svn: /php/php-src/ branches/PHP_5_3/NEWS branches/PHP_5_3/ext/phar/dirstream.c branches/PHP_5_3/ext/phar/stream.c trunk/ext/phar/dirstream.c
trunk/ext/phar/stream.c
| From: | Ilia Alshanetsky | Date: | Tue, 27 Apr 2010 17:13:24 +0000 |
| Subject: | svn: /php/php-src/ branches/PHP_5_3/NEWS branches/PHP_5_3/ext/phar/dirstream.c branches/PHP_5_3/ext/phar/stream.c trunk/ext/phar/dirstream.c trunk/ext/phar/stream.c |
||
| Groups: | php.cvs | ||
| Request: | Send a blank email to php-cvs+get-62446@lists.php.net to get a copy of this message | ||
iliaa Tue, 27 Apr 2010 17:13:24 +0000
Revision: http://svn.php.net/viewvc?view=revision&revision=298667
Log:
Fixed string format validation inside phar extension. Reported by Stefan Esser
Changed paths:
U php/php-src/branches/PHP_5_3/NEWS
U php/php-src/branches/PHP_5_3/ext/phar/dirstream.c
U php/php-src/branches/PHP_5_3/ext/phar/stream.c
U php/php-src/trunk/ext/phar/dirstream.c
U php/php-src/trunk/ext/phar/stream.c
Modified: php/php-src/branches/PHP_5_3/NEWS
===================================================================
--- php/php-src/branches/PHP_5_3/NEWS 2010-04-27 17:12:03 UTC (rev 298666)
+++ php/php-src/branches/PHP_5_3/NEWS 2010-04-27 17:13:24 UTC (rev 298667)
@@ -21,6 +21,8 @@
- Fixed very rare memory leak in mysqlnd, when binding thousands of columns.
(Andrey)
+- Fixed string format validation inside phar extension. Reported by Stefan
+ Esser (Ilia)
- Fixed handling of session variable serialization on certain prefix
characters. Reported by Stefan Esser (Ilia)
- Fixed a NULL pointer dereference when processing invalid XML-RPC
Modified: php/php-src/branches/PHP_5_3/ext/phar/dirstream.c
===================================================================
--- php/php-src/branches/PHP_5_3/ext/phar/dirstream.c 2010-04-27 17:12:03 UTC (rev 298666)
+++ php/php-src/branches/PHP_5_3/ext/phar/dirstream.c 2010-04-27 17:13:24 UTC (rev 298667)
@@ -360,7 +360,7 @@
if (FAILURE == phar_get_archive(&phar, resource->host, host_len, NULL, 0, &error
TSRMLS_CC)) {
if (error) {
- php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, error);
+ php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, "%s", error);
efree(error);
} else {
php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, "phar file \"%s\" is
unknown", resource->host);
Modified: php/php-src/branches/PHP_5_3/ext/phar/stream.c
===================================================================
--- php/php-src/branches/PHP_5_3/ext/phar/stream.c 2010-04-27 17:12:03 UTC (rev 298666)
+++ php/php-src/branches/PHP_5_3/ext/phar/stream.c 2010-04-27 17:13:24 UTC (rev 298667)
@@ -117,7 +117,7 @@
{
if (error) {
if (!(options & PHP_STREAM_URL_STAT_QUIET)) {
- php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, error);
+ php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, "%s", error);
}
efree(error);
}
@@ -128,7 +128,7 @@
if (error) {
spprintf(&error, 0, "Cannot open cached phar '%s' as writeable, copy on
write failed", resource->host);
if (!(options & PHP_STREAM_URL_STAT_QUIET)) {
- php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, error);
+ php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, "%s", error);
}
efree(error);
}
@@ -140,7 +140,7 @@
{
if (error) {
if (!(options & PHP_STREAM_URL_STAT_QUIET)) {
- php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, error);
+ php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, "%s", error);
}
efree(error);
}
@@ -192,7 +192,7 @@
if (mode[0] == 'w' || (mode[0] == 'r' && mode[1] == '+')) {
if (NULL == (idata = phar_get_or_create_entry_data(resource->host, host_len, internal_file,
strlen(internal_file), mode, 0, &error, 1 TSRMLS_CC))) {
if (error) {
- php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, error);
+ php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, "%s", error);
efree(error);
} else {
php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, "phar error: file
\"%s\" could not be created in phar \"%s\"", internal_file,
resource->host);
@@ -297,7 +297,7 @@
if ((FAILURE == phar_get_entry_data(&idata, resource->host, host_len, internal_file,
strlen(internal_file), "r", 0, &error, 0 TSRMLS_CC)) || !idata) {
idata_error:
if (error) {
- php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, error);
+ php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, "%s", error);
