# memcpy negative size parameter in php_resolve_path

Passing a 0x7fffffff-length filename to PHP file functions causes php_resolve_path to call memcpy with a negative size, corrupting memory.

- Payout: $500
- Severity: low
- Program: Internet Bug Bounty
- Credited: fms
- Disclosed: 2017-02-07
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/175311
- Library page: https://bugbountylibrary.com/r/h1%3A175311
- Tags: domain:oss impact:dos kind:bounty platform:hackerone sev:low tech:php technique:source-review vuln:memory-corruption

**Target:** php_resolve_path in fopen_wrappers.c (file functions)
**Root cause:** Integer truncation/sign issue: filename_length of 0x7fffffff is used in a memcpy size computation in php_resolve_path, yielding a negative size on 64-bit builds.
**Steps:**
1. Craft poc.php calling e.g. `file_get_contents()` with a filename of length 0x7fffffff
2. Run under ASan build: `php -n poc.php`
3. Break at fopen_wrappers.c:555 and memcpy; observe `$rdx = -2147483648`
4. memcpy receives negative size, causing memory corruption
**How found:** Researcher inspected php_resolve_path and tested extreme filename lengths, using GDB/ASan to confirm the negative memcpy size argument.
**Insight:** Audit path-resolution helpers for length arithmetic on attacker-controlled filename sizes; test boundary values like 0x7fffffff where int truncation flips sign before memcpy.