# Out-Of-Bounds Read in timelib_meridian()

Invalid dateTime in wddx_deserialize triggers heap out-of-bounds read in timelib_meridian(), letting remote attackers peek process memory via echoed results.

- Payout: $500
- Severity: medium
- Program: Internet Bug Bounty
- Credited: xixabangm4
- Disclosed: 2019-10-14
- CVE: CVE-2017-16642, CVE-2017-11145
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/283644
- Library page: https://bugbountylibrary.com/r/h1%3A283644
- Tags: domain:web impact:data-leak kind:bounty platform:hackerone sev:medium tech:php technique:regression technique:source-review vuln:info-disclosure vuln:memory-corruption

**Target:** PHP wddx_deserialize / timelib_meridian() date parser
**Root cause:** timelib_meridian() reads past the end of the input buffer when parsing malformed 'back of'/'front of' meridian directives in an invalid dateTime string.
**Steps:**
1. Craft a WDDX packet containing an invalid dateTime value using 'back of'/'front of' meridian directives.
2. Pass it to `wddx_deserialize()` (network-reachable).
3. Parser reaches `timelib_meridian()` and reads out-of-bounds heap memory.
4. If the result is echoed back to the client, leaked bytes are returned.
**How found:** Noted similarity to CVE-2017-11145 and traced the 'back of'/'front of' meridian directives in timelib format to a separate OOB read.
**Exploitation:** Send malformed WDDX dateTime to an endpoint calling wddx_deserialize(); if output is reflected, observe out-of-bounds heap bytes in the response.
**Insight:** Date/time parser meridian directives ('back of'/'front of') are a recurring OOB source; fuzz deserializers that feed timelib with malformed dateTime strings and check for reflected output.