cvs: php-src /ext/standard string.c /main php_variables.c

iliaa Wed Sep 28 18:31:30 2005 EDT Modified files: /php-src/main php_variables.c /php-src/ext/standard string.c Log: Fixed possible GLOBALS variable override when register_globals are ON. Fixed possible register_globals toggle via parse_str(). http://cvs.php.net/diff.php/php-src/main/php_variables.c?r1=1.108&r2=1.109&ty=u Index: php-src/main/php_variables.c diff -u php-src/main/php_variables.c:1.108 php-src/main/php_variables.c:1.109 --- php-src/main/php_variables.c:1.108 Thu Sep 1 15:14:54 2005 +++ php-src/main/php_variables.c Wed Sep 28 18:31:26 2005 @@ -17,7 +17,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: php_variables.c,v 1.108 2005/09/01 19:14:54 iliaa Exp $ */ +/* $Id: php_variables.c,v 1.109 2005/09/28 22:31:26 iliaa Exp $ */ #include <stdio.h> #include "php.h" @@ -118,6 +118,13 @@ zval_dtor(val); return; } + + /* GLOBALS hijack attempt, reject parameter */ + if (symtable1 == EG(active_symbol_table) && !strcmp("GLOBALS", var)) { + zval_dtor(val); + return; + } + /* ensure that we don't have spaces or dots in the variable name (not binary safe) */ for (p=var; *p; p++) { switch (*p) { http://cvs.php.net/diff.php/php-src/ext/standard/string.c?r1=1.485&r2=1.486&ty=u Index: php-src/ext/standard/string.c diff -u php-src/ext/standard/string.c:1.485 php-src/ext/standard/string.c:1.486 --- php-src/ext/standard/string.c:1.485 Wed Sep 28 10:58:31 2005 +++ php-src/ext/standard/string.c Wed Sep 28 18:31:29 2005 @@ -18,7 +18,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: string.c,v 1.485 2005/09/28 14:58:31 rolland Exp $ */ +/* $Id: string.c,v 1.486 2005/09/28 22:31:29 iliaa Exp $ */ /* Synced with php 3.0 revision 1.193 1999-06-16 [ssb] */ @@ -4786,7 +4786,6 @@ zval *sarg; char *res = NULL; int argCount; - int old_rg; argCount = ZEND_NUM_ARGS(); if (argCount < 1 || argCount > 2 || zend_get_parameters_ex(argCount, &arg, &arrayArg) == FAILURE) { @@ -4799,19 +4798,18 @@ res = estrndup(Z_STRVAL_P(sarg), Z_STRLEN_P(sarg)); } - old_rg = PG(register_globals); if (argCount == 1) { - PG(register_globals) = 1; - sapi_module.treat_data(PARSE_STRING, res, NULL TSRMLS_CC); + zval tmp; + Z_ARRVAL(tmp) = EG(active_symbol_table); + + sapi_module.treat_data(PARSE_STRING, res, &tmp TSRMLS_CC); } else { - PG(register_globals) = 0; /* Clear out the array that was passed in. */ zval_dtor(*arrayArg); array_init(*arrayArg); sapi_module.treat_data(PARSE_STRING, res, *arrayArg TSRMLS_CC); } - PG(register_globals) = old_rg; } /* }}} */