Bug #73020 [NEW]: GD fontnames can violate open_basedir restriction

From: cmb Operating system: * PHP version: 7.1Git-2016-09-05 (Git) Package: GD related Bug Type: Bug Bug description:GD fontnames can violate open_basedir restriction Description: ------------ I've just stumbled upon <https://bugs.php.net/bug.php?id=64823> and that pointed me to a potential security issue, namely that the open_basedir check[1] is useless for font names (which are looked up in the standard font directories). Even worse, not only a font name, but actually a semicolon delimited font name list[2] is accepted by gdImageStringFT() and friends, what is not catered to by the PHP binding at all, i.e. the reproduce script works in non ZTS mode (if myfont.ttf exists in the parent dir), even if open_basedir=.. [1] <https://github.com/php/php-src/blob/PHP-7.0.11/ext/gd/gd.c#L3914> [2] <https://github.com/php/php-src/blob/PHP-7.0.11/ext/gd/libgd/gdft.c#L81-L85> Test script: --------------- var_dump( imagettfbbox(14, 0, 'doesnotexist.tff;../myfont.ttf', 'foo') === false ); Expected result: ---------------- Warning: fopen(): open_basedir restriction in effect. File(../myfont.ttf) is not within the allowed path(s): (.) in %s on line %d bool(true) Actual result: -------------- bool(false) -- Edit bug report at https://bugs.php.net/bug.php?id=73020&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=73020&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=73020&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=73020&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=73020&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=73020&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=73020&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=73020&r=needscript Try newer version: https://bugs.php.net/fix.php?id=73020&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=73020&r=support Expected behavior: https://bugs.php.net/fix.php?id=73020&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=73020&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=73020&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=73020&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=73020&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=73020&r=dst IIS Stability: https://bugs.php.net/fix.php?id=73020&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=73020&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=73020&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=73020&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=73020&r=mysqlcfg