# PHP WDDX Deserialization Heap OOB Read in timelib_meridian()

Malformed WDDX dateTime string causes heap out-of-bounds read in timelib_meridian() during wddx_deserialize(), potentially leaking process memory to remote clients.

- Payout: $500
- Severity: medium
- Program: Internet Bug Bounty
- Credited: xixabangm4
- Disclosed: 2019-10-14
- CVE: CVE-2017-11145
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/248659
- Library page: https://bugbountylibrary.com/r/h1%3A248659
- Tags: domain:web impact:data-leak kind:bounty platform:hackerone sev:medium tech:php technique:fuzzing technique:source-review vuln:info-disclosure vuln:memory-corruption

**Target:** PHP ext/wddx wddx_deserialize() / timelib date parser
**Root cause:** timelib_meridian() reads past the end of a heap buffer allocated by timelib_string() when parsing a truncated/invalid meridian token in a dateTime value; no bounds check on the remaining length.
**Steps:**
1. Build PHP 7.1.6 with `CFLAGS="-O0 -g -fsanitize=address" ./configure --disable-shared --enable-wddx`
2. Set `USE_ZEND_ALLOC=0`
3. Craft WDDX packet with `<dateTime>I06.00am 0</dateTime>` inside a struct var
4. Call `wddx_deserialize($wddx_str)` on the packet
5. Observe ASAN heap-buffer-overflow READ of size 1 in `timelib_meridian` at parse_date.c:410
**How found:** Fuzzing/edge-case testing of dateTime values in WDDX deserialization; an invalid meridian token ('am' followed by trailing data) triggered ASAN in timelib_meridian, traced via stack to timelib_string allocation.
**Exploitation:** If the deserialized result is echoed back to the client, the OOB read past the 10-byte timelib_string buffer could disclose adjacent heap memory to a remote attacker. No full end-to-end exfil demonstrated.
**Insight:** Date/time parser meridian handling assumes a well-formed token; feed truncated or trailing-garbage meridian strings ('am 0', 'I06.00am') through any API that calls timelib_strtotime (wddx, date parsing) under ASAN to find similar OOB reads.