# stack-buffer-overflow through "ResourceBundle" methods

ResourceBundle::create/getLocales with a bundlename near 0x7fffffff bytes triggers integer overflow in ICU CharString::ensureCapacity, causing stack buffer overflow in PHP.

- Payout: $500
- Severity: low
- Program: Internet Bug Bounty
- Credited: fms
- Disclosed: 2019-10-13
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/175316
- Library page: https://bugbountylibrary.com/r/h1%3A175316
- Tags: domain:oss impact:dos kind:bounty platform:hackerone sev:low tech:php technique:reverse-engineering technique:source-review vuln:memory-corruption

**Target:** PHP intl extension ResourceBundle::create / getLocales (libicu CharString)
**Root cause:** CharString::ensureCapacity receives capacity 0x80000000 which is interpreted as negative int (-2147483648), so the capacity>buffer.getCapacity() check is false and no reallocation occurs; subsequent append memcpy of 0x7fffffff bytes overflows the 40-byte stack buffer.
**Steps:**
1. Build PHP with intl extension and ASAN, link against ICU 58.
2. Call `ResourceBundle::create($len, ...)` or `ResourceBundle::getLocales($len)` with bundlename length ~0x7fffffff.
3. Observe ensureCapacity(capacity=0x80000000) where `capacity>buffer.getCapacity()` evaluates false.
4. append() then memcpy's sLength=0x7fffffff bytes into a 40-byte buffer -> stack overflow.
**How found:** Debugging with gdb/ASAN on ICU charstr.cpp; noticed capacity printed as -2147483648 and the comparison returning false, then confirmed the oversized memcpy at append.
**Insight:** When a length parameter is passed to a C library that stores it in a signed int, test values straddling 0x7fffffff/0x80000000 to trigger sign-flip in capacity checks; PHP_MAXPATHLEN-style bounds checks at the language boundary prevent this.