Commit:    000e84aa88ce16deabbf61e7086fc8db63ca88aa
Author:    Stanislav Malyshev <s...@php.net>         Mon, 7 May 2012 12:08:36 
-0700
Parents:   2068419ae5c24781714e9d60c4baf64d254d573d
Branches:  PHP-5.3

Link:       
http://git.php.net/?p=php-src.git;a=commitdiff;h=000e84aa88ce16deabbf61e7086fc8db63ca88aa

Log:
improve fix for CVE-2012-1823

Changed paths:
  M  sapi/cgi/cgi_main.c


Diff:
diff --git a/sapi/cgi/cgi_main.c b/sapi/cgi/cgi_main.c
index 760ad66..a7ac26f 100644
--- a/sapi/cgi/cgi_main.c
+++ b/sapi/cgi/cgi_main.c
@@ -1561,10 +1561,15 @@ int main(int argc, char *argv[])
                }
        }
 
-       if(query_string = getenv("QUERY_STRING")) {
+       if((query_string = getenv("QUERY_STRING")) != NULL && 
strchr(query_string, '=') == NULL) {
+               /* we've got query string that has no = - apache CGI will pass 
it to command line */
+               unsigned char *p;
                decoded_query_string = strdup(query_string);
                php_url_decode(decoded_query_string, 
strlen(decoded_query_string));
-               if(*decoded_query_string == '-' && strchr(decoded_query_string, 
'=') == NULL) {
+               for (p = decoded_query_string; *p &&  *p <= ' '; p++) {
+                       /* skip all leading spaces */
+               }
+               if(*p == '-') {
                        skip_getopt = 1;
                }
                free(decoded_query_string);
@@ -1819,7 +1824,7 @@ consult the installation file that came with this 
distribution, or visit \n\
        }
 
        zend_first_try {
-               while ((c = php_getopt(argc, argv, OPTIONS, &php_optarg, 
&php_optind, 1, 2)) != -1) {
+               while (!skip_getopt && (c = php_getopt(argc, argv, OPTIONS, 
&php_optarg, &php_optind, 1, 2)) != -1) {
                        switch (c) {
                                case 'T':
                                        benchmark = 1;


--
PHP CVS Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php

Reply via email to