[PHP-CVS] com php-src: Fixed external entity loading: ext/libxml/libxml.c ext/libxml/php_libxml.h ext/soap/php_xml.c
Commit:8e76d0404b7f664ee6719fd98f0483f0ac4669d6
Author:Dmitry Stogov Wed, 20 Feb 2013 22:14:59
+0400
Parents: afc1debb2f48938e98ec35dbc6545b331b1c3096
Branches: PHP-5.3 PHP-5.4 PHP-5.5 master
Link:
http://git.php.net/?p=php-src.git;a=commitdiff;h=8e76d0404b7f664ee6719fd98f0483f0ac4669d6
Log:
Fixed external entity loading
Changed paths:
M ext/libxml/libxml.c
M ext/libxml/php_libxml.h
M ext/soap/php_xml.c
Diff:
diff --git a/ext/libxml/libxml.c b/ext/libxml/libxml.c
index 5db1f31..920a90c 100644
--- a/ext/libxml/libxml.c
+++ b/ext/libxml/libxml.c
@@ -261,6 +261,7 @@ static PHP_GINIT_FUNCTION(libxml)
libxml_globals->stream_context = NULL;
libxml_globals->error_buffer.c = NULL;
libxml_globals->error_list = NULL;
+ libxml_globals->entity_loader_disabled = 0;
}
/* Channel libxml file io layer through the PHP streams subsystem.
@@ -348,16 +349,15 @@ static int php_libxml_streams_IO_close(void *context)
}
static xmlParserInputBufferPtr
-php_libxml_input_buffer_noload(const char *URI, xmlCharEncoding enc)
-{
- return NULL;
-}
-
-static xmlParserInputBufferPtr
php_libxml_input_buffer_create_filename(const char *URI, xmlCharEncoding enc)
{
xmlParserInputBufferPtr ret;
void *context = NULL;
+ TSRMLS_FETCH();
+
+ if (LIBXML(entity_loader_disabled)) {
+ return NULL;
+ }
if (URI == NULL)
return(NULL);
@@ -834,28 +834,25 @@ static PHP_FUNCTION(libxml_clear_errors)
}
/* }}} */
+PHP_LIBXML_API zend_bool php_libxml_disable_entity_loader(zend_bool disable
TSRMLS_DC)
+{
+ zend_bool old = LIBXML(entity_loader_disabled);
+
+ LIBXML(entity_loader_disabled) = disable;
+ return old;
+}
+
/* {{{ proto bool libxml_disable_entity_loader([boolean disable])
Disable/Enable ability to load external entities */
static PHP_FUNCTION(libxml_disable_entity_loader)
{
zend_bool disable = 1;
- xmlParserInputBufferCreateFilenameFunc old;
if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "|b", &disable) ==
FAILURE) {
return;
}
- if (disable == 0) {
- old =
xmlParserInputBufferCreateFilenameDefault(php_libxml_input_buffer_create_filename);
- } else {
- old =
xmlParserInputBufferCreateFilenameDefault(php_libxml_input_buffer_noload);
- }
-
- if (old == php_libxml_input_buffer_noload) {
- RETURN_TRUE;
- }
-
- RETURN_FALSE;
+ RETURN_BOOL(php_libxml_disable_entity_loader(disable TSRMLS_CC));
}
/* }}} */
diff --git a/ext/libxml/php_libxml.h b/ext/libxml/php_libxml.h
index 91a6d24..a7d8466 100644
--- a/ext/libxml/php_libxml.h
+++ b/ext/libxml/php_libxml.h
@@ -43,6 +43,7 @@ ZEND_BEGIN_MODULE_GLOBALS(libxml)
zval *stream_context;
smart_str error_buffer;
zend_llist *error_list;
+ zend_bool entity_loader_disabled;
ZEND_END_MODULE_GLOBALS(libxml)
typedef struct _libxml_doc_props {
@@ -93,6 +94,7 @@ PHP_LIBXML_API void php_libxml_ctx_error(void *ctx, const
char *msg, ...);
