Skip to content

Commit dbf3036

Browse files
TyraelTyrael
committed
Merge remote-tracking branch 'origin/master' into PHP-7.0.0
* origin/master: add missing NEWS entries add missing NEWS entries Fixed bug #69646 (OS command injection vulnerability in escapeshellarg) add NEWS Fixed bug #68776 fix test update NEWS fix typo Fix bug #69646 OS command injection vulnerability in escapeshellarg Fix #69719 - more checks for nulls in paths fix test description Fixed Buf #68812 Unchecked return value.
2 parents 9cb8cb4 + 5ff259e commit dbf3036

File tree

6 files changed

+403
-10
lines changed

6 files changed

+403
-10
lines changed

‎UPGRADING

+1-1
Original file line numberDiff line numberDiff line change
@@ -663,7 +663,7 @@ out, that the corresponding SDK isn't available anymore.
663663
. ZLIB_FINISH
664664

665665
- GD
666-
. T1Lib support removed, thrus lifting the optional dependency on T1Lib, the
666+
. T1Lib support removed, thus lifting the optional dependency on T1Lib, the
667667
following is therefore not available anymore:
668668

669669
Functions:

‎ext/dom/document.c

+19-7
Original file line numberDiff line numberDiff line change
@@ -1562,7 +1562,7 @@ PHP_FUNCTION(dom_document_save)
15621562
char *file;
15631563
zend_long options = 0;
15641564

1565-
if (zend_parse_method_parameters(ZEND_NUM_ARGS(), getThis(), "Os|l", &id, dom_document_class_entry, &file, &file_len, &options) == FAILURE) {
1565+
if (zend_parse_method_parameters(ZEND_NUM_ARGS(), getThis(), "Op|l", &id, dom_document_class_entry, &file, &file_len, &options) == FAILURE) {
15661566
return;
15671567
}
15681568

@@ -1793,7 +1793,7 @@ static void _dom_document_schema_validate(INTERNAL_FUNCTION_PARAMETERS, int type
17931793
int is_valid;
17941794
char resolved_path[MAXPATHLEN + 1];
17951795

1796-
if (zend_parse_method_parameters(ZEND_NUM_ARGS(), getThis(), "Op|l", &id, dom_document_class_entry, &source, &source_len, &flags) == FAILURE) {
1796+
if (zend_parse_method_parameters(ZEND_NUM_ARGS(), getThis(), "Os|l", &id, dom_document_class_entry, &source, &source_len, &flags) == FAILURE) {
17971797
return;
17981798
}
17991799

@@ -1806,7 +1806,11 @@ static void _dom_document_schema_validate(INTERNAL_FUNCTION_PARAMETERS, int type
18061806

18071807
switch (type) {
18081808
case DOM_LOAD_FILE:
1809-
valid_file = _dom_get_valid_file_path(source, resolved_path, MAXPATHLEN );
1809+
if (CHECK_NULL_PATH(source, source_len)) {
1810+
php_error_docref(NULL, E_WARNING, "Invalid Schema file source");
1811+
RETURN_FALSE;
1812+
}
1813+
valid_file = _dom_get_valid_file_path(source, resolved_path, MAXPATHLEN TSRMLS_CC);
18101814
if (!valid_file) {
18111815
php_error_docref(NULL, E_WARNING, "Invalid Schema file source");
18121816
RETURN_FALSE;
@@ -1889,7 +1893,7 @@ static void _dom_document_relaxNG_validate(INTERNAL_FUNCTION_PARAMETERS, int typ
18891893
int is_valid;
18901894
char resolved_path[MAXPATHLEN + 1];
18911895

1892-
if (zend_parse_method_parameters(ZEND_NUM_ARGS(), getThis(), "Op", &id, dom_document_class_entry, &source, &source_len) == FAILURE) {
1896+
if (zend_parse_method_parameters(ZEND_NUM_ARGS(), getThis(), "Os", &id, dom_document_class_entry, &source, &source_len) == FAILURE) {
18931897
return;
18941898
}
18951899

@@ -1902,7 +1906,11 @@ static void _dom_document_relaxNG_validate(INTERNAL_FUNCTION_PARAMETERS, int typ
19021906

19031907
switch (type) {
19041908
case DOM_LOAD_FILE:
1905-
valid_file = _dom_get_valid_file_path(source, resolved_path, MAXPATHLEN );
1909+
if (CHECK_NULL_PATH(source, source_len)) {
1910+
php_error_docref(NULL, E_WARNING, "Invalid RelaxNG file source");
1911+
RETURN_FALSE;
1912+
}
1913+
valid_file = _dom_get_valid_file_path(source, resolved_path, MAXPATHLEN TSRMLS_CC);
19061914
if (!valid_file) {
19071915
php_error_docref(NULL, E_WARNING, "Invalid RelaxNG file source");
19081916
RETURN_FALSE;
@@ -1983,7 +1991,7 @@ static void dom_load_html(INTERNAL_FUNCTION_PARAMETERS, int mode) /* {{{ */
19831991

19841992
id = getThis();
19851993

1986-
if (zend_parse_parameters(ZEND_NUM_ARGS(), "p|l", &source, &source_len, &options) == FAILURE) {
1994+
if (zend_parse_parameters(ZEND_NUM_ARGS(), "s|l", &source, &source_len, &options) == FAILURE) {
19871995
return;
19881996
}
19891997

