dmitry Tue Jul 15 13:38:57 2008 UTC
Modified files:
/php-src/sapi/cgi cgi_main.c
Log:
Fixed bug #45151 (Crash with URI/file..php (filename contains 2 dots))
http://cvs.php.net/viewvc.cgi/php-src/sapi/cgi/cgi_main.c?r1=1.357&r2=1.358&diff_format=u
Index: php-src/sapi/cgi/cgi_main.c
diff -u php-src/sapi/cgi/cgi_main.c:1.357 php-src/sapi/cgi/cgi_main.c:1.358
--- php-src/sapi/cgi/cgi_main.c:1.357 Tue Jul 15 13:10:42 2008
+++ php-src/sapi/cgi/cgi_main.c Tue Jul 15 13:38:56 2008
@@ -21,7 +21,7 @@
+----------------------------------------------------------------------+
*/
-/* $Id: cgi_main.c,v 1.357 2008/07/15 13:10:42 dmitry Exp $ */
+/* $Id: cgi_main.c,v 1.358 2008/07/15 13:38:56 dmitry Exp $ */
#include "php.h"
#include "php_globals.h"
@@ -876,6 +876,39 @@
}
/* }}} */
+/* {{{ is_valid_path
+ *
+ * some server configurations allow '..' to slip through in the
+ * translated path. We'll just refuse to handle such a path.
+ */
+static int is_valid_path(const char *path)
+{
+ const char *p;
+
+ if (!path) {
+ return 0;
+ }
+ p = strstr(path, "..");
+ if (p) {
+ if ((p == path || IS_SLASH(*(p-1))) &&
+ (*(p+2) == 0 || IS_SLASH(*(p+2)))) {
+ return 0;
+ }
+ while (1) {
+ p = strstr(p+1, "..");
+ if (!p) {
+ break;
+ }
+ if (IS_SLASH(*(p-1)) &&
+ (*(p+2) == 0 || IS_SLASH(*(p+2)))) {
+ return 0;
+ }
+ }
+ }
+ return 1;
+}
+/* }}} */
+
/* {{{ init_request_info
initializes request_info structure
@@ -1171,9 +1204,7 @@
if (pt) {
efree(pt);
}
- /* some server configurations allow '..' to
slip through in the
- translated path. We'll just refuse to
handle such a path. */
- if (script_path_translated &&
!strstr(script_path_translated, "..")) {
+ if (is_valid_path(script_path_translated)) {
SG(request_info).path_translated =
estrdup(script_path_translated);
}
} else {
@@ -1204,9 +1235,7 @@
} else {
SG(request_info).request_uri =
env_script_name;
}
- /* some server configurations allow '..' to
slip through in the
- translated path. We'll just refuse to
handle such a path. */
- if (script_path_translated &&
!strstr(script_path_translated, "..")) {
+ if (is_valid_path(script_path_translated)) {
SG(request_info).path_translated =
estrdup(script_path_translated);
}
free(real_path);
@@ -1221,9 +1250,7 @@
if (!CGIG(discard_path) && env_path_translated) {
script_path_translated = env_path_translated;
}
- /* some server configurations allow '..' to slip
through in the
- translated path. We'll just refuse to handle such
a path. */
- if (script_path_translated &&
!strstr(script_path_translated, "..")) {
+ if (is_valid_path(script_path_translated)) {
SG(request_info).path_translated =
estrdup(script_path_translated);
}
}
--
PHP CVS Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
