# CVE-2016-7418 PHP Out-Of-Bounds Read in php_wddx_push_element

Out-of-bounds read in PHP's php_wddx_push_element when parsing WDDX XML with malformed var attributes, causing strcmp to dereference attacker-influenced memory.

- Payout: hidden
- Severity: medium
- Program: Internet Bug Bounty
- Found by: binvul
- Disclosed: 2020-10-10
- CVE: CVE-2016-7418
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/170618
- Library page: https://bugbountylibrary.com/r/h1%3A170618
- Tags: area:oss domain:oss impact:dos kind:bounty platform:hackerone sev:medium tech:php technique:source-review vuln:dos vuln:memory-corruption

**Target:** ext/wddx WDDX deserializer (wddx_deserialize)
**Root cause:** The attribute loop checks atts[i] in the for-condition but indexes atts[++i] inside the if without re-validating, so a NULL terminator at atts[2] is skipped and strcmp reads atts[3] out of bounds.
**Steps:**
1. Build PHP 7.0.10 with `-fsanitize=address`
2. Craft WDDX XML with `<var Name="name">` followed by nested `<var name="1111">` elements
3. Call `wddx_deserialize($xml)`
4. Observe ASan SEGV in `__interceptor_strcmp` called from `php_wddx_push_element` wddx.c:791
5. Under GDB, inspect `$rdi` to see attacker-influenced bytes like `\x01xPacket`
**How found:** Code review of the attribute iteration loop revealed the mismatch between the for-loop NULL check and the inner `atts[++i]` access; GDB inspection of the faulting strcmp pointer showed controllable bytes, upgrading a NULL-deref to an OOB read.
**Insight:** When a loop guards `atts[i]` but the body does `atts[++i]`, the increment can skip the NULL sentinel and read past the array — audit every `++i` inside attribute-parsing loops for this off-by-one sentinel bypass.