bytes (0x41414131) landed in the register used for reading.
**Exploitation:** Attacker supplies a WDDX packet (typically from external input) containing a dateTime with an embedded \r; deserialization misparses and uses the timestamp value as a pointer, causing illegal memory access/crash. No full RCE chain demonstrated.
**Insight:** When fuzzing deserializers, watch for parser branches that convert string fields into numeric/pointer values; embedded control characters like \r can desync the parser and let field content become a pointer.