Re: cvs: php4 /main rfc1867.c

Can we use meaningful names, with new code at least? :) As to how to solve this (as the current fix will break *lots* of scripts). There's no real way to mark a certain variable as non-overwritable. This logic is not inside the variable, but outside of it, and thus, we can only decide whether we want newer variables to override old ones, or not (now they do). However, changing this will also probably break lots of scripts. Am I correct in my understanding that this only happens in POST requests that are go through rfc1867.c? If so, we should probably provide a specialized solution here. We can probably add each 'dangerous', to-be-protected variable name to a hash, and wrap php_register_variable() with a function that would deny such variables to overwrite the existing variables. Actually, we can probably make it in a way that this wrapper will also add these strings to the hash. Zeev At 08:09 04-09-00, Rasmus Lerdorf wrote:

rasmus          Sun Sep  3 22:09:46 2000 EDT

Modified files:

    /php4/main  rfc1867.c

Log: Quick-fix for the file upload security alert @Quick-fix for the file upload security alert (Rasmus) Index: php4/main/rfc1867.c diff -u php4/main/rfc1867.c:1.38 php4/main/rfc1867.c:1.39

--- php4/main/rfc1867.c:1.38    Sat Aug  5 23:40:28 2000

+++ php4/main/rfc1867.c Sun Sep 3 22:09:46 2000 @@ -15,7 +15,7 @@

    | Authors: Rasmus Lerdorf <rasmus@php.net>                             |
    +----------------------------------------------------------------------+

*/ -/* $Id: rfc1867.c,v 1.38 2000/08/06 06:40:28 rasmus Exp $ */ +/* $Id: rfc1867.c,v 1.39 2000/09/04 05:09:46 rasmus Exp $ */ #include <stdio.h> #include "php.h" @@ -64,7 +64,7 @@

        int eolsize;
        long bytes, max_file_size = 0;
        char *namebuf=NULL, *filenamebuf=NULL, *lbuf=NULL,
-               *abuf=NULL, *start_arr=NULL, *end_arr=NULL, *arr_index=NULL;
+               *abuf=NULL, *start_arr=NULL, *end_arr=NULL, *arr_index=NULL, *sbuf=NULL;
        FILE *fp;
        int itype, is_arr_upload=0, arr_len=0;
        zval *http_post_files=NULL;

@@ -172,8 +172,10 @@

                                                }
                                                abuf = estrndup(namebuf, strlen(namebuf)-arr_len);
                                                sprintf(lbuf, "%s_name[%s]", abuf, arr_index);
+                                               sbuf = estrdup(abuf);
                                        } else {
                                                sprintf(lbuf, "%s_name", namebuf);
+                                               sbuf = estrdup(abuf);
                                        }
                                        s = strrchr(filenamebuf, '\\');
                                        if (s && s > filenamebuf) {

@@ -252,7 +254,11 @@

                                }
                                *(loc - 4) = '\0';

-                               php_register_variable(namebuf, ptr, array_ptr ELS_CC PLS_CC);
+                               /* Check to make sure we are not overwriting special file
+                               * upload variables */
+                               if(memcmp(namebuf,sbuf,strlen(sbuf))) {
+                                       php_register_variable(namebuf, ptr, array_ptr ELS_CC PLS_CC);
+                               }

                                /* And a little kludge to pick out special MAX_FILE_SIZE */
                                itype = php_check_ident_type(namebuf);

@@ -353,6 +359,7 @@

                                break;
                }
        }
+       if(sbuf) efree(sbuf);
        SAFE_RETURN;

} -- PHP CVS Mailing List (http://www.php.net/) To unsubscribe, e-mail: php-cvs-unsubscribe@lists.php.net For additional commands, e-mail: php-cvs-help@lists.php.net To contact the list administrators, e-mail: php-list-admin@lists.php.net

-- Zeev Suraski <zeev@zend.com> http://www.zend.com/