# out of bounds read crashes php-cgi

PHP CGI mmap path mishandles a .php file starting with '#' and no newline, causing an out-of-bounds read that leaks php-cgi memory or may enable code execution.

- Payout: hidden
- Severity: medium
- Program: Internet Bug Bounty
- Found by: geeknik
- Disclosed: 2014-12-30
- CVE: CVE-2014-9427
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/73234
- Library page: https://bugbountylibrary.com/r/h1%3A73234
- Tags: area:oss domain:oss impact:data-leak impact:rce kind:bounty platform:hackerone sev:medium tech:php vuln:info-disclosure vuln:memory-corruption

**Target:** php-cgi SAPI (sapi/cgi/cgi_main.c) reading .php files via mmap
**Root cause:** When mmap is used to read a .php file, the CGI SAPI does not properly consider the mapping's length while processing an invalid file that begins with '#' and lacks a newline, causing an out-of-bounds read.
**Steps:**
1. Upload or place a .php file whose content begins with `#` and contains no newline character.
2. Cause php-cgi to process that file with mmap-based reading enabled.
3. The parser reads past the end of the mapping, disclosing adjacent process memory or reaching adjacent mapped PHP script bytes.
**Exploitation:** Attacker leverages the ability to upload a .php file; the OOB read can leak sensitive information from php-cgi process memory, or trigger unexpected code execution if a valid PHP script sits in memory adjacent to the mapping.
**Insight:** Edge-case file contents (leading '#' with no newline) interacting with mmap length handling in the CGI SAPI: test parser boundary conditions on memory-mapped input where the mapping length differs from logical file length.