efree(error);
} else {
php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, "phar error: \"%s\" is
not a file in phar \"%s\"", internal_file, resource->host);
@@ -320,7 +320,7 @@
/* check length, crc32 */
if (!idata->internal_file->is_crc_checked && phar_postprocess_file(idata,
idata->internal_file->crc32, &error, 2 TSRMLS_CC) != SUCCESS) {
- php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, error);
+ php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, "%s", error);
efree(error);
phar_entry_delref(idata TSRMLS_CC);
efree(internal_file);
@@ -761,7 +761,7 @@
efree(internal_file);
phar_entry_remove(idata, &error TSRMLS_CC);
if (error) {
- php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, error);
+ php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, "%s", error);
efree(error);
}
return 1;
Modified: php/php-src/trunk/ext/phar/dirstream.c
===================================================================
--- php/php-src/trunk/ext/phar/dirstream.c 2010-04-27 17:12:03 UTC (rev 298666)
+++ php/php-src/trunk/ext/phar/dirstream.c 2010-04-27 17:13:24 UTC (rev 298667)
@@ -360,7 +360,7 @@
if (FAILURE == phar_get_archive(&phar, resource->host, host_len, NULL, 0, &error
TSRMLS_CC)) {
if (error) {
- php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, error);
+ php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, "%s", error);
efree(error);
} else {
php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, "phar file \"%s\" is
unknown", resource->host);
Modified: php/php-src/trunk/ext/phar/stream.c
===================================================================
--- php/php-src/trunk/ext/phar/stream.c 2010-04-27 17:12:03 UTC (rev 298666)
+++ php/php-src/trunk/ext/phar/stream.c 2010-04-27 17:13:24 UTC (rev 298667)
@@ -117,7 +117,7 @@
{
if (error) {
if (!(options & PHP_STREAM_URL_STAT_QUIET)) {
- php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, error);
+ php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, "%s", error);
}
efree(error);
}
@@ -128,7 +128,7 @@
if (error) {
spprintf(&error, 0, "Cannot open cached phar '%s' as writeable, copy on
write failed", resource->host);
if (!(options & PHP_STREAM_URL_STAT_QUIET)) {
- php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, error);
+ php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, "%s", error);
}
efree(error);
}
@@ -140,7 +140,7 @@
{
if (error) {
if (!(options & PHP_STREAM_URL_STAT_QUIET)) {
- php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, error);
+ php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, "%s", error);
}
efree(error);
}
@@ -192,7 +192,7 @@
if (mode[0] == 'w' || (mode[0] == 'r' && mode[1] == '+')) {
if (NULL == (idata = phar_get_or_create_entry_data(resource->host, host_len, internal_file,
strlen(internal_file), mode, 0, &error, 1 TSRMLS_CC))) {
if (error) {
- php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, error);
+ php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, "%s", error);
efree(error);
} else {
php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, "phar error: file
\"%s\" could not be created in phar \"%s\"", internal_file,
resource->host);
@@ -297,7 +297,7 @@
if ((FAILURE == phar_get_entry_data(&idata, resource->host, host_len, internal_file,
strlen(internal_file), "r", 0, &error, 0 TSRMLS_CC)) || !idata) {
idata_error:
if (error) {
- php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, error);
+ php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, "%s", error);
efree(error);
} else {
php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, "phar error: \"%s\" is
not a file in phar \"%s\"", internal_file, resource->host);
@@ -320,7 +320,7 @@
/* check length, crc32 */
if (!idata->internal_file->is_crc_checked && phar_postprocess_file(idata,
idata->internal_file->crc32, &error, 2 TSRMLS_CC) != SUCCESS) {
- php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, error);
+ php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, "%s", error);
efree(error);
phar_entry_delref(idata TSRMLS_CC);
efree(internal_file);
@@ -761,7 +761,7 @@
efree(internal_file);
phar_entry_remove(idata, &error TSRMLS_CC);
if (error) {
- php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, error);
+ php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, "%s", error);
efree(error);
}
return 1;