com php-src: Merge branch 'PHP-5.6': ext/dom/document.c ext/standard/mail.c

Commit: d4407e1cb9865b544fcf1d4a2adf2df759730425 Author: Stanislav Malyshev <stas@php.net> Tue, 9 Jun 2015 21:39:59 -0700 Parents: 563462fbf8c45c5fe54c6b215d6ec76b5b3f867c 60a2742fd280ea4a53e6f4c2f811bedbec89393d Branches: master Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=d4407e1cb9865b544fcf1d4a2adf2df759730425 Log: Merge branch 'PHP-5.6' * PHP-5.6: add NEWS Fixed bug #68776 fix test update NEWS Fix bug #69646 OS command injection vulnerability in escapeshellarg Fix #69719 - more checks for nulls in paths fix test description Fixed Buf #68812 Unchecked return value. Conflicts: ext/dom/document.c ext/gd/gd.c ext/standard/exec.c Bugs: https://bugs.php.net/68776 https://bugs.php.net/69646 https://bugs.php.net/69719 https://bugs.php.net/68812 Changed paths: MM ext/dom/document.c MM ext/standard/mail.c Diff: diff --cc ext/dom/document.c index d435b1c,1bf4c54..3e4e298 --- a/ext/dom/document.c +++ b/ext/dom/document.c @@@ -1560,9 -1698,9 +1560,9 @@@ PHP_FUNCTION(dom_document_save dom_object *intern; dom_doc_propsptr doc_props; char *file; - long options = 0; + zend_long options = 0; - if (zend_parse_method_parameters(ZEND_NUM_ARGS(), getThis(), "Os|l", &id, dom_document_class_entry, &file, &file_len, &options) == FAILURE) { - if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Op|l", &id, dom_document_class_entry, &file, &file_len, &options) == FAILURE) { ++ if (zend_parse_method_parameters(ZEND_NUM_ARGS(), getThis(), "Op|l", &id, dom_document_class_entry, &file, &file_len, &options) == FAILURE) { return; } @@@ -1793,7 -1930,7 +1793,7 @@@ static void _dom_document_schema_valida int is_valid; char resolved_path[MAXPATHLEN + 1]; - if (zend_parse_method_parameters(ZEND_NUM_ARGS(), getThis(), "Op|l", &id, dom_document_class_entry, &source, &source_len, &flags) == FAILURE) { - if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Os|l", &id, dom_document_class_entry, &source, &source_len, &flags) == FAILURE) { ++ if (zend_parse_method_parameters(ZEND_NUM_ARGS(), getThis(), "Os|l", &id, dom_document_class_entry, &source, &source_len, &flags) == FAILURE) { return; } @@@ -1806,9 -1943,13 +1806,13 @@@ switch (type) { case DOM_LOAD_FILE: - valid_file = _dom_get_valid_file_path(source, resolved_path, MAXPATHLEN ); + if (CHECK_NULL_PATH(source, source_len)) { - php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid Schema file source"); ++ php_error_docref(NULL, E_WARNING, "Invalid Schema file source"); + RETURN_FALSE; + } + valid_file = _dom_get_valid_file_path(source, resolved_path, MAXPATHLEN TSRMLS_CC); if (!valid_file) { - php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid Schema file source"); + php_error_docref(NULL, E_WARNING, "Invalid Schema file source"); RETURN_FALSE; } parser = xmlSchemaNewParserCtxt(valid_file); @@@ -1889,7 -2030,7 +1893,7 @@@ static void _dom_document_relaxNG_valid int is_valid; char resolved_path[MAXPATHLEN + 1]; - if (zend_parse_method_parameters(ZEND_NUM_ARGS(), getThis(), "Op", &id, dom_document_class_entry, &source, &source_len) == FAILURE) { - if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Os", &id, dom_document_class_entry, &source, &source_len) == FAILURE) { ++ if (zend_parse_method_parameters(ZEND_NUM_ARGS(), getThis(), "Os", &id, dom_document_class_entry, &source, &source_len) == FAILURE) { return; } @@@ -1902,9 -2043,13 +1906,13 @@@ switch (type) { case DOM_LOAD_FILE: - valid_file = _dom_get_valid_file_path(source, resolved_path, MAXPATHLEN ); + if (CHECK_NULL_PATH(source, source_len)) { - php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid RelaxNG file source"); ++ php_error_docref(NULL, E_WARNING, "Invalid RelaxNG file source"); + RETURN_FALSE; + } + valid_file = _dom_get_valid_file_path(source, resolved_path, MAXPATHLEN TSRMLS_CC); if (!valid_file) { - php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid