[PHP-CVS] cvs: php-src(PHP_5_0) /ext/standard basic_functions.c

[Ilia Alshanetsky]

iliaa           Thu Sep 29 12:31:21 2005 EDT

  Modified files:              (Branch: PHP_5_0)
    /php-src/ext/standard       basic_functions.c 
  Log:
  MFH:
  Fixed possible crash and/or memory corruption in import_request_variables()
  Fixed potential GLOBALS overwrite via import_request_variables().
  
  
http://cvs.php.net/diff.php/php-src/ext/standard/basic_functions.c?r1=1.673.2.20&r2=1.673.2.21&ty=u
Index: php-src/ext/standard/basic_functions.c
diff -u php-src/ext/standard/basic_functions.c:1.673.2.20 
php-src/ext/standard/basic_functions.c:1.673.2.21
--- php-src/ext/standard/basic_functions.c:1.673.2.20   Wed Sep 21 10:47:28 2005
+++ php-src/ext/standard/basic_functions.c      Thu Sep 29 12:31:20 2005
@@ -17,7 +17,7 @@
    +----------------------------------------------------------------------+
  */
 
-/* $Id: basic_functions.c,v 1.673.2.20 2005/09/21 14:47:28 dmitry Exp $ */
+/* $Id: basic_functions.c,v 1.673.2.21 2005/09/29 16:31:20 iliaa Exp $ */
 
 #include "php.h"
 #include "php_streams.h"
@@ -3077,11 +3077,25 @@
        prefix = va_arg(args, char *);
        prefix_len = va_arg(args, uint);
 
-       new_key_len = prefix_len + hash_key->nKeyLength;
-       new_key = (char *) emalloc(new_key_len);
+       if (!prefix_len) {
+               if (!hash_key->nKeyLength) {
+                       php_error_docref(NULL TSRMLS_CC, E_WARNING, "Numeric 
key detected - possible security hazard.");
+                       return 0;
+               } else if (!strcmp(hash_key->arKey, "GLOBALS")) {
+                       php_error_docref(NULL TSRMLS_CC, E_WARNING, "Attempted 
GLOBALS variable overwrite.");
+                       return 0; 
+               }
+       }
+
+       if (hash_key->nKeyLength) {
+               new_key_len = prefix_len + hash_key->nKeyLength;
+               new_key = (char *) emalloc(new_key_len);
 
-       memcpy(new_key, prefix, prefix_len);
-       memcpy(new_key+prefix_len, hash_key->arKey, hash_key->nKeyLength);
+               memcpy(new_key, prefix, prefix_len);
+               memcpy(new_key+prefix_len, hash_key->arKey, 
hash_key->nKeyLength);
+       } else {
+               new_key_len = spprintf(&new_key, 0, "%s%ld", prefix, 
hash_key->h);
+       }
 
        zend_hash_del(&EG(symbol_table), new_key, new_key_len);
        ZEND_SET_SYMBOL_WITH_LENGTH(&EG(symbol_table), new_key, new_key_len, 
*var, (*var)->refcount+1, 0);

-- 
PHP CVS Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php