Skip to content

Commit 4e2fb47

Browse files
smalyshevsmalyshev
committed
Merge branch 'PHP-5.4' into PHP-5.5
* PHP-5.4: Fix bug #69646 OS command injection vulnerability in escapeshellarg Fix #69719 - more checks for nulls in paths fix test description Fixed Buf #68812 Unchecked return value. Conflicts: ext/dom/document.c ext/gd/gd.c
2 parents 5f7c191 + 8036758 commit 4e2fb47

File tree

3 files changed

+31
-11
lines changed

3 files changed

+31
-11
lines changed

‎ext/dom/document.c

Lines changed: 17 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1761,7 +1761,7 @@ PHP_FUNCTION(dom_document_save)
17611761
char *file;
17621762
long options = 0;
17631763

1764-
if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Os|l", &id, dom_document_class_entry, &file, &file_len, &options) == FAILURE) {
1764+
if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Op|l", &id, dom_document_class_entry, &file, &file_len, &options) == FAILURE) {
17651765
return;
17661766
}
17671767

@@ -1991,7 +1991,7 @@ static void _dom_document_schema_validate(INTERNAL_FUNCTION_PARAMETERS, int type
19911991
int is_valid;
19921992
char resolved_path[MAXPATHLEN + 1];
19931993

1994-
if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Op|l", &id, dom_document_class_entry, &source, &source_len, &flags) == FAILURE) {
1994+
if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Os|l", &id, dom_document_class_entry, &source, &source_len, &flags) == FAILURE) {
19951995
return;
19961996
}
19971997

@@ -2004,6 +2004,10 @@ static void _dom_document_schema_validate(INTERNAL_FUNCTION_PARAMETERS, int type
20042004

20052005
switch (type) {
20062006
case DOM_LOAD_FILE:
2007+
if (CHECK_NULL_PATH(source, source_len)) {
2008+
php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid Schema file source");
2009+
RETURN_FALSE;
2010+
}
20072011
valid_file = _dom_get_valid_file_path(source, resolved_path, MAXPATHLEN TSRMLS_CC);
20082012
if (!valid_file) {
20092013
php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid Schema file source");
@@ -2087,7 +2091,7 @@ static void _dom_document_relaxNG_validate(INTERNAL_FUNCTION_PARAMETERS, int typ
20872091
int is_valid;
20882092
char resolved_path[MAXPATHLEN + 1];
20892093

2090-
if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Op", &id, dom_document_class_entry, &source, &source_len) == FAILURE) {
2094+
if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Os", &id, dom_document_class_entry, &source, &source_len) == FAILURE) {
20912095
return;
20922096
}
20932097

@@ -2100,6 +2104,10 @@ static void _dom_document_relaxNG_validate(INTERNAL_FUNCTION_PARAMETERS, int typ
21002104

21012105
switch (type) {
21022106
case DOM_LOAD_FILE:
2107+
if (CHECK_NULL_PATH(source, source_len)) {
2108+
php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid RelaxNG file source");
2109+
RETURN_FALSE;
2110+
}
21032111
valid_file = _dom_get_valid_file_path(source, resolved_path, MAXPATHLEN TSRMLS_CC);
21042112
if (!valid_file) {
21052113
php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid RelaxNG file source");
@@ -2180,7 +2188,7 @@ static void dom_load_html(INTERNAL_FUNCTION_PARAMETERS, int mode) /* {{{ */
21802188

21812189
id = getThis();
21822190

2183-
if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p|l", &source, &source_len, &options) == FAILURE) {
2191+
if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|l", &source, &source_len, &options) == FAILURE) {
21842192
return;
21852193
}
21862194

@@ -2190,6 +2198,10 @@ static void dom_load_html(INTERNAL_FUNCTION_PARAMETERS, int mode) /* {{{ */
21902198
}
21912199

21922200
if (mode == DOM_LOAD_FILE) {
2201+
if (CHECK_NULL_PATH(source, source_len)) {
2202+
php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid file source");
2203+
RETURN_FALSE;
2204+
}
21932205
ctxt = htmlCreateFileParserCtxt(source, NULL);
21942206
} else {
21952207
source_len = xmlStrlen(source);
@@ -2278,7 +2290,7 @@ PHP_FUNCTION(dom_document_save_html_file)
22782290
char *file;
22792291
const char *encoding;
22802292

2281-
if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Os", &id, dom_document_class_entry, &file, &file_len) == FAILURE) {
2293+
if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Op", &id, dom_document_class_entry, &file, &file_len) == FAILURE) {
22822294
return;
22832295
}
22842296

‎ext/gd/gd.c

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1735,7 +1735,7 @@ PHP_FUNCTION(imagefilledarc)
17351735
long cx, cy, w, h, ST, E, col, style;
17361736
gdImagePtr im;
17371737
int e, st;
1738-
1738+
17391739
if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "rllllllll", &IM, &cx, &cy, &w, &h, &ST, &E, &col, &style) == FAILURE) {
17401740
return;
17411741
}
@@ -1976,7 +1976,7 @@ PHP_FUNCTION(imagegrabwindow)
19761976
if ( handle == 0 ) {
19771977
goto clean;
19781978
}
1979-
pPrintWindow = (tPrintWindow) GetProcAddress(handle, "PrintWindow");
1979+
pPrintWindow = (tPrintWindow) GetProcAddress(handle, "PrintWindow");
19801980

19811981
if ( pPrintWindow ) {
19821982
pPrintWindow(window, memDC, (UINT) client_area);
@@ -3845,7 +3845,7 @@ static void php_imagettftext_common(INTERNAL_FUNCTION_PARAMETERS, int mode, int
38453845
if (zend_hash_get_current_data_ex(HASH_OF(EXT), (void **) &item, &pos) == FAILURE) {
38463846
continue;
38473847
}
3848-
3848+
38493849
if (strcmp("linespacing", key) == 0) {
38503850
convert_to_double_ex(item);
38513851
strex.flags |= gdFTEX_LINESPACE;
@@ -3924,7 +3924,7 @@ PHP_FUNCTION(imagepsloadfont)
39243924
struct stat st;
39253925
#endif
39263926

3927-
if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &file, &file_len) == FAILURE) {
3927+
if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p", &file, &file_len) == FAILURE) {
39283928
return;
39293929
}
39303930

@@ -4264,11 +4264,11 @@ PHP_FUNCTION(imagepsbbox)
42644264
if (argc != 3 && argc != 6) {
42654265
ZEND_WRONG_PARAM_COUNT();
42664266
}
4267-
4267+
42684268
if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "srl|lld", &str, &str_len, &fnt, &sz, &sp, &wd, &angle) == FAILURE) {
42694269
return;
42704270
}
4271-
4271+
42724272
if (argc == 6) {
42734273
space = sp;
42744274
add_width = wd;

‎ext/standard/exec.c

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -380,6 +380,14 @@ PHPAPI char *php_escape_shell_arg(char *str)
380380
}
381381
}
382382
#ifdef PHP_WIN32
383+
if (y > 0 && '\\' == cmd[y - 1]) {
384+
int k = 0, n = y - 1;
385+
for (; n >= 0 && '\\' == cmd[n]; n--, k++);
386+
if (k % 2) {
387+
cmd[y++] = '\\';
388+
}
389+
}
390+
383391
cmd[y++] = '"';
384392
#else
385393
cmd[y++] = '\'';

0 commit comments

Comments
 (0)