PHP_LIBXML_API int php_libxml_xmlCheckUTF8(const unsigned char *s);
PHP_LIBXML_API zval *php_libxml_switch_context(zval *context TSRMLS_DC);
PHP_LIBXML_API void php_libxml_issue_error(int level, const char *msg
TSRMLS_DC);
+PHP_LIBXML_API zend_bool php_libxml_disable_entity_loader(zend_bool disable
TSRMLS_DC);
/* Init/shutdown functions*/
PHP_LIBXML_API void php_libxml_initialize(void);
diff --git a/ext/soap/php_xml.c b/ext/soap/php_xml.c
index 006db85..7823100 100644
--- a/ext/soap/php_xml.c
+++ b/ext/soap/php_xml.c
@@ -20,6 +20,7 @@
/* $Id$ */
#include "php_soap.h"
+#include "ext/libxml/php_libxml.h"
#include "libxml/parser.h"
#include "libxml/parserInternals.h"
@@ -91,14 +92,17 @@ xmlDocPtr soap_xmlParseFile(const char *filename TSRMLS_DC)
ctxt = xmlCreateFileParserCtxt(filename);
PG(allow_url_fopen) = old_allow_url_fopen;
if (ctxt) {
+ zend_bool old;
+
ctxt->keepBlanks = 0;
- ctxt->options &= ~XML_PARSE_DTDLOAD;
ctxt->sax->ignorableWhitespace = soap_ignorableWhitespace;
ctxt->sax->comment = soap_Comment;
ctxt->sax->warning = NULL;
ctxt->sax->error = NULL;
/*ctxt->sax->fatalError = NULL;*/
+ old = php_libxml_disable_entity_loader(1);
xmlParseDocument(ctxt);
+ php_libxml_disable_entity_loader(old);
if (ctxt->wellFormed) {
ret = ctxt->myDoc;
if (ret->URL == NULL && ctxt->directory != NULL) {
@@ -134,7 +138,8 @@ xmlDocPtr soap_xmlParseMemory(const void *buf, size_t
buf_size)
*/
ctxt = xmlCreateMemoryParserCtxt(buf, buf_size);
if (ctxt) {
- ctxt->options &= ~XML_PARSE_DTDLOAD;
+ zend_bool old;
+
ctxt->
[PHP-CVS] com php-src: Merge branch 'PHP-5.3' into PHP-5.4: ext/libxml/libxml.c ext/libxml/php_libxml.h ext/soap/php_xml.c
Commit:c737b89473df9dba6742b8fc8fbf6d009bf05c36
Author:Dmitry Stogov Wed, 20 Feb 2013 22:27:41
+0400
Parents: 021f57ef0e21868f6bbef34c4b1a1a2bf5461159
8e76d0404b7f664ee6719fd98f0483f0ac4669d6
Branches: PHP-5.4 PHP-5.5 master
Link:
http://git.php.net/?p=php-src.git;a=commitdiff;h=c737b89473df9dba6742b8fc8fbf6d009bf05c36
Log:
Merge branch 'PHP-5.3' into PHP-5.4
* PHP-5.3:
Fixed external entity loading
Conflicts:
ext/libxml/libxml.c
ext/libxml/php_libxml.h
Changed paths:
MM ext/libxml/libxml.c
MM ext/libxml/php_libxml.h
MM ext/soap/php_xml.c
Diff:
diff --cc ext/libxml/libxml.c
index 0f1c2bb,920a90c..b1cb45d
--- a/ext/libxml/libxml.c
+++ b/ext/libxml/libxml.c
@@@ -269,20 -261,9 +269,21 @@@ static PHP_GINIT_FUNCTION(libxml
libxml_globals->stream_context = NULL;
libxml_globals->error_buffer.c = NULL;
libxml_globals->error_list = NULL;
+ libxml_globals->entity_loader.fci.size = 0;
+ libxml_globals->entity_loader_disabled = 0;
}
+static void _php_libxml_destroy_fci(zend_fcall_info *fci)
+{
+ if (fci->size > 0) {
+ zval_ptr_dtor(&fci->function_name);
+ if (fci->object_ptr != NULL) {
+ zval_ptr_dtor(&fci->object_ptr);
+ }
+ fci->size = 0;
+ }
+}
+
/* Channel libxml file io layer through the PHP streams subsystem.
