# Illegal write access through Locale methods

PHP intl locale_get_all_variants/locale_get_primary_language passed oversized locale strings to ICU, overflowing an int32 index and causing an illegal write in ulocimp_getLanguage.

- Payout: $500
- Severity: low
- Program: Internet Bug Bounty
- Credited: fms
- Disclosed: 2019-10-13
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/175315
- Library page: https://bugbountylibrary.com/r/h1%3A175315
- Tags: domain:oss impact:dos kind:bounty platform:hackerone sev:low tech:php technique:source-review vuln:memory-corruption

**Target:** PHP ext/intl locale functions (locale_get_all_variants, locale_get_primary_language) backed by ICU ulocimp_getLanguage
**Root cause:** PHP does not bound loc_name_len before passing it to ICU; ICU's ulocimp_getLanguage uses an int32_t index, so strings longer than 0xffffffff overflow the index negative and write out of bounds.
**Steps:**
1. Build PHP with ext/intl and ASAN, link ICU 58.
2. Call `locale_get_all_variants($s)` or `locale_get_primary_language($s)` with a locale string whose length exceeds 0xffffffff.
3. ICU ulocimp_getLanguage computes a negative int32 index (observed i = -2147483648) and writes `language[i]`, triggering SIGSEGV/illegal write.
**How found:** Source review of locale_methods.c noting missing length check before ICU call, then reproducing under GDB/ASAN and inspecting the negative index in ulocimp_getLanguage.
**Exploitation:** Not described beyond triggering the crash under ASAN/GDB; no weaponization shown.
**Insight:** When a PHP extension forwards a size_t length into a C library that indexes with int32_t, look for missing upper-bound checks at the boundary; huge-string inputs can flip signed indices negative and turn a length bug into an OOB write.