From: djcapelis at gmail dot com
Operating system: Linux, x86
PHP version: 4.4.4
PHP Bug Type: *Directory/Filesystem functions
Bug description: file_exists() silently truncates after a null byte
Description:
------------
file_exists() silently truncates anything after a null byte in a string.
This produces unexpected results in some circumstances and possibly would
result in security problems for limited amounts of poorly written code.
include_once() for instance, provides the following:
"ALERT - Include filename truncated by a \0 after '/etc/passwd' (attacker
'REMOTE_ADDR not set', file '/home/djc/test.php', line 13)"
This seems like a sane way to handle it if truncating has to be done...
though frankly since truncation will *always* produce the wrong result it
might be nice to throw an error and stop processing.
Reproduce code:
---------------
<?php
$filename = "/etc/passwd^@" . ".someextension";
if (file_exists($filename))
{
echo "The file " . $filename . "exists";
}
else
{
echo "The file " . $filename . "does not exist";
}
?>
Expected result:
----------------
Expected:
$ php -n test.php
The file /etc/passwd.\0someextension does not exist
Actual result:
--------------
Actual:
$ php -n test.php
The file /etc/passwd.someextension exists
--
Edit bug report at http://bugs.php.net/?id=39863&edit=1
--
Try a CVS snapshot (PHP 4.4):
http://bugs.php.net/fix.php?id=39863&r=trysnapshot44
Try a CVS snapshot (PHP 5.2):
http://bugs.php.net/fix.php?id=39863&r=trysnapshot52
Try a CVS snapshot (PHP 6.0):
http://bugs.php.net/fix.php?id=39863&r=trysnapshot60
Fixed in CVS: http://bugs.php.net/fix.php?id=39863&r=fixedcvs
Fixed in release:
http://bugs.php.net/fix.php?id=39863&r=alreadyfixed
Need backtrace: http://bugs.php.net/fix.php?id=39863&r=needtrace
Need Reproduce Script: http://bugs.php.net/fix.php?id=39863&r=needscript
Try newer version: http://bugs.php.net/fix.php?id=39863&r=oldversion
Not developer issue: http://bugs.php.net/fix.php?id=39863&r=support
Expected behavior: http://bugs.php.net/fix.php?id=39863&r=notwrong
Not enough info:
http://bugs.php.net/fix.php?id=39863&r=notenoughinfo
Submitted twice:
http://bugs.php.net/fix.php?id=39863&r=submittedtwice
register_globals: http://bugs.php.net/fix.php?id=39863&r=globals
PHP 3 support discontinued: http://bugs.php.net/fix.php?id=39863&r=php3
Daylight Savings: http://bugs.php.net/fix.php?id=39863&r=dst
IIS Stability: http://bugs.php.net/fix.php?id=39863&r=isapi
Install GNU Sed: http://bugs.php.net/fix.php?id=39863&r=gnused
Floating point limitations: http://bugs.php.net/fix.php?id=39863&r=float
No Zend Extensions: http://bugs.php.net/fix.php?id=39863&r=nozend
MySQL Configuration Error: http://bugs.php.net/fix.php?id=39863&r=mysqlcfg
