[PHP-CVS] cvs: php-src(PHP_4_4) /ext/session session.c

[Antony Dovgal]

tony2001                Wed Dec 20 19:31:40 2006 UTC

  Modified files:              (Branch: PHP_4_4)
    /php-src/ext/session        session.c 
  Log:
  protect _SESSION, HTTP_SESSION_VARS and GLOBALS
  maintain an internal reference of _SESSION, so that it won't be possible to 
destroy it from userspace
  
  
http://cvs.php.net/viewvc.cgi/php-src/ext/session/session.c?r1=1.336.2.53.2.8&r2=1.336.2.53.2.9&diff_format=u
Index: php-src/ext/session/session.c
diff -u php-src/ext/session/session.c:1.336.2.53.2.8 
php-src/ext/session/session.c:1.336.2.53.2.9
--- php-src/ext/session/session.c:1.336.2.53.2.8        Fri Dec  1 00:28:43 2006
+++ php-src/ext/session/session.c       Wed Dec 20 19:31:40 2006
@@ -17,7 +17,7 @@
    +----------------------------------------------------------------------+
  */
 
-/* $Id: session.c,v 1.336.2.53.2.8 2006/12/01 00:28:43 iliaa Exp $ */
+/* $Id: session.c,v 1.336.2.53.2.9 2006/12/20 19:31:40 tony2001 Exp $ */
 
 #ifdef HAVE_CONFIG_H
 #include "config.h"
@@ -418,6 +418,7 @@
        int namelen;
        int has_value;
        php_unserialize_data_t var_hash;
+       int globals_on = PG(register_globals);
 
        PHP_VAR_UNSERIALIZE_INIT(var_hash);
 
@@ -428,15 +429,22 @@
                name = estrndup(p + 1, namelen);
                
                p += namelen + 1;
-               
-               if (has_value) {
-                       ALLOC_INIT_ZVAL(current);
-                       if (php_var_unserialize(&current, (const unsigned char 
**)&p, endptr, &var_hash TSRMLS_CC)) {
-                               php_set_session_var(name, namelen, current, 
&var_hash  TSRMLS_CC);
+               if (globals_on && namelen == sizeof("_SESSION")-1 && 
!memcmp(name, "_SESSION", sizeof("_SESSION") - 1)) {
+                       /* _SESSION hijack attempt */
+               } else if (globals_on && namelen == sizeof("GLOBALS")-1 && 
!memcmp(name, "GLOBALS", sizeof("GLOBALS") - 1)) {
+                       /* _GLOBALS hijack attempt */
+               } else if (globals_on && namelen == 
sizeof("HTTP_SESSION_VARS")-1 && !memcmp(name, "HTTP_SESSION_VARS", 
sizeof("HTTP_SESSION_VARS")-1)) {
+                       /* HTTP_SESSION_VARS hijack attempt */
+               } else {
+                       if (has_value) {
+                               ALLOC_INIT_ZVAL(current);
+                               if (php_var_unserialize(&current, (const 
unsigned char **)&p, endptr, &var_hash TSRMLS_CC)) {
+                                       php_set_session_var(name, namelen, 
current, &var_hash  TSRMLS_CC);
+                               }
+                               zval_ptr_dtor(&current);
                        }
-                       zval_ptr_dtor(&current);
+                       PS_ADD_VARL(name, namelen);
                }
-               PS_ADD_VARL(name, namelen);
                efree(name);
        }
 
@@ -488,6 +496,7 @@
        int namelen;
        int has_value;
        php_unserialize_data_t var_hash;
+       int globals_on = PG(register_globals);
 
        PHP_VAR_UNSERIALIZE_INIT(var_hash);
 
@@ -509,14 +518,22 @@
                name = estrndup(p, namelen);
                q++;
                
-               if (has_value) {
-                       ALLOC_INIT_ZVAL(current);
-                       if (php_var_unserialize(&current, (const unsigned char 
**)&q, endptr, &var_hash TSRMLS_CC)) {
-                               php_set_session_var(name, namelen, current, 
&var_hash TSRMLS_CC);
+               if (globals_on && namelen == sizeof("_SESSION")-1 && 
!memcmp(name, "_SESSION", sizeof("_SESSION") - 1)) {
+                       /* _SESSION hijack attempt */
+               } else if (globals_on && namelen == sizeof("GLOBALS")-1 && 
!memcmp(name, "GLOBALS", sizeof("GLOBALS") - 1)) {
+                       /* _GLOBALS hijack attempt */
+               } else if (globals_on && namelen == 
sizeof("HTTP_SESSION_VARS")-1 && !memcmp(name, "HTTP_SESSION_VARS", 
sizeof("HTTP_SESSION_VARS")-1)) {
+                       /* HTTP_SESSION_VARS hijack attempt */
+               } else { 
+                       if (has_value) {
+                               ALLOC_INIT_ZVAL(current);
+                               if (php_var_unserialize(&current, (const 
unsigned char **)&q, endptr, &var_hash TSRMLS_CC)) {
+                                       php_set_session_var(name, namelen, 
current, &var_hash TSRMLS_CC);
+                               }
+                               zval_ptr_dtor(&current);
                        }
-                       zval_ptr_dtor(&current);
+                       PS_ADD_VARL(name, namelen);
                }
-               PS_ADD_VARL(name, namelen);
                efree(name);
                
                p = q;
@@ -536,12 +553,16 @@
        zend_hash_del(&EG(symbol_table), "HTTP_SESSION_VARS", 
sizeof("HTTP_SESSION_VARS"));
        zend_hash_del(&EG(symbol_table), "_SESSION", sizeof("_SESSION"));
 
+       if (PS(http_session_vars)) {
+               zval_ptr_dtor(&PS(http_session_vars));
+       }
+
        MAKE_STD_ZVAL(session_vars);
        array_init(session_vars);
        PS(http_session_vars) = session_vars;
 
-       ZEND_SET_GLOBAL_VAR_WITH_LENGTH("HTTP_SESSION_VARS", 
sizeof("HTTP_SESSION_VARS"), PS(http_session_vars), 2, 1);
-       ZEND_SET_GLOBAL_VAR_WITH_LENGTH("_SESSION", sizeof("_SESSION"), 
PS(http_session_vars), 2, 1);
+       ZEND_SET_GLOBAL_VAR_WITH_LENGTH("HTTP_SESSION_VARS", 
sizeof("HTTP_SESSION_VARS"), PS(http_session_vars), 3, 1);
+       ZEND_SET_GLOBAL_VAR_WITH_LENGTH("_SESSION", sizeof("_SESSION"), 
PS(http_session_vars), 3, 1);
 }
 
 static char *php_session_encode(int *newlen TSRMLS_DC)
@@ -1641,6 +1662,10 @@
 
 static void php_rshutdown_session_globals(TSRMLS_D)
 {
+       if (PS(http_session_vars)) {
+               zval_ptr_dtor(&PS(http_session_vars));
+               PS(http_session_vars) = NULL;
+       }
        if (PS(mod_data)) {
                zend_try {
                        PS(mod)->s_close(&PS(mod_data) TSRMLS_CC);

-- 
PHP CVS Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php