com php-src: Fixed bug #69353 (Missing null byte checks for paths in various PHP extensions): ext/dom/document.c ext/dom/tests/DOMDo
cument_loadHTMLfile_error2.phpt ext/fileinfo/fileinfo .c ext/fileinfo/tests/finfo_file_basic.phpt ext/gd/ gd.c ext/hash/hash.c
ext/hash/tests/hash_hmac_file _error.phpt ext/pgsql/pgsql.c ext/standard/link.c ext/standard/streamsfuncs.c ext/xmlwriter/php_xmlwrite r.c
ext/zlib/zlib.c

From: Date: Wed, 15 Apr 2015 08:11:35 +0000
Subject: com php-src: Fixed bug #69353 (Missing null byte checks for paths in various PHP extensions): ext/dom/document.c ext/dom/tests/DOMDo
cument_loadHTMLfile_error2.phpt ext/fileinfo/fileinfo .c ext/fileinfo/tests/finfo_file_basic.phpt ext/gd/ gd.c ext/hash/hash.c
ext/hash/tests/hash_hmac_file _error.phpt ext/pgsql/pgsql.c ext/standard/link.c ext/standard/streamsfuncs.c ext/xmlwriter/php_xmlwrite r.c
ext/zlib/zlib.c
Groups: php.cvs 
Request: Send a blank email to php-cvs+get-86269@lists.php.net to get a copy of this message
Commit: 52b93f0cfd3cba7ff98cc5198df6ca4f23865f80 Author: Stanislav Malyshev <stas@php.net> Sun, 5 Apr 2015 16:01:24 -0700 Committer: Julien Pauli <jpauli@php.net> Wed, 15 Apr 2015 10:11:35 +0200 Parents: 17cbd0b5b78a7500f185b3781a2149881bfff8ae Branches: PHP-5.5.24 Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=52b93f0cfd3cba7ff98cc5198df6ca4f23865f80 Log: Fixed bug #69353 (Missing null byte checks for paths in various PHP extensions) Bugs: https://bugs.php.net/69353 Changed paths: M ext/dom/document.c M ext/dom/tests/DOMDocument_loadHTMLfile_error2.phpt M ext/fileinfo/fileinfo..c M ext/fileinfo/tests/finfo_file_basic.phpt M ext/gd/gd.c M ext/hash/hash.c M ext/hash/tests/hash_hmac_file_error.phpt M ext/pgsql/pgsql.c M ext/standard/link.c M ext/standard/streamsfuncs..c M ext/xmlwriter/php_xmlwriter.c M ext/zlib/zlib.c

diff --git a/ext/dom/document.c b/ext/dom/document.c index 18c9cc6..7c5817a 100644 --- a/ext/dom/document.c +++ b/ext/dom/document.c @@ -1580,6 +1580,9 @@ static xmlDocPtr dom_document_parser(zval *id, int mode, char *source, int sourc xmlInitParser(); if (mode == DOM_LOAD_FILE) { + if (CHECK_NULL_PATH(source, source_len)) { + return NULL; + } char *file_dest = _dom_get_valid_file_path(source, resolved_path, MAXPATHLEN TSRMLS_CC); if (file_dest) { ctxt = xmlCreateFileParserCtxt(file_dest); @@ -2176,7 +2179,7 @@ static void dom_load_html(INTERNAL_FUNCTION_PARAMETERS, int mode) /* {{{ */ id = getThis(); - if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|l", &source, &source_len, &options) == FAILURE) { + if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p|l", &source, &source_len, &options) == FAILURE) { return; } diff --git a/ext/dom/tests/DOMDocument_loadHTMLfile_error2.phpt b/ext/dom/tests/DOMDocument_loadHTMLfile_error2.phpt index e59ff56..75004e2 100644 --- a/ext/dom/tests/DOMDocument_loadHTMLfile_error2.phpt +++ b/ext/dom/tests/DOMDocument_loadHTMLfile_error2.phpt @@ -13,6 +13,11 @@ assert.bail=true $doc = new DOMDocument(); $result = $doc->loadHTMLFile(""); assert('$result === false'); +$doc = new DOMDocument(); +$result = $doc->loadHTMLFile("text.html\0something"); +assert('$result === null'); ?> --EXPECTF-- %r(PHP ){0,1}%rWarning: DOMDocument::loadHTMLFile(): Empty string supplied as input %s + +%r(PHP ){0,1}%rWarning: DOMDocument::loadHTMLFile() expects parameter 1 to be a valid path, string given %s diff --git a/ext/fileinfo/fileinfo.c b/ext/fileinfo/fileinfo.c index ead7585..9f651af 100644 --- a/ext/fileinfo/fileinfo.c +++ b/ext/fileinfo/fileinfo.c @@ -506,6 +506,11 @@ static void _php_finfo_get_type(INTERNAL_FUNCTION_PARAMETERS, int mode, int mime RETVAL_FALSE; goto clean; } + if (CHECK_NULL_PATH(buffer, buffer_len)) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid path"); + RETVAL_FALSE; + goto