Submit #1018488: phpMyAdmin ShapeFile 4.0.1 CWE-835 -Infinite Loop in ShapeRecord::loadFromFile

phpMyAdmin ShapeFile is prone to an infinite loop (CWE-835) in
ShapeRecord::loadFromFile when parsing a crafted SHP file.

The skip loop that consumes the remainder of a record is bounded only
by a size field read from the file itself:

while ($this->read < $this->size) {
$this->loadData('V', 4);
}

At end-of-file, the underlying fread() call returns an empty string
rather than false. As a result strlen("") == 0, the read counter never
increments, and the loop condition remains true indefinitely. The
process spins in userspace, pinning one CPU core at 100% until the
OS or PHP execution limit terminates it.

Trigger: a valid 100-byte SHP header (shape type Point) followed by a
record header that declares a content length larger than the remaining
file bytes. A total payload of 112 bytes is sufficient.

Impact: remote, unauthenticated denial of service in any application
that feeds untrusted .shp files to this library (upload endpoints,
file importers, GIS pipelines).

Confirmed dynamically on PHP 8.5.10 (ZTS x64, Windows). The skip loop
was captured via both PHP's max_execution_time fatal error and an
external taskkill of php.exe after a 5-second timeout. Full reproducer
and diff available at the advisory link.

Fix: bound the skip loop by checking the return value of loadData(),
and reject records whose declared size exceeds the remaining file
length before entering the loop.

• Source: ⚠️ https://gist.github.com/Ishanoshada/efbda3b5bee92058cc6b08f67d4e7363
• User: ishanoshada (UID 101910)
• Submission: 10/07/2026 13:47 (27 days ago)
• Moderation: 11/03/2026 11:48 (27 days later)
• Status: Accepted
• VulDB entry: 430227 [phpMyAdmin ShapeFile up to 4.0.1 SHP File loadFromFile infinite loop]
• Points: 20