com php-src: Merge branch 'PHP-5.4.40' into PHP-5.5-security: ext/curl/interface.c ext/curl/tests/bug69316.phpt sapi/apache 2handler/sapi_apache2.c

Commit: d19842f613f7e63c41d35c0f2a0ba0c3513edb62 Author: Stanislav Malyshev <stas@php.net> Sun, 5 Apr 2015 00:36:57 -0700 Parents: 8751e0fe719f90863354917dcd493f3a4b18ab02 cb0d325066486efafde8d9c324e083ac3d10a174 Branches: PHP-5.5 PHP-5.6 master Link: http://git.php..net/?p=php-src.git;a=commitdiff;h=d19842f613f7e63c41d35c0f2a0ba0c3513edb62 Log: Merge branch 'PHP-5.4.40' into PHP-5.5-security * PHP-5.4.40: Fixed bug #69316 (Use-after-free in php_curl related to CURLOPT_FILE/_INFILE/_WRITEHEADER) Fix bug #68486 and bug #69218 (segfault in apache2handler with apache 2.4) Fix bug #68819 (Fileinfo on specific file causes spurious OOM and/or segfault) Revert "Merge branch 'PHP-5.4' of https://git.php.net/repository/php-src into PHP-5.4" Fixed bug #69293 Add ZEND_ARG_CALLABLE_INFO to allow internal function to type hint against callable. Bugs: https://bugs.php.net/69316 https://bugs.php.net/68486 https://bugs.php.net/69218 https://bugs.php.net/68819 https://bugs.php.net/69293 Changed paths: MM ext/curl/interface.c AM ext/curl/tests/bug69316.phpt MM sapi/apache2handler/sapi_apache2.c Diff: diff --cc ext/curl/interface.c index 3c7fd82,7f8f276..53c8c76 --- a/ext/curl/interface.c +++ b/ext/curl/interface.c @@@ -1371,71 -1069,6 +1372,72 @@@ static size_t curl_write(char *data, si } /* }}} */ +#if LIBCURL_VERSION_NUM >= 0x071500 /* Available since 7.21.0 */ +/* {{{ curl_fnmatch + */ +static int curl_fnmatch(void *ctx, const char *pattern, const char *string) +{ + php_curl *ch = (php_curl *) ctx; + php_curl_fnmatch *t = ch->handlers->fnmatch; + int rval = CURL_FNMATCHFUNC_FAIL; + switch (t->method) { + case PHP_CURL_USER: { + zval **argv[3]; + zval *zhandle = NULL; + zval *zpattern = NULL; + zval *zstring = NULL; + zval *retval_ptr; + int error; + zend_fcall_info fci; + TSRMLS_FETCH_FROM_CTX(ch->thread_ctx); + + MAKE_STD_ZVAL(zhandle); + MAKE_STD_ZVAL(zpattern); + MAKE_STD_ZVAL(zstring); + + ZVAL_RESOURCE(zhandle, ch->id); + zend_list_addref(ch->id); + ZVAL_STRING(zpattern, pattern, 1); + ZVAL_STRING(zstring, string, 1); + + argv[0] = &zhandle; + argv[1] = &zpattern; + argv[2] = &zstring; + + fci.size = sizeof(fci); + fci.function_table = EG(function_table); + fci.function_name = t->func_name; + fci.object_ptr = NULL; + fci.retval_ptr_ptr = &retval_ptr; + fci.param_count = 3; + fci.params = argv; + fci.no_separation = 0; + fci.symbol_table = NULL; + + ch->in_callback = 1; + error = zend_call_function(&fci, &t->fci_cache TSRMLS_CC); + ch->in_callback = 0; + if (error == FAILURE) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "Cannot call the CURLOPT_FNMATCH_FUNCTION"); + } else if (retval_ptr) { ++ _php_curl_verify_handlers(ch, 1 TSRMLS_CC); + if (Z_TYPE_P(retval_ptr) != IS_LONG) { + convert_to_long_ex(&retval_ptr); + } + rval = Z_LVAL_P(retval_ptr); + zval_ptr_dtor(&retval_ptr); + } + zval_ptr_dtor(argv[0]); + zval_ptr_dtor(argv[1]); + zval_ptr_dtor(argv[2]); + break; + } + } + return rval; +} +/* }}} */ +#endif + /* {{{ curl_progress */ static size_t curl_progress(void *clientp, double dltotal, double dlnow, double ultotal, double ulnow) diff --cc ext/curl/tests/bug69316.phpt index 0000000,0f8106b..47c98fb mode 000000,100644..100644 --- a/ext/curl/tests/bug69316.phpt +++ b/ext/curl/tests/bug69316.phpt @@@ -1,0 -1,47 +1,39 @@@ + --TEST-- + Bug #69316: Use-after-free in php_curl related to CURLOPT_FILE/_INFILE/_WRITEHEADER + --SKIPIF-- -<?php -if (!extension_loaded("curl")) exit("skip curl extension not loaded"); -if (false === getenv('PHP_CURL_HTTP_REMOTE_SERVER')) exit("skip PHP_CURL_HTTP_REMOTE_SERVER env variable is not defined"); -?> ++<?php include 'skipif.inc'; ?> + --FILE-- + <?php + function hdr_callback($ch, $data) { + // close the stream, causing the FILE structure to be free()'d + if($GLOBALS['f_file']) { + fclose($GLOBALS['f_file']); $GLOBALS['f_file'] = 0; + + // cause an allocation of approx the same size as a FILE structure, size varies a bit depending on platform/libc + $FILE_size = (PHP_INT_SIZE == 4 ? 0x160 : 0x238); + curl_setopt($ch, CURLOPT_COOKIE, str_repeat("a", $FILE_size - 1)); + } + return strlen($data); + } - $host = getenv('PHP_CURL_HTTP_REMOTE_SERVER'); - ++ ++ include 'server.inc'; ++ $host = curl_cli_server_start(); + $temp_file = dirname(__FILE__) . '/body.tmp'; + $url = "{$host}/get.php?test=getpost"; + $ch = curl_init(); + $f_file = fopen($temp_file, "w") or die("failed to open file\n"); + curl_setopt($ch, CURLOPT_BUFFERSIZE, 10); + curl_setopt($ch, CURLOPT_HEADERFUNCTION, "hdr_callback"); + curl_setopt($ch, CURLOPT_FILE, $f_file); + curl_setopt($ch, CURLOPT_URL, $url); + curl_exec($ch); + curl_close($ch); + ?> + ===DONE=== + --CLEAN-- + <?php + unlink(dirname(__FILE__) . '/body.tmp'); + ?> + --EXPECTF-- + Warning: curl_exec(): CURLOPT_FILE resource has gone away, resetting to default in %s on line %d -array(1) { - ["test"]=> - string(7) "getpost" -} -array(0) { -} + ===DONE===