com php-src: Fix bug #67730 - Null byte injection possible with imagexxx functions: ext/gd/gd_ctx.c
| From: | JulienPauli | Date: | Tue, 19 Aug 2014 13:03:01 +0000 |
| Subject: | com php-src: Fix bug #67730 - Null byte injection possible with imagexxx functions: ext/gd/gd_ctx.c | ||
| Groups: | php.cvs | ||
| Request: | Send a blank email to php-cvs+get-80614@lists.php.net to get a copy of this message | ||
Commit: 1daa4c0090b7cd8178dcaa96287234c69ac6ca18
Author: Stanislav Malyshev <stas@php.net> Mon, 18 Aug 2014 22:49:10 -0700
Committer: Julien Pauli <jpauli@php.net> Tue, 19 Aug 2014 15:03:01 +0200
Parents: fbceec5861e08b10e75af36a097da35d9f808ef6
Branches: PHP-5.5.16
Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=1daa4c0090b7cd8178dcaa96287234c69ac6ca18
Log:
Fix bug #67730 - Null byte injection possible with imagexxx functions
Bugs:
https://bugs.php.net/67730
Changed paths:
M ext/gd/gd_ctx.c
Diff:
diff --git a/ext/gd/gd_ctx.c b/ext/gd/gd_ctx.c
index 59eff80..253b664 100644
--- a/ext/gd/gd_ctx.c
+++ b/ext/gd/gd_ctx.c
@@ -124,6 +124,11 @@ static void _php_image_output_ctx(INTERNAL_FUNCTION_PARAMETERS, int image_type,
RETURN_FALSE;
}
} else if (Z_TYPE_P(to_zval) == IS_STRING) {
+ if (CHECK_ZVAL_NULL_PATH(to_zval)) {
+ php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid 2nd parameter, filename must not
contain null bytes");
+ RETURN_FALSE;
+ }
+
stream = php_stream_open_wrapper(Z_STRVAL_P(to_zval), "wb",
REPORT_ERRORS|IGNORE_PATH|IGNORE_URL_WIN, NULL);
if (stream == NULL) {
RETURN_FALSE;