# Invalid parameter in memcpy function trough openssl_pbkdf2

PHP 5.6 openssl_pbkdf2 passed a key_length > 0x7fffffff as a negative size to memcpy in PKCS5_PBKDF2_HMAC, causing memory corruption.

- Payout: $500
- Severity: low
- Program: Internet Bug Bounty
- Credited: emyei
- Disclosed: 2017-02-08
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/190933
- Library page: https://bugbountylibrary.com/r/h1%3A190933
- Tags: domain:oss impact:dos kind:bounty platform:hackerone sev:low tech:php technique:regression technique:source-review vuln:memory-corruption

**Target:** openssl_pbkdf2() in ext/openssl
**Root cause:** PHP 5.6 lacked the PHP_OPENSSL_CHECK_NUMBER_CONVERSION macro used in 7.0, so a key_length above 0x7fffffff was truncated to a negative int and forwarded as the memcpy size inside PKCS5_PBKDF2_HMAC.
**Steps:**
1. Build PHP 5.6 with ASan.
2. Call `openssl_pbkdf2($password, $salt, $key_length, $iterations)` with `$key_length > 0x7fffffff`.
3. Observe ASan negative-size-param (size=-1) in __asan_memcpy called from PKCS5_PBKDF2_HMAC.
**How found:** Researcher noticed PHP 7.0 added PHP_OPENSSL_CHECK_NUMBER_CONVERSION around the key_length argument and tested the 5.6 branch without that guard, triggering the negative-size memcpy under ASan.
**Insight:** When a newer branch adds a numeric-conversion guard macro around a length argument, diff the older branch for that same call site and fuzz the boundary value (0x7fffffff) to confirm the missing check.