clean; + } wrap = php_stream_locate_url_wrapper(buffer, &tmp2, 0 TSRMLS_CC); diff --git a/ext/fileinfo/tests/finfo_file_basic.phpt b/ext/fileinfo/tests/finfo_file_basic.phpt index 20223fd..ee70e2e 100644 --- a/ext/fileinfo/tests/finfo_file_basic.phpt +++ b/ext/fileinfo/tests/finfo_file_basic.phpt @@ -19,6 +19,7 @@ echo "*** Testing finfo_file() : basic functionality ***\n"; var_dump( finfo_file( $finfo, __FILE__) ); var_dump( finfo_file( $finfo, __FILE__, FILEINFO_CONTINUE ) ); var_dump( finfo_file( $finfo, $magicFile ) ); +var_dump( finfo_file( $finfo, $magicFile.chr(0).$magicFile) ); ?> ===DONE=== @@ -27,4 +28,7 @@ var_dump( finfo_file( $finfo, $magicFile ) ); string(28) "text/x-php; charset=us-ascii" string(22) "PHP script, ASCII text" string(25) "text/plain; charset=utf-8" + +Warning: finfo_file(): Invalid path in %s/finfo_file_basic.php on line %d +bool(false) ===DONE=== diff --git a/ext/gd/gd.c b/ext/gd/gd.c index cbc1d2b..322325e 100644 --- a/ext/gd/gd.c +++ b/ext/gd/gd.c @@ -1417,7 +1417,7 @@ PHP_FUNCTION(imageloadfont) gdFontPtr font; php_stream *stream; - if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &file, &file_name) == FAILURE) { + if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p", &file, &file_name) == FAILURE) { return; } @@ -2354,7 +2354,7 @@ static void _php_image_create_from(INTERNAL_FUNCTION_PARAMETERS, int image_type, long ignore_warning; if (image_type == PHP_GDIMG_TYPE_GD2PART) { - if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "sllll", &file, &file_len, &srcx, &srcy, &width, &height) == FAILURE) { + if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "pllll", &file, &file_len, &srcx, &srcy, &width, &height) == FAILURE) { return; } if (width < 1 || height < 1) { @@ -2362,7 +2362,7 @@ static void _php_image_create_from(INTERNAL_FUNCTION_PARAMETERS, int image_type, RETURN_FALSE; } } else { - if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &file, &file_len) == FAILURE) { + if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p", &file, &file_len) == FAILURE) { return; } } @@ -4031,7 +4031,7 @@ PHP_FUNCTION(imagepsencodefont) char *enc, **enc_vector; int enc_len, *f_ind; - if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "rs", &fnt, &enc, &enc_len) == FAILURE) { + if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "rp", &fnt, &enc, &enc_len) == FAILURE) { return; } diff --git a/ext/hash/hash.c b/ext/hash/hash.c index abdc62b..9cd6b8e 100644 --- a/ext/hash/hash.c +++ b/ext/hash/hash.c @@ -143,6 +143,7 @@ static void php_hash_do_hash(INTERNAL_FUNCTION_PARAMETERS, int isfilename, zend_ } if (isfilename) { if (CHECK_NULL_PATH(data, data_len)) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid path"); RETURN_FALSE; } stream = php_stream_open_wrapper_ex(data, "rb", REPORT_ERRORS, NULL, DEFAULT_CONTEXT); @@ -258,6 +259,10 @@ static void php_hash_do_hash_hmac(INTERNAL_FUNCTION_PARAMETERS, int isfilename, RETURN_FALSE; } if (isfilename) { + if (CHECK_NULL_PATH(data, data_len)) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid path"); + RETURN_FALSE; + } stream = php_stream_open_wrapper_ex(data, "rb", REPORT_ERRORS, NULL, DEFAULT_CONTEXT); if (!stream) { /* Stream will report errors opening file */ @@ -462,7 +467,7 @@ PHP_FUNCTION(hash_update_file) char *filename, buf[1024]; int filename_len, n; - if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "rs|r", &zhash, &filename, &filename_len, &zcontext) == FAILURE) { + if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "rp|r", &zhash, &filename, &filename_len, &zcontext) == FAILURE) { return; } diff --git a/ext/hash/tests/hash_hmac_file_error.phpt b/ext/hash/tests/hash_hmac_file_error.phpt index 42ab122..26ba8aa 100644 --- a/ext/hash/tests/hash_hmac_file_error.phpt +++ b/ext/hash/tests/hash_hmac_file_error.phpt @@ -28,6 +28,9 @@ hash_hmac_file('crc32', $file, $key, TRUE, $extra_arg); echo "\n-- Testing hash_hmac_file() function with invalid hash algorithm --\n"; hash_hmac_file('foo', $file, $key, TRUE); +echo "\n-- Testing hash_hmac_file() function with bad path --\n"; +hash_hmac_file('crc32', $file.chr(0).