@@ -1993,6 +2001,10 @@ static void dom_load_html(INTERNAL_FUNCTION_PARAMETERS, int mode) /* {{{ */
19932001
}
19942002

19952003
if (mode == DOM_LOAD_FILE) {
2004+
if (CHECK_NULL_PATH(source, source_len)) {
2005+
php_error_docref(NULL, E_WARNING, "Invalid file source");
2006+
RETURN_FALSE;
2007+
}
19962008
ctxt = htmlCreateFileParserCtxt(source, NULL);
19972009
} else {
19982010
source_len = xmlStrlen((xmlChar *) source);
@@ -2082,7 +2094,7 @@ PHP_FUNCTION(dom_document_save_html_file)
20822094
char *file;
20832095
const char *encoding;
20842096

2085-
if (zend_parse_method_parameters(ZEND_NUM_ARGS(), getThis(), "Os", &id, dom_document_class_entry, &file, &file_len) == FAILURE) {
2097+
if (zend_parse_method_parameters(ZEND_NUM_ARGS(), getThis(), "Op", &id, dom_document_class_entry, &file, &file_len) == FAILURE) {
20862098
return;
20872099
}
20882100

‎ext/dom/tests/DOMDocument_loadHTMLfile_error2.phpt

+2-2
Original file line numberDiff line numberDiff line change
@@ -15,9 +15,9 @@ $result = $doc->loadHTMLFile("");
1515
assert('$result === false');
1616
$doc = new DOMDocument();
1717
$result = $doc->loadHTMLFile("text.html\0something");
18-
assert('$result === null');
18+
assert('$result === false');
1919
?>
2020
--EXPECTF--
2121
%r(PHP ){0,1}%rWarning: DOMDocument::loadHTMLFile(): Empty string supplied as input %s
2222

23-
%r(PHP ){0,1}%rWarning: DOMDocument::loadHTMLFile() expects parameter 1 to be a valid path, string given %s
23+
%r(PHP ){0,1}%rWarning: DOMDocument::loadHTMLFile(): Invalid file source %s

‎ext/standard/exec.c

+8
Original file line numberDiff line numberDiff line change
@@ -383,6 +383,14 @@ PHPAPI zend_string *php_escape_shell_arg(char *str)
383383
}
384384
}
385385
#ifdef PHP_WIN32
386+
if (y > 0 && '\\' == cmd->val[y - 1]) {
387+
int k = 0, n = y - 1;
388+
for (; n >= 0 && '\\' == cmd->val[n]; n--, k++);
389+
if (k % 2) {
390+
cmd->val[y++] = '\\';
391+
}
392+
}
393+
386394
cmd->val[y++] = '"';
387395
#else
388396
cmd->val[y++] = '\'';

‎ext/standard/mail.c

+44
Original file line numberDiff line numberDiff line change
@@ -224,6 +224,44 @@ void php_mail_log_to_file(char *filename, char *message, size_t message_size) {
224224
}
225225

226226

227+
static int php_mail_detect_multiple_crlf(char *hdr) {
228+
/* This function detects multiple/malformed multiple newlines. */
229+
size_t len;
230+
231+
if (!hdr) {
232+
return 0;
233+
}
234+
235+
/* Should not have any newlines at the beginning. */
236+
/* RFC 2822 2.2. Header Fields */
237+
if (*hdr < 33 || *hdr > 126 || *hdr == ':') {
238+
return 1;
239+
}
240+
241+
while(*hdr) {
242+
if (*hdr == '\r') {
243+
if (*(hdr+1) == '\0' || *(hdr+1) == '\r' || (*(hdr+1) == '\n' && (*(hdr+2) == '\0' || *(hdr+2) == '\n' || *(hdr+2) == '\r'))) {
244+
/* Malformed or multiple newlines. */
245+
return 1;
246+
} else {
247+
hdr += 2;
248+
}
249+
} else if (*hdr == '\n') {
250+
if (*(hdr+1) == '\0' || *(hdr+1) == '\r' || *(hdr+1) == '\n') {
251+
/* Malformed or multiple newlines. */
252+
return 1;
253+
} else {
254+
hdr += 2;
255+
}
256+
} else {
257+
hdr++;
258+
}
259+
}
260+
261+
return 0;
262+
}
263+
264+
227265
/* {{{ php_mail
228266
*/
229267
PHPAPI int php_mail(char *to, char *subject, char *message, char *headers, char *extra_cmd)
@@ -278,6 +316,7 @@ PHPAPI int php_mail(char *to, char *subject, char *message, char *headers, char
278316

279317
efree(tmp);
280318
}
319+
281320
if (PG(mail_x_header)) {
282321
const char *tmp = zend_get_executed_filename();
283322
zend_string *f;
@@ -292,6 +331,11 @@ PHPAPI int php_mail(char *to, char *subject, char *message, char *headers, char
292331
zend_string_release(f);
293332
}
294333

334+
if (hdr && php_mail_detect_multiple_crlf(hdr)) {
335+
php_error_docref(NULL TSRMLS_CC, E_WARNING, "Multiple or malformed newlines found in additional_header");
336+
MAIL_RET(0);
337+
}
338+
295339
if (!sendmail_path) {
296340
#if (defined PHP_WIN32 || defined NETWARE)
297341
/* handle old style win smtp sending */

0 commit comments

Comments
 (0)