# memory corruption while parsing HTTP response

Malformed HTTP response with bare LF causes negative index in PHP's http_fopen_wrapper.c line-length trimming, leading to stack buffer over-read and DoS.

- Payout: $500
- Severity: medium
- Program: Internet Bug Bounty
- Credited: xixabangm4
- Disclosed: 2019-10-14
- CVE: CVE-2018-7584
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/320222
- Library page: https://bugbountylibrary.com/r/h1%3A320222
- Tags: domain:oss impact:dos kind:bounty platform:hackerone sev:medium tech:php technique:fuzzing technique:source-review vuln:dos vuln:memory-corruption

**Target:** PHP ext/standard/http_fopen_wrapper.c php_stream_url_wrap_http_ex (file_get_contents HTTP wrapper)
**Root cause:** After decrementing tmp_line_len for trailing \n and \r, the code indexes tmp_line[tmp_line_len - 1] without checking tmp_line_len > 0, so a line ending in \n\n (or \n with prior \r) drives the index negative and reads before the buffer.
**Steps:**
1. Build PHP 7.2.2 with ASAN.
2. Create poc file containing `000000000100\n\n` (12 bytes).
3. Serve it: `nc -vvlp 8080 < poc`.
4. Run `bin/php -r 'file_get_contents("http://localhost:8080");'`.
5. Observe ASAN stack-buffer-overflow READ at http_fopen_wrapper.c:723 in php_stream_url_wrap_http_ex.
**How found:** Code review of the HTTP response parsing loop in http_fopen_wrapper.c; noticed the \n/\r trimming decrements tmp_line_len then immediately indexes tmp_line[tmp_line_len - 1] without a lower-bound check, hypothesized negative index on empty/short lines, confirmed with crafted response and ASAN.
**Exploitation:** Attacker controls or MITMs an HTTP server that a PHP app fetches via file_get_contents(); returning a response line ending in bare LF (or LF LF) triggers the underflow, causing out-of-bounds read and crash (DoS). Under non-ASAN, tmp_line_len can reach -1 causing oversized string copy.
**Insight:** When auditing line-trimming loops, check the order of decrement vs. index and whether empty lines (bare LF) can drive the length to zero/negative; fuzz HTTP clients with responses containing bare LF and CRLF edge cases.