* This allows use of ftps:// and https:// urls */
diff --cc ext/libxml/php_libxml.h
index 8b9acc0,a7d8466..04f8b49
--- a/ext/libxml/php_libxml.h
+++ b/ext/libxml/php_libxml.h
@@@ -43,10 -43,7 +43,11 @@@ ZEND_BEGIN_MODULE_GLOBALS(libxml
zval *stream_context;
smart_str error_buffer;
zend_llist *error_list;
+ struct _php_libxml_entity_resolver {
+ zend_fcall_info fci;
+ zend_fcall_info_cache fcc;
+ } entity_loader;
+ zend_bool entity_loader_disabled;
ZEND_END_MODULE_GLOBALS(libxml)
typedef struct _libxml_doc_props {
--
PHP CVS Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
[PHP-CVS] com php-src: 5.3.22 NEWS: NEWS
Commit:afc1debb2f48938e98ec35dbc6545b331b1c3096 Author:Johannes Schlüter Wed, 20 Feb 2013 11:56:29 +0100 Parents: 558c5dbe655ffe13d27c47fa02e108302a7dfe73 Branches: PHP-5.3 PHP-5.4 PHP-5.5 master Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=afc1debb2f48938e98ec35dbc6545b331b1c3096 Log: 5.3.22 NEWS Changed paths: M NEWS Diff: diff --git a/NEWS b/NEWS index 26d56cc..0242cff 100644 --- a/NEWS +++ b/NEWS @@ -6,10 +6,7 @@ PHP NEWS . Fixed bug #64228 (RecursiveDirectoryIterator always assumes SKIP_DOTS). (patch by kr...@krizalys.com, Laruence) - -?? ??? 2013, PHP 5.3.22 - -## DON'T ADD ENTRIES TO THIS SECTION - TALK TO RM FOR MERGES +21 Feb 2013, PHP 5.3.22 - Zend Engine: . Fixed bug #64099 (Wrong TSRM usage in zend_Register_class alias). (Johannes) @@ -26,6 +23,11 @@ PHP NEWS - FPM: . Fixed bug #63999 (php with fpm fails to build on Solaris 10 or 11). (Adam) +- SOAP + . Added check that soap.wsdl_cache_dir conforms to open_basedir +(CVE-2013-1635). (Dmitry) + . Disabled external entities loading (CVE-2013-1643). (Dmitry) + - SPL: . Fixed bug #64106 (Segfault on SplFixedArray[][x] = y when extended). (Nikita Popov) -- PHP CVS Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php
[PHP-CVS] tag php-src: create tag php-5.3.22
Tag php-5.3.22 in php-src.git was created Tag: 0a516d521e97c6bf788f07dc7a49795ad72ae8c2 Tagger: Johannes Schlüter Wed Feb 20 11:53:16 2013 +0100 Log: PHP 5.3.22 -BEGIN PGP SIGNATURE- Version: GnuPG v2.0.17 (SunOS) iQEcBAABAgAGBQJRJKsnAAoJEH3sTmn8nIPXZOoH/AiYHdNaclzprvq0c0oGKgl0 VsTT9/FkeQ9AoygNBmv3O1CpszGsnM6SsV2I2lOycWLiBHYJgZcgTzyI7wnKa6Nl dFXCt6EnisAkU0xYh6weu6h4axx2RxjKAMVg0VMFom+7+2W1/Ege6kGGa5y7vslu /uP4gVQYLOqEdz//BYj5e06EyNe/A8CT8PiNskR/kHUo/SNXYhAkMzs4cOiqdbaC fS4RAamPs1d128TCy4nv2gArLQK00LXtJHGP+SD1ixeKDgEsypkKIDTTRO318VnQ m0DVNXsyMMI7kjPdnwe+GpRRGIqLkymXFK0xFe3WoeiyNYkQi5wi55QksCpXTww= =NU41 -END PGP SIGNATURE- Link: http://git.php.net/?p=php-src.git;a=tag;h=0a516d521e97c6bf788f07dc7a49795ad72ae8c2 Target: 13616e8856076ee7bd3d661fd492326565ae48ff Author: Johannes Schlüter Wed, 20 Feb 2013 11:52:37 +0100 Parents: 229edf4f3d76bb34637f87b24240631c013ab79e Target link: http://git.php.net/?p=php-src.git;a=commitdiff;h=13616e8856076ee7bd3d661fd492326565ae48ff Target log: PHP 5.3.22 Changed paths: M NEWS M configure.in M main/php_version.h -- PHP CVS Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php
