cvs: php-src(PHP_5_2) / NEWS /ext/filter logical_filters.c /ext/filter/tests bug39846.phpt

iliaa Sat Dec 16 21:48:05 2006 UTC Added files: (Branch: PHP_5_2) /php-src/ext/filter/tests bug39846.phpt Modified files: /php-src/ext/filter logical_filters.c /php-src NEWS Log: Fixed bug #39846 (Invalid IPv4 treated as valid). http://cvs.php.net/viewvc.cgi/php-src/ext/filter/logical_filters.c?r1=1.1.2.11&r2=1.1.2.12&diff_format=u Index: php-src/ext/filter/logical_filters.c diff -u php-src/ext/filter/logical_filters.c:1.1.2.11 php-src/ext/filter/logical_filters.c:1.1.2.12 --- php-src/ext/filter/logical_filters.c:1.1.2.11 Tue Oct 17 15:26:14 2006 +++ php-src/ext/filter/logical_filters.c Sat Dec 16 21:48:05 2006 @@ -17,13 +17,17 @@ +----------------------------------------------------------------------+ */ -/* $Id: logical_filters.c,v 1.1.2.11 2006/10/17 15:26:14 iliaa Exp $ */ +/* $Id: logical_filters.c,v 1.1.2.12 2006/12/16 21:48:05 iliaa Exp $ */ #include "php_filter.h" #include "filter_private.h" #include "ext/standard/url.h" #include "ext/pcre/php_pcre.h" +#if HAVE_ARPA_INET_H +# include <arpa/inet.h> +#endif + /* {{{ FETCH_LONG_OPTION(var_name, option_name) */ #define FETCH_LONG_OPTION(var_name, option_name) \ var_name = 0; \ @@ -523,70 +527,31 @@ } /* }}} */ -static int _php_filter_validate_ipv4_count_dots(char *str) /* {{{ */ -{ - char *s1, *s2, *s3, *s4; - - s1 = strchr(str, '.'); - if (!s1) - return 0; - s2 = strchr(s1 + 1, '.'); - if (!s2) - return 1; - s3 = strchr(s2 + 1, '.'); - if (!s3) - return 2; - s4 = strchr(s3 + 1, '.'); - if (!s4) - return 3; - return 4; /* too many */ -} -/* }}} */ - -static int _php_filter_validate_ipv4_get_nr(char **str) /* {{{ */ +static int _php_filter_validate_ipv4(char *str, int str_len, int *ip) /* {{{ */ { - char *begin, *end, *ptr, *tmp_str; - int tmp_nr = -1; - - begin = ptr = *str; - while ((*ptr >= '0') && (*ptr <= '9')) { - ++ptr; - } - end = ptr; - *str = end + 1; - - if (end == begin) { - return -1; - } - - tmp_str = calloc(1, end - begin + 1); - memcpy(tmp_str, begin, end - begin); - tmp_nr = strtol(tmp_str, NULL, 10); - free(tmp_str); - - if (tmp_nr < 0 || tmp_nr > 255) { - tmp_nr = -1; + unsigned long int i = inet_addr(str); + char ip_chk[16]; + int l; + + if (i == INADDR_NONE) { + if (!strcmp(str, "255.255.255.255")) { + ip[0] = ip[1] = ip[2] = ip[3] = 255; + return 1; + } else { + return 0; + } } - return tmp_nr; -} -/* }}} */ - -static int _php_filter_validate_ipv4(char *str, int *ip TSRMLS_DC) /* {{{ */ -{ - char *p; - int x; - - if (_php_filter_validate_ipv4_count_dots(str) != 3) { + ip[0] = i & 0xFF; + ip[1] = (i & 0xFF00) / 256; + ip[2] = (i & 0xFF0000) / 256 / 256; + ip[3] = (i & 0xFF000000) / 256 / 256 / 256; + + /* make sure that the input does not have any trailing values */ + l = sprintf(ip_chk, "%d.