0002422: No limit on DBGP read buffer

ID	Project	Category	View Status	Date Submitted	Last Update
0002422	Xdebug	Step Debugging	public	2026-05-19 23:56	2026-06-08 14:36

Reporter	ilia	Assigned To
Priority	normal	Severity	minor	Reproducibility	always
Status	closed	Resolution	fixed
Product Version	3.5.1
Target Version	3.5dev	Fixed in Version	3.5.3

Summary	0002422: No limit on DBGP read buffer
Description	`xdebug_fd_read_line_delim` grows `context->buffer` with `realloc()` in 128-byte chunks until a NUL delimiter arrives. No cap. `_fd_buf::buffer_size` is int; `buffer_size + newl + 1` overflows near `INT_MAX`. `realloc()` return is assigned into context->buffer with no NULL check; subsequent memcpy derefs NULL. Fix: cap at 64 MiB (`XDEBUG_DBGP_MAX_PACKET`), realloc into a temp, NULL-check before assignment, free old buffer on failure.
Steps To Reproduce	Run `attacker.php`: listens on 127.0.0.1:9003, accepts xdebug's connect, reads the init packet, then streams 'A' without ever sending '\0'. Run `victim.php` (xdebug.mode=debug, start_with_request=yes, client_port=9003). Unpatched: victim grows past memory_limit and dies silently; long enough run hits the signed overflow. Patched: connection closed at the cap, victim runs to completion.
Tags	No tags attached.

Operating System
PHP Version	8.4.10-8.4.19

derick 2026-05-27 15:42 administrator ~0007500	https://github.com/xdebug/xdebug/pull/1081