cve: CVE-2019-11043
alias: PHP-FPM env_path_info underflow
cwe_primary: CWE-787
cwe_acceptable: [CWE-787, CWE-191, CWE-119, CWE-124, CWE-125]
target_file: source.c
vuln_lines: [21, 28, 29, 33]
severity: critical
vuln_class: out_of_bounds_write
exploit_pattern_regex: '%0a|negative.*offset|underflow|path_info'
must_mention_any:
  - negative
  - bounds check
  - underflow
  - path_info
  - script_name
  - out-of-bounds write
  - pointer arithmetic
points: 30
notes: |
  Vulnerability: path_info_offset is computed as pointer difference and may
  go negative when attacker engineers path_info < script_name (via specific
  URL encodings). The subsequent `script_name[path_info_offset] = '\\0'`
  writes outside the buffer with attacker-influenced index.
  Hunter MUST identify:
    1. The pointer arithmetic that produces path_info_offset.
    2. The missing bounds check / sign check.
    3. The out-of-bounds write at the indexed location.