iliaa Thu Sep 29 12:30:52 2005 EDT Modified files: (Branch: PHP_5_1) /php-src NEWS /php-src/ext/standard basic_functions.c Log: MFH: Fixed possible crash and/or memory corruption in import_request_variables() Fixed potential GLOBALS overwrite via import_request_variables(). http://cvs.php.net/diff.php/php-src/NEWS?r1=1.2027.2.84&r2=1.2027.2.85&ty=u Index: php-src/NEWS diff -u php-src/NEWS:1.2027.2.84 php-src/NEWS:1.2027.2.85 --- php-src/NEWS:1.2027.2.84 Wed Sep 28 18:39:52 2005 +++ php-src/NEWS Thu Sep 29 12:30:51 2005 @@ -1,6 +1,9 @@ PHP NEWS ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ?? Aug 2005, PHP 5.1 Release Candidate 2 +- Fixed possible crash and/or memory corruption in import_request_variables(). + (Ilia) +- Fixed potential GLOBALS overwrite via import_request_variables(). (Ilia) - Fixed possible GLOBALS variable override when register_globals are ON. (Ilia, Stefan) - Fixed possible register_globals toggle via parse_str(). (Ilia, Stefan) http://cvs.php.net/diff.php/php-src/ext/standard/basic_functions.c?r1=1.725.2.2&r2=1.725.2.3&ty=u Index: php-src/ext/standard/basic_functions.c diff -u php-src/ext/standard/basic_functions.c:1.725.2.2 php-src/ext/standard/basic_functions.c:1.725.2.3 --- php-src/ext/standard/basic_functions.c:1.725.2.2 Tue Sep 13 09:24:38 2005 +++ php-src/ext/standard/basic_functions.c Thu Sep 29 12:30:51 2005 @@ -17,7 +17,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: basic_functions.c,v 1.725.2.2 2005/09/13 13:24:38 iliaa Exp $ */ +/* $Id: basic_functions.c,v 1.725.2.3 2005/09/29 16:30:51 iliaa Exp $ */ #include "php.h" #include "php_streams.h" @@ -1033,6 +1033,15 @@ REGISTER_LONG_CONSTANT("SUNFUNCS_RET_STRING", SUNFUNCS_RET_STRING, CONST_CS | CONST_PERSISTENT); REGISTER_LONG_CONSTANT("SUNFUNCS_RET_DOUBLE", SUNFUNCS_RET_DOUBLE, CONST_CS | CONST_PERSISTENT); + REGISTER_LONG_CONSTANT("PHP_URL_SCHEME", PHP_URL_SCHEME, CONST_CS | CONST_PERSISTENT); + REGISTER_LONG_CONSTANT("PHP_URL_HOST", PHP_URL_HOST, CONST_CS | CONST_PERSISTENT); + REGISTER_LONG_CONSTANT("PHP_URL_PORT", PHP_URL_PORT, CONST_CS | CONST_PERSISTENT); + REGISTER_LONG_CONSTANT("PHP_URL_USER", PHP_URL_USER, CONST_CS | CONST_PERSISTENT); + REGISTER_LONG_CONSTANT("PHP_URL_PASS", PHP_URL_PASS, CONST_CS | CONST_PERSISTENT); + REGISTER_LONG_CONSTANT("PHP_URL_PATH", PHP_URL_PATH, CONST_CS | CONST_PERSISTENT); + REGISTER_LONG_CONSTANT("PHP_URL_QUERY", PHP_URL_QUERY, CONST_CS | CONST_PERSISTENT); + REGISTER_LONG_CONSTANT("PHP_URL_FRAGMENT", PHP_URL_FRAGMENT, CONST_CS | CONST_PERSISTENT); + #define REGISTER_MATH_CONSTANT(x) REGISTER_DOUBLE_CONSTANT(#x, x, CONST_CS | CONST_PERSISTENT) REGISTER_MATH_CONSTANT(M_E); REGISTER_MATH_CONSTANT(M_LOG2E); @@ -3217,11 +3226,25 @@ prefix = va_arg(args, char *); prefix_len = va_arg(args, uint); - new_key_len = prefix_len + hash_key->nKeyLength; - new_key = (char *) emalloc(new_key_len); + if (!prefix_len) { + if (!hash_key->nKeyLength) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "Numeric key detected - possible security hazard."); + return 0; + } else if (!strcmp(hash_key->arKey, "GLOBALS")) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "Attempted GLOBALS variable overwrite."); + return 0; + } + } + + if (hash_key->nKeyLength) { + new_key_len = prefix_len + hash_key->nKeyLength; + new_key = (char *) emalloc(new_key_len); - memcpy(new_key, prefix, prefix_len); - memcpy(new_key+prefix_len, hash_key->arKey, hash_key->nKeyLength); + memcpy(new_key, prefix, prefix_len); + memcpy(new_key+prefix_len, hash_key->arKey, hash_key->nKeyLength); + } else { + new_key_len = spprintf(&new_key, 0, "%s%ld", prefix, hash_key->h); + } zend_delete_global_variable(new_key, new_key_len-1 TSRMLS_CC); ZEND_SET_SYMBOL_WITH_LENGTH(&EG(symbol_table), new_key, new_key_len, *var, (*var)->refcount+1, 0);
-- PHP CVS Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php