cvs: php-src /ext/com_dotnet com_persist.c /ext/sqlite pdo_sqlite2.c sqlite.c

iliaa Sat Sep 16 18:23:05 2006 UTC Modified files: /php-src/ext/sqlite sqlite.c pdo_sqlite2.c /php-src/ext/com_dotnet com_persist.c Log: MFB: Added missing validation checks around expand_filepath() http://cvs.php.net/viewvc.cgi/php-src/ext/sqlite/sqlite.c?r1=1.195&r2=1.196&diff_format=u Index: php-src/ext/sqlite/sqlite.c diff -u php-src/ext/sqlite/sqlite.c:1.195 php-src/ext/sqlite/sqlite.c:1.196 --- php-src/ext/sqlite/sqlite.c:1.195 Tue Aug 8 16:59:11 2006 +++ php-src/ext/sqlite/sqlite.c Sat Sep 16 18:23:05 2006 @@ -17,7 +17,7 @@ | Marcus Boerger <helly@php.net> | +----------------------------------------------------------------------+ - $Id: sqlite.c,v 1.195 2006/08/08 16:59:11 tony2001 Exp $ + $Id: sqlite.c,v 1.196 2006/09/16 18:23:05 iliaa Exp $ */ #ifdef HAVE_CONFIG_H @@ -1129,7 +1129,7 @@ { php_info_print_table_start(); php_info_print_table_header(2, "SQLite support", "enabled"); - php_info_print_table_row(2, "PECL Module version", PHP_SQLITE_MODULE_VERSION " $Id: sqlite.c,v 1.195 2006/08/08 16:59:11 tony2001 Exp $"); + php_info_print_table_row(2, "PECL Module version", PHP_SQLITE_MODULE_VERSION " $Id: sqlite.c,v 1.196 2006/09/16 18:23:05 iliaa Exp $"); php_info_print_table_row(2, "SQLite Library", sqlite_libversion()); php_info_print_table_row(2, "SQLite Encoding", sqlite_libencoding()); php_info_print_table_end(); @@ -1233,7 +1233,9 @@ if (strncmp(filename, ":memory:", sizeof(":memory:") - 1)) { /* resolve the fully-qualified path name to use as the hash key */ - fullpath = expand_filepath(filename, NULL TSRMLS_CC); + if (!(fullpath = expand_filepath(filename, NULL TSRMLS_CC))) { + RETURN_FALSE; + } if (php_check_open_basedir(fullpath TSRMLS_CC)) { efree(fullpath); @@ -1306,7 +1308,14 @@ if (strncmp(filename, ":memory:", sizeof(":memory:") - 1)) { /* resolve the fully-qualified path name to use as the hash key */ - fullpath = expand_filepath(filename, NULL TSRMLS_CC); + if (!(fullpath = expand_filepath(filename, NULL TSRMLS_CC))) { + php_std_error_handling(); + if (object) { + RETURN_NULL(); + } else { + RETURN_FALSE; + } + } if (php_check_open_basedir(fullpath TSRMLS_CC)) { php_std_error_handling(); @@ -1317,7 +1326,6 @@ RETURN_FALSE; } } - } php_sqlite_open(fullpath ? fullpath : filename, (int)mode, NULL, return_value, errmsg, object TSRMLS_CC); @@ -1351,7 +1359,10 @@ if (strncmp(filename, ":memory:", sizeof(":memory:") - 1)) { /* resolve the fully-qualified path name to use as the hash key */ - fullpath = expand_filepath(filename, NULL TSRMLS_CC); + if (!(fullpath = expand_filepath(filename, NULL TSRMLS_CC))) { + php_std_error_handling(); + RETURN_NULL(); + } if (php_check_open_basedir(fullpath TSRMLS_CC)) { efree(fullpath); http://cvs.php.net/viewvc.cgi/php-src/ext/sqlite/pdo_sqlite2.c?r1=1.11&r2=1.12&diff_format=u Index: php-src/ext/sqlite/pdo_sqlite2.c diff -u php-src/ext/sqlite/pdo_sqlite2.c:1.11 php-src/ext/sqlite/pdo_sqlite2.c:1.12 --- php-src/ext/sqlite/pdo_sqlite2.c:1.11 Sun Feb 19 00:55:20 2006 +++ php-src/ext/sqlite/pdo_sqlite2.c Sat Sep 16 18:23:05 2006 @@ -16,7 +16,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: pdo_sqlite2.c,v 1.11 2006/02/19 00:55:20 andi Exp $ */ +/* $Id: pdo_sqlite2.c,v 1.12 2006/09/16 18:23:05 iliaa Exp $ */ #ifdef HAVE_CONFIG_H #include "config.h" #endif @@ -518,6 +518,10 @@ if (strncmp(filename, ":memory:", sizeof(":memory:")-1)) { char *fullpath = expand_filepath(filename, NULL TSRMLS_CC); + if (!fullpath) { + return NULL; + } + if (php_check_open_basedir(fullpath TSRMLS_CC)) { efree(fullpath); return NULL; http://cvs.php.net/viewvc.cgi/php-src/ext/com_dotnet/com_persist.c?r1=1.9&r2=1.10&diff_format=u Index: php-src/ext/com_dotnet/com_persist.c diff -u php-src/ext/com_dotnet/com_persist.c:1.9 php-src/ext/com_dotnet/com_persist.c:1.10 --- php-src/ext/com_dotnet/com_persist.c:1.9 Wed Mar 29 15:08:51 2006 +++ php-src/ext/com_dotnet/com_persist.c Sat Sep 16 18:23:05 2006 @@ -16,7 +16,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: com_persist.c,v 1.9 2006/03/29 15:08:51 tony2001 Exp $ */ +/* $Id: com_persist.c,v 1.10 2006/09/16 18:23:05 iliaa Exp $ */ /* Infrastructure for working with persistent COM objects. * Implements: IStream* wrapper for PHP streams. @@ -389,9 +389,12 @@ } if (filename) { - fullpath = expand_filepath(filename, NULL TSRMLS_CC); + if (!(fullpath = expand_filepath(filename, NULL TSRMLS_CC))) { + RETURN_FALSE; + } if (php_check_open_basedir(fullpath TSRMLS_CC)) { + efree(fullpath); RETURN_FALSE; } @@ -447,10 +450,12 @@ php_com_throw_exception(E_INVALIDARG, "Invalid arguments" TSRMLS_CC); return; } - - fullpath = expand_filepath(filename, NULL TSRMLS_CC); - if (php_check_open_basedir(fullpath TSRMLS_CC)) { + if (!(fullpath = expand_filepath(filename, NULL TSRMLS_CC))) { + RETURN_FALSE; + } + + if (php_check_open_basedir(fullpath TSRMLS_CC)) { efree(fullpath); RETURN_FALSE; }