0002424: Control-socket buffer crashes

ID	Project	Category	View Status	Date Submitted	Last Update
0002424	Xdebug	Step Debugging	public	2026-05-20 00:36	2026-06-08 14:36

Reporter	ilia	Assigned To
Priority	normal	Severity	minor	Reproducibility	always
Status	closed	Resolution	open
Product Version	3.5.1
Target Version	3.5dev	Fixed in Version	3.5.3

Summary	0002424: Control-socket buffer crashes
Description	3 issues in 1 file, so 1 patch to keep it simple `read(new_sd, buffer, sizeof(buffer))` at ~line 292 leaves no room for NUL. A full 256-byte send leaves no terminator; `xdebug_log_ex("Received: '%s'", buffer)` walks past via `strlen`; `xdebug_cmd_parse(buffer)` walks past via its state machine. zero-byte read passes the `bytes_read == -1` check,`xdebug_cmd_parse` returns parse_error with`*cmd == NULL`, `lookup_cmd(NULL)` does `strcmp(name, NULL)` and crashes. Fix: read cap to `sizeof(buffer)-1`, explicit `NUL` at`buffer[bytes_read]`, reject `bytes_read <= 0` NULL-check cmd before `lookup_cmd` Test covers 1st & last
Steps To Reproduce	Start `victim.php` (xdebug.mode=develop, xdebug.control_socket=default). Run `attacker.php` a (256 non-NUL bytes), `attacker.php` c (immediate close) Unpatched: ASan stack-buffer-overflow at`ctrl_socket.c:296` SEGV at `lookup_cmd`
Tags	No tags attached.

Operating System
PHP Version	8.4.10-8.4.19

derick 2026-06-08 10:03 administrator ~0007516	https://github.com/xdebug/xdebug/pull/1089