cvs: php-src(PHP_5_0) /ext/standard string.c /main php_variables.c

iliaa Wed Sep 28 18:35:45 2005 EDT Modified files: (Branch: PHP_5_0) /php-src/main php_variables.c /php-src/ext/standard string.c Log: MFH: Fixed possible GLOBALS variable override when register_globals are ON. MFH: Fixed possible register_globals toggle via parse_str(). http://cvs.php.net/diff.php/php-src/main/php_variables.c?r1=1.81.2.12&r2=1.81.2.13&ty=u Index: php-src/main/php_variables.c diff -u php-src/main/php_variables.c:1.81.2.12 php-src/main/php_variables.c:1.81.2.13 --- php-src/main/php_variables.c:1.81.2.12 Thu Sep 1 15:15:51 2005 +++ php-src/main/php_variables.c Wed Sep 28 18:35:42 2005 @@ -17,7 +17,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: php_variables.c,v 1.81.2.12 2005/09/01 19:15:51 iliaa Exp $ */ +/* $Id: php_variables.c,v 1.81.2.13 2005/09/28 22:35:42 iliaa Exp $ */ #include <stdio.h> #include "php.h" @@ -103,6 +103,13 @@ zval_dtor(val); return; } + + /* GLOBALS hijack attempt, reject parameter */ + if (symtable1 == EG(active_symbol_table) && !strcmp("GLOBALS", var)) { + zval_dtor(val); + return; + } + /* ensure that we don't have spaces or dots in the variable name (not binary safe) */ for (p=var; *p; p++) { switch(*p) { http://cvs.php.net/diff.php/php-src/ext/standard/string.c?r1=1.420.2.12&r2=1.420.2.13&ty=u Index: php-src/ext/standard/string.c diff -u php-src/ext/standard/string.c:1.420.2.12 php-src/ext/standard/string.c:1.420.2.13 --- php-src/ext/standard/string.c:1.420.2.12 Sat Jul 16 07:18:35 2005 +++ php-src/ext/standard/string.c Wed Sep 28 18:35:43 2005 @@ -18,7 +18,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: string.c,v 1.420.2.12 2005/07/16 11:18:35 hyanantha Exp $ */ +/* $Id: string.c,v 1.420.2.13 2005/09/28 22:35:43 iliaa Exp $ */ /* Synced with php 3.0 revision 1.193 1999-06-16 [ssb] */ @@ -3809,7 +3809,6 @@ zval *sarg; char *res = NULL; int argCount; - int old_rg; argCount = ZEND_NUM_ARGS(); if (argCount < 1 || argCount > 2 || zend_get_parameters_ex(argCount, &arg, &arrayArg) == FAILURE) { @@ -3822,19 +3821,18 @@ res = estrndup(Z_STRVAL_P(sarg), Z_STRLEN_P(sarg)); } - old_rg = PG(register_globals); if (argCount == 1) { - PG(register_globals) = 1; - sapi_module.treat_data(PARSE_STRING, res, NULL TSRMLS_CC); + zval tmp; + Z_ARRVAL(tmp) = EG(active_symbol_table); + + sapi_module.treat_data(PARSE_STRING, res, &tmp TSRMLS_CC); } else { - PG(register_globals) = 0; /* Clear out the array that was passed in. */ zval_dtor(*arrayArg); array_init(*arrayArg); sapi_module.treat_data(PARSE_STRING, res, *arrayArg TSRMLS_CC); } - PG(register_globals) = old_rg; } /* }}} */