RelaxNG file source"); + php_error_docref(NULL, E_WARNING, "Invalid RelaxNG file source"); RETURN_FALSE; } parser = xmlRelaxNGNewParserCtxt(valid_file); @@@ -1983,7 -2127,7 +1991,7 @@@ static void dom_load_html(INTERNAL_FUNC id = getThis(); - if (zend_parse_parameters(ZEND_NUM_ARGS(), "p|l", &source, &source_len, &options) == FAILURE) { - if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|l", &source, &source_len, &options) == FAILURE) { ++ if (zend_parse_parameters(ZEND_NUM_ARGS(), "s|l", &source, &source_len, &options) == FAILURE) { return; } @@@ -1993,9 -2137,13 +2001,13 @@@ } if (mode == DOM_LOAD_FILE) { + if (CHECK_NULL_PATH(source, source_len)) { - php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid file source"); ++ php_error_docref(NULL, E_WARNING, "Invalid file source"); + RETURN_FALSE; + } ctxt = htmlCreateFileParserCtxt(source, NULL); } else { - source_len = xmlStrlen(source); + source_len = xmlStrlen((xmlChar *) source); ctxt = htmlCreateMemoryParserCtxt(source, source_len); } @@@ -2082,7 -2229,7 +2094,7 @@@ PHP_FUNCTION(dom_document_save_html_fil char *file; const char *encoding; - if (zend_parse_method_parameters(ZEND_NUM_ARGS(), getThis(), "Os", &id, dom_document_class_entry, &file, &file_len) == FAILURE) { - if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Op", &id, dom_document_class_entry, &file, &file_len) == FAILURE) { ++ if (zend_parse_method_parameters(ZEND_NUM_ARGS(), getThis(), "Op", &id, dom_document_class_entry, &file, &file_len) == FAILURE) { return; } diff --cc ext/standard/mail.c index 5633372,74adc97..a9046ce --- a/ext/standard/mail.c +++ b/ext/standard/mail.c @@@ -224,9 -223,47 +224,47 @@@ void php_mail_log_to_file(char *filenam } + static int php_mail_detect_multiple_crlf(char *hdr) { + /* This function detects multiple/malformed multiple newlines. */ + size_t len; + + if (!hdr) { + return 0; + } + + /* Should not have any newlines at the beginning.. */ + /* RFC 2822 2.2. Header Fields */ + if (*hdr < 33 || *hdr > 126 || *hdr == ':') { + return 1; + } + + while(*hdr) { + if (*hdr == '\r') { + if (*(hdr+1) == '\0' || *(hdr+1) == '\r' || (*(hdr+1) == '\n' && (*(hdr+2) == '\0' || *(hdr+2) == '\n' || *(hdr+2) == '\r'))) { + /* Malformed or multiple newlines. */ + return 1; + } else { + hdr += 2; + } + } else if (*hdr == '\n') { + if (*(hdr+1) == '\0' || *(hdr+1) == '\r' || *(hdr+1) == '\n') { + /* Malformed or multiple newlines. */ + return 1; + } else { + hdr += 2; + } + } else { + hdr++; + } + } + + return 0; + } + + /* {{{ php_mail */ -PHPAPI int php_mail(char *to, char *subject, char *message, char *headers, char *extra_cmd TSRMLS_DC) +PHPAPI int php_mail(char *to, char *subject, char *message, char *headers, char *extra_cmd) { #if (defined PHP_WIN32 || defined NETWARE) int tsm_err; @@@ -278,20 -314,27 +316,26 @@@ efree(tmp); } + if (PG(mail_x_header)) { - const char *tmp = zend_get_executed_filename(TSRMLS_C); - char *f; - size_t f_len; + const char *tmp = zend_get_executed_filename(); + zend_string *f; - php_basename(tmp, strlen(tmp), NULL, 0,&f, &f_len TSRMLS_CC); + f = php_basename(tmp, strlen(tmp), NULL, 0); if (headers != NULL) { - spprintf(&hdr, 0, "X-PHP-Originating-Script: %ld:%s\n%s", php_getuid(TSRMLS_C), f, headers); + spprintf(&hdr, 0, "X-PHP-Originating-Script: " ZEND_LONG_FMT ":%s\n%s", php_getuid(), f->val, headers); } else { - spprintf(&hdr, 0, "X-PHP-Originating-Script: %ld:%s", php_getuid(TSRMLS_C), f); + spprintf(&hdr, 0, "X-PHP-Originating-Script: " ZEND_LONG_FMT ":%s", php_getuid(), f->val); } - efree(f); + zend_string_release(f); } + if (hdr && php_mail_detect_multiple_crlf(hdr)) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "Multiple or malformed newlines found in additional_header"); + MAIL_RET(0); + } + if (!sendmail_path) { #if (defined PHP_WIN32 || defined NETWARE) /* handle old style win smtp sending */