$file, $key, TRUE); + ?> ===Done=== --EXPECTF-- @@ -51,4 +54,8 @@ Warning: hash_hmac_file() expects at most 4 parameters, 5 given in %s on line %d -- Testing hash_hmac_file() function with invalid hash algorithm -- Warning: hash_hmac_file(): Unknown hashing algorithm: foo in %s on line %d + +-- Testing hash_hmac_file() function with bad path -- + +Warning: hash_hmac_file(): Invalid path in %s on line %d ===Done=== \ No newline at end of file diff --git a/ext/pgsql/pgsql.c b/ext/pgsql/pgsql.c index 7af7e8b..23d55cb 100644 --- a/ext/pgsql/pgsql.c +++ b/ext/pgsql/pgsql.c @@ -3014,7 +3014,7 @@ PHP_FUNCTION(pg_trace) php_stream *stream; id = PGG(default_link); - if (zend_parse_parameters(argc TSRMLS_CC, "s|sr", &z_filename, &z_filename_len, &mode, &mode_len, &pgsql_link) == FAILURE) { + if (zend_parse_parameters(argc TSRMLS_CC, "p|sr", &z_filename, &z_filename_len, &mode, &mode_len, &pgsql_link) == FAILURE) { return; } diff --git a/ext/standard/link.c b/ext/standard/link.c index 0e40a0b..4ed2c5e 100644 --- a/ext/standard/link.c +++ b/ext/standard/link.c @@ -59,7 +59,7 @@ PHP_FUNCTION(readlink) char buff[MAXPATHLEN]; int ret; - if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &link, &link_len) == FAILURE) { + if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p", &link, &link_len) == FAILURE) { return; } diff --git a/ext/standard/streamsfuncs.c b/ext/standard/streamsfuncs.c index 7ddfc66..4c2837e 100644 --- a/ext/standard/streamsfuncs.c +++ b/ext/standard/streamsfuncs.c @@ -1549,7 +1549,7 @@ PHP_FUNCTION(stream_resolve_include_path) char *filename, *resolved_path; int filename_len; - if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &filename, &filename_len) == FAILURE) { + if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p", &filename, &filename_len) == FAILURE) { return; } diff --git a/ext/xmlwriter/php_xmlwriter.c b/ext/xmlwriter/php_xmlwriter.c index 206d82a..7a650e2 100644 --- a/ext/xmlwriter/php_xmlwriter.c +++ b/ext/xmlwriter/php_xmlwriter.c @@ -1738,7 +1738,7 @@ static PHP_FUNCTION(xmlwriter_write_dtd_entity) /* }}} */ #endif -/* {{{ proto resource xmlwriter_open_uri(resource xmlwriter, string source) +/* {{{ proto resource xmlwriter_open_uri(string source) Create new xmlwriter using source uri for output */ static PHP_FUNCTION(xmlwriter_open_uri) { @@ -1759,7 +1759,7 @@ static PHP_FUNCTION(xmlwriter_open_uri) void *ioctx; #endif - if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &source, &source_len) == FAILURE) { + if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p", &source, &source_len) == FAILURE) { return; } diff --git a/ext/zlib/zlib.c b/ext/zlib/zlib.c index d70198c..ec958e1 100644 --- a/ext/zlib/zlib.c +++ b/ext/zlib/zlib.c @@ -593,7 +593,7 @@ static PHP_FUNCTION(gzopen) php_stream *stream; long use_include_path = 0; - if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "ss|l", &filename, &filename_len, &mode, &mode_len, &use_include_path) == FAILURE) { + if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "ps|l", &filename, &filename_len, &mode, &mode_len, &use_include_path) == FAILURE) { return; } @@ -621,7 +621,7 @@ static PHP_FUNCTION(readgzfile) int size; long use_include_path = 0; - if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|l", &filename, &filename_len, &use_include_path) == FAILURE) { + if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p|l", &filename, &filename_len, &use_include_path) == FAILURE) { return; }
« previous php.cvs (#86269) next »