Bug #75686 [NEW]: coding bug
From: yangx92 at hotmail dot com
Operating system: Linux
PHP version: master-Git-2017-12-14 (Git)
Package: XML Writer
Bug Type: Bug
Bug description:coding bug
Description:
------------
There is a coding bug in _xmlwriter_get_valid_file_path function in
ext/xmlwriter/php_xmlwriter.c.
>>>
char file_dirname[MAXPATHLEN];
size_t dir_len;
if (!VCWD_REALPATH(source, resolved_path) &&
!expand_filepath(source, resolved_path)) {
xmlFreeURI(uri);
return NULL;
}
memcpy(file_dirname, source, strlen(source));
>>>
As code showed above, I think there should be a check for strlen(source)
and MAXPATHLEN. If strlen(source) >= MAXPATHLEN, there will be a buffer
overflow.
Test script:
---------------
None
Expected result:
----------------
None
Actual result:
--------------
None
--
Edit bug report at https://bugs.php.net/bug.php?id=75686&edit=1
--
Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=75686&r=trysnapshot54
Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=75686&r=trysnapshot55
Try a snapshot (trunk): https://bugs.php.net/fix.php?id=75686&r=trysnapshottrunk
Fixed in SVN: https://bugs.php.net/fix.php?id=75686&r=fixed
Fixed in release: https://bugs.php.net/fix.php?id=75686&r=alreadyfixed
Need backtrace: https://bugs.php.net/fix.php?id=75686&r=needtrace
Need Reproduce Script: https://bugs.php.net/fix.php?id=75686&r=needscript
Try newer version: https://bugs.php.net/fix.php?id=75686&r=oldversion
Not developer issue: https://bugs.php.net/fix.php?id=75686&r=support
Expected behavior: https://bugs.php.net/fix.php?id=75686&r=notwrong
Not enough info: https://bugs.php.net/fix.php?id=75686&r=notenoughinfo
Submitted twice: https://bugs.php.net/fix.php?id=75686&r=submittedtwice
register_globals: https://bugs.php.net/fix.php?id=75686&r=globals
PHP 4 support discontinued: https://bugs.php.net/fix.php?id=75686&r=php4
Daylight Savings: https://bugs.php.net/fix.php?id=75686&r=dst
IIS Stability: https://bugs.php.net/fix.php?id=75686&r=isapi
Install GNU Sed: https://bugs.php.net/fix.php?id=75686&r=gnused
Floating point limitations: https://bugs.php.net/fix.php?id=75686&r=float
No Zend Extensions: https://bugs.php.net/fix.php?id=75686&r=nozend
MySQL Configuration Error: https://bugs.php.net/fix.php?id=75686&r=mysqlcfg
Thread (2 messages)
- yangx92 at hotmail dot com