%d.%d.%d", ip[0], ip[1], ip[2], ip[3]); + if (l != str_len || strcmp(ip_chk, str)) { return 0; } - p = str; - for (x = 0; x < 4; ++x) { - ip[x] = _php_filter_validate_ipv4_get_nr(&p); - if (ip[x] == -1) { - return 0; - } - } return 1; } /* }}} */ @@ -607,7 +572,7 @@ hexcode_found++; \ } -static int _php_filter_validate_ipv6_(char *str TSRMLS_DC) /* {{{ */ +static int _php_filter_validate_ipv6_(char *str, int str_len TSRMLS_DC) /* {{{ */ { int hexcode_found = 0; int compressed_2end = 0; @@ -617,21 +582,21 @@ char *s2 = NULL, *ipv4=NULL; int ip4elm[4]; - if (!strchr(str, ':')) { + if (!memchr(str, ':', str_len)) { return 0; } /* Check for compressed expression. only one is allowed */ - compressed = strstr(str, "::"); + compressed = php_memnstr(str, "::", sizeof("::")-1, str+str_len); if (compressed) { - s2 = strstr(compressed+1, "::"); + s2 = php_memnstr(compressed+1, "::", sizeof("::")-1, str + str_len); if (s2) { return 0; } } /* check for bundled IPv4 */ - ipv4 = strchr(str, '.'); + ipv4 = memchr(str, '.', str_len); if (ipv4) { while (*ipv4 != ':' && ipv4 >= start) { @@ -644,7 +609,7 @@ } ipv4++; - if (!_php_filter_validate_ipv4(ipv4, ip4elm TSRMLS_CC)) { + if (!_php_filter_validate_ipv4(ipv4, (str + str_len - ipv4), ip4elm TSRMLS_CC)) { return 0; } @@ -658,7 +623,7 @@ if (ipv4) { end = ipv4 - 1; } else { - end = str + strlen(start); + end = str + str_len; } while (*str && str <= end) { @@ -771,7 +736,7 @@ switch (mode) { case FORMAT_IPV4: - if (!_php_filter_validate_ipv4(str, ip TSRMLS_CC)) { + if (!_php_filter_validate_ipv4(str, Z_STRLEN_P(value), ip)) { RETURN_VALIDATION_FAILED } @@ -801,7 +766,7 @@ case FORMAT_IPV6: { int res = 0; - res = _php_filter_validate_ipv6_(str TSRMLS_CC); + res = _php_filter_validate_ipv6_(str, Z_STRLEN_P(value) TSRMLS_CC); if (res < 1) { RETURN_VALIDATION_FAILED } http://cvs.php.net/viewvc.cgi/php-src/NEWS?r1=1.2027.2.547.2.431&r2=1.2027.2.547.2.432&diff_format=u Index: php-src/NEWS diff -u php-src/NEWS:1.2027.2.547.2.431 php-src/NEWS:1.2027.2.547.2.432 --- php-src/NEWS:1.2027.2.547.2.431 Fri Dec 15 13:25:26 2006 +++ php-src/NEWS Sat Dec 16 21:48:05 2006 @@ -54,6 +54,7 @@ - Fixed FastCGI impersonation for persistent connections on Windows. (Dmitry) - Fixed wrong signature initialization in imagepng (Takeshi Abe) - Added optimization for imageline with horizontal and vertial lines (Pierre) +- Fixed bug #39846 (Invalid IPv4 treated as valid). (Ilia) - Fixed bug #39816 (apxs2filter ignores httpd.conf & .htaccess php config settings). (Ilia) - Fixed bug #39797 (virtual() does not reset changed INI settings). (Ilia) http://cvs.php.net/viewvc.cgi/php-src/ext/filter/tests/bug39846.phpt?view=markup&rev=1.1 Index: php-src/ext/filter/tests/bug39846.phpt +++ php-src/ext/filter/tests/bug39846.phpt