cvs: php-src(PHP_4_4) / NEWS /ext/curl curl.c curlstreams.c /ext/standard string.c Zend zend_alloc.c

iliaa Thu Aug 10 17:27:12 2006 UTC Modified files: (Branch: PHP_4_4) /php-src NEWS /php-src/ext/curl curl.c curlstreams.c /Zend zend_alloc.c /php-src/ext/standard string.c Log: MFH: Various security fixes

http://cvs.php.net/viewvc.cgi/php-src/NEWS?r1=1.1247.2.920.2.150&r2=1.1247.2.920.2.151&diff_format=u Index: php-src/NEWS diff -u php-src/NEWS:1.1247.2.920.2.150 php-src/NEWS:1.1247.2.920.2.151 --- php-src/NEWS:1.1247.2.920.2.150 Tue Aug 8 14:57:04 2006 +++ php-src/NEWS Thu Aug 10 17:27:11 2006 @@ -1,6 +1,10 @@ PHP 4 NEWS ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ?? ??? 2006, Version 4.4.4 +- Fixed memory_limit on 64bit systems. (Stefan E.) +- Fixed overflow on 64bit systems in str_repeat() and wordwrap(). (Stefan E.) +- Disabled CURLOPT_FOLLOWLOCATION in curl when open_basedir or safe_mode are + enabled. (Stefan E.) - Fixed bug #38377 (session_destroy() gives warning after session_regenerate_id()). (Ilia) - Fixed bug #38322 (reading past array in sscanf() leads to arbitary code http://cvs.php.net/viewvc.cgi/php-src/ext/curl/curl.c?r1=1.124.2.30.2.11&r2=1.124.2.30.2.12&diff_format=u Index: php-src/ext/curl/curl.c diff -u php-src/ext/curl/curl.c:1.124.2.30.2.11 php-src/ext/curl/curl.c:1.124.2.30.2.12 --- php-src/ext/curl/curl.c:1.124.2.30.2.11 Sun May 21 18:48:50 2006 +++ php-src/ext/curl/curl.c Thu Aug 10 17:27:11 2006 @@ -16,7 +16,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: curl.c,v 1.124.2.30.2.11 2006/05/21 18:48:50 helly Exp $ */ +/* $Id: curl.c,v 1.124.2.30.2.12 2006/08/10 17:27:11 iliaa Exp $ */ #ifdef HAVE_CONFIG_H #include "config.h" @@ -924,7 +924,6 @@ case CURLOPT_FTPLISTONLY: case CURLOPT_FTPAPPEND: case CURLOPT_NETRC: - case CURLOPT_FOLLOWLOCATION: case CURLOPT_PUT: #if CURLOPT_MUTE != 0 case CURLOPT_MUTE: @@ -961,6 +960,16 @@ convert_to_long_ex(zvalue); error = curl_easy_setopt(ch->cp, option, Z_LVAL_PP(zvalue)); break; + case CURLOPT_FOLLOWLOCATION: + convert_to_long_ex(zvalue); + if ((PG(open_basedir) && *PG(open_basedir)) || PG(safe_mode)) { + if (Z_LVAL_PP(zvalue) != 0) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "CURLOPT_FOLLOWLOCATION cannot be activated when in safe_mode or an open_basedir is set"); + RETURN_FALSE; + } + } + error = curl_easy_setopt(ch->cp, option, Z_LVAL_PP(zvalue)); + break; case CURLOPT_URL: case CURLOPT_PROXY: case CURLOPT_USERPWD: http://cvs.php.net/viewvc.cgi/php-src/ext/curl/curlstreams.c?r1=1.2.2.3.2.1&r2=1.2.2.3.2.2&diff_format=u Index: php-src/ext/curl/curlstreams.c diff -u php-src/ext/curl/curlstreams.c:1.2.2.3.2.1 php-src/ext/curl/curlstreams.c:1.2.2.3.2.2 --- php-src/ext/curl/curlstreams.c:1.2.2.3.2.1 Sun Jan 1 13:46:50 2006 +++ php-src/ext/curl/curlstreams.c Thu Aug 10 17:27:11 2006 @@ -16,7 +16,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: curlstreams.c,v 1.2.2.3.2.1 2006/01/01 13:46:50 sniper Exp $ */ +/* $Id: curlstreams.c,v 1.2.2.3.2.2 2006/08/10 17:27:11 iliaa Exp $ */ /* This file implements cURL based wrappers. * NOTE: If you are implementing your own streams that are intended to @@ -297,7 +297,11 @@ curl_easy_setopt(curlstream->curl, CURLOPT_WRITEHEADER, stream); /* currently buggy (bug is in curl) */ - curl_easy_setopt(curlstream->curl, CURLOPT_FOLLOWLOCATION, 1); + if ((PG(open_basedir) && *PG(open_basedir)) || PG(safe_mode)) { + curl_easy_setopt(curlstream->curl, CURLOPT_FOLLOWLOCATION, 0); + } else { + curl_easy_setopt(curlstream->curl, CURLOPT_FOLLOWLOCATION, 1); + } curl_easy_setopt(curlstream->curl, CURLOPT_ERRORBUFFER, curlstream->errstr); curl_easy_setopt(curlstream->curl, CURLOPT_VERBOSE, 0); http://cvs.php.net/viewvc.cgi/Zend/zend_alloc.c?r1=1.105.4.9.2.3&r2=1.105.4.9.2.4&diff_format=u Index: Zend/zend_alloc.c diff -u Zend/zend_alloc.c:1.105.4.9.2.3 Zend/zend_alloc.c:1.105.4.9.2.4 --- Zend/zend_alloc.c:1.105.4.9.2.3 Sun Jan 1 13:46:49 2006 +++ Zend/zend_alloc.c Thu Aug 10 17:27:12 2006 @@ -64,7 +64,15 @@ #define CHECK_MEMORY_LIMIT(s, rs) _CHECK_MEMORY_LIMIT(s, rs, NULL, 0) # endif -#define _CHECK_MEMORY_LIMIT(s, rs, file, lineno) { AG(allocated_memory) += rs;\ +#define _CHECK_MEMORY_LIMIT(s, rs, file, lineno) { if ((ssize_t)(rs) > (ssize_t)(INT_MAX - AG(allocated_memory))) { \ + if (file) { \ + fprintf(stderr, "Integer overflow in memory_limit check detected at %s:%d\n", file, lineno); \ + } else { \ + fprintf(stderr, "Integer overflow in memory_limit check detected\n"); \ + } \ + exit(1); \ + } \ + AG(allocated_memory) += rs;\ if (AG(memory_limit)<AG(allocated_memory)) {\ int php_mem_limit = AG(memory_limit); \ AG(allocated_memory) -= rs; \ @@ -111,7 +119,7 @@ p->pLast = (zend_mem_header *) NULL; #define DECLARE_CACHE_VARS() \ - unsigned int real_size; \ + size_t real_size; \ unsigned int cache_index #define REAL_SIZE(size) ((size+7) & ~0x7) @@ -126,12 +134,16 @@ ZEND_API void *_emalloc(size_t size ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC) { - zend_mem_header *p; + zend_mem_header *p = NULL; DECLARE_CACHE_VARS(); TSRMLS_FETCH(); CALCULATE_REAL_SIZE_AND_CACHE_INDEX(size); + if (size > INT_MAX || SIZE < size) { + goto emalloc_error; + } + if (!ZEND_DISABLE_MEMORY_CACHE && (CACHE_INDEX < MAX_CACHED_MEMORY) && (AG(cache_count)[CACHE_INDEX] > 0)) { p = AG(cache)[CACHE_INDEX][--AG(cache_count)[CACHE_INDEX]]; #if ZEND_DEBUG @@ -165,6 +177,8 @@ p = (zend_mem_header *) ZEND_DO_MALLOC(sizeof(zend_mem_header) + MEM_HEADER_PADDING + SIZE + END_MAGIC_SIZE); } +emalloc_error: + HANDLE_BLOCK_INTERRUPTIONS(); if (!p) { @@ -320,6 +334,13 @@ CALCULATE_REAL_SIZE_AND_CACHE_INDEX(size); HANDLE_BLOCK_INTERRUPTIONS(); + + if (size > INT_MAX || SIZE < size) { + REMOVE_POINTER_FROM_LIST(p); + p = NULL; + goto erealloc_error; + } + #if MEMORY_LIMIT CHECK_MEMORY_LIMIT(size - p->size, SIZE - REAL_SIZE(p->size)); if (AG(allocated_memory) > AG(allocated_memory_peak)) { @@ -328,6 +349,7 @@ #endif REMOVE_POINTER_FROM_LIST(p); p = (zend_mem_header *) ZEND_DO_REALLOC(p, sizeof(zend_mem_header)+MEM_HEADER_PADDING+SIZE+END_MAGIC_SIZE); +erealloc_error: if (!p) { if (!allow_failure) { fprintf(stderr,"FATAL: erealloc(): Unable to allocate %ld bytes\n", (long) size); http://cvs.php.net/viewvc.cgi/php-src/ext/standard/string.c?r1=1.333.2.52.2.5&r2=1.333.2.52.2.6&diff_format=u Index: php-src/ext/standard/string.c diff -u php-src/ext/standard/string.c:1.333.2.52.2.5 php-src/ext/standard/string.c:1.333.2.52.2.6 --- php-src/ext/standard/string.c:1.333.2.52.2.5 Fri May 19 10:20:44 2006 +++ php-src/ext/standard/string.c Thu Aug 10 17:27:12 2006 @@ -18,7 +18,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: string.c,v 1.333.2.52.2.5 2006/05/19 10:20:44 tony2001 Exp $ */ +/* $Id: string.c,v 1.333.2.52.2.6 2006/08/10 17:27:12 iliaa Exp $ */ /* Synced with php 3.0 revision 1.193 1999-06-16 [ssb] */ @@ -628,7 +628,8 @@ { const char *text, *breakchar = "\n"; char *newtext; - int textlen, breakcharlen = 1, newtextlen, alloced, chk; + int textlen, breakcharlen = 1, newtextlen, chk; + size_t alloced; long current = 0, laststart = 0, lastspace = 0; long linelength = 75; zend_bool docut = 0; @@ -3518,7 +3519,7 @@ zval **input_str; /* Input string */ zval **mult; /* Multiplier */ char *result; /* Resulting string */ - int result_len; /* Length of the resulting string */ + size_t result_len; /* Length of the resulting string */ if (ZEND_NUM_ARGS() != 2 || zend_get_parameters_ex(2, &input_str, &mult) == FAILURE) { WRONG_PARAM_COUNT; @@ -3543,11 +3544,7 @@ /* Initialize the result string */ result_len = Z_STRLEN_PP(input_str) * Z_LVAL_PP(mult); - if (result_len < 1) { - php_error_docref(NULL TSRMLS_CC, E_WARNING, "You may not create strings longer than 2147483647 bytes"); - RETURN_FALSE; - } - result = (char *)emalloc(result_len + 1); + result = (char *)safe_emalloc(Z_STRLEN_PP(input_str), Z_LVAL_PP(mult), 1); /* Heavy optimization for situations where input string is 1 byte long */ if (Z_STRLEN_PP(input_str) == 1) {