Skip to content

Commit 58e590a

Browse files
smalyshevJulien Pauli
smalyshev
authored and
Julien Pauli
committed
Fix #69719 - more checks for nulls in paths
Conflicts: ext/dom/document.c ext/gd/gd.c
1 parent b16842e commit 58e590a

File tree

2 files changed

+30
-12
lines changed

2 files changed

+30
-12
lines changed

‎ext/dom/document.c

Lines changed: 16 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1761,7 +1761,7 @@ PHP_FUNCTION(dom_document_save)
17611761
char *file;
17621762
long options = 0;
17631763

1764-
if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Os|l", &id, dom_document_class_entry, &file, &file_len, &options) == FAILURE) {
1764+
if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Op|l", &id, dom_document_class_entry, &file, &file_len, &options) == FAILURE) {
17651765
return;
17661766
}
17671767

@@ -2004,6 +2004,10 @@ static void _dom_document_schema_validate(INTERNAL_FUNCTION_PARAMETERS, int type
20042004

20052005
switch (type) {
20062006
case DOM_LOAD_FILE:
2007+
if (CHECK_NULL_PATH(source, source_len)) {
2008+
php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid Schema file source");
2009+
RETURN_FALSE;
2010+
}
20072011
valid_file = _dom_get_valid_file_path(source, resolved_path, MAXPATHLEN TSRMLS_CC);
20082012
if (!valid_file) {
20092013
php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid Schema file source");
@@ -2087,7 +2091,7 @@ static void _dom_document_relaxNG_validate(INTERNAL_FUNCTION_PARAMETERS, int typ
20872091
int is_valid;
20882092
char resolved_path[MAXPATHLEN + 1];
20892093

2090-
if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Op", &id, dom_document_class_entry, &source, &source_len) == FAILURE) {
2094+
if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Os", &id, dom_document_class_entry, &source, &source_len) == FAILURE) {
20912095
return;
20922096
}
20932097

@@ -2100,6 +2104,10 @@ static void _dom_document_relaxNG_validate(INTERNAL_FUNCTION_PARAMETERS, int typ
21002104

21012105
switch (type) {
21022106
case DOM_LOAD_FILE:
2107+
if (CHECK_NULL_PATH(source, source_len)) {
2108+
php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid RelaxNG file source");
2109+
RETURN_FALSE;
2110+
}
21032111
valid_file = _dom_get_valid_file_path(source, resolved_path, MAXPATHLEN TSRMLS_CC);
21042112
if (!valid_file) {
21052113
php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid RelaxNG file source");
@@ -2180,7 +2188,7 @@ static void dom_load_html(INTERNAL_FUNCTION_PARAMETERS, int mode) /* {{{ */
21802188

21812189
id = getThis();
21822190

2183-
if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p|l", &source, &source_len, &options) == FAILURE) {
2191+
if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|l", &source, &source_len, &options) == FAILURE) {
21842192
return;
21852193
}
21862194

@@ -2190,6 +2198,10 @@ static void dom_load_html(INTERNAL_FUNCTION_PARAMETERS, int mode) /* {{{ */
21902198
}
21912199

21922200
if (mode == DOM_LOAD_FILE) {
2201+
if (CHECK_NULL_PATH(source, source_len)) {
2202+
php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid file source");
2203+
RETURN_FALSE;
2204+
}
21932205
ctxt = htmlCreateFileParserCtxt(source, NULL);
21942206
} else {
21952207
source_len = xmlStrlen(source);
@@ -2278,7 +2290,7 @@ PHP_FUNCTION(dom_document_save_html_file)
22782290
char *file;
22792291
const char *encoding;
22802292

2281-
if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Os", &id, dom_document_class_entry, &file, &file_len) == FAILURE) {
2293+
if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Op", &id, dom_document_class_entry, &file, &file_len) == FAILURE) {
22822294
return;
22832295
}
22842296

‎ext/gd/gd.c

Lines changed: 14 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1735,7 +1735,7 @@ PHP_FUNCTION(imagefilledarc)
17351735
long cx, cy, w, h, ST, E, col, style;
17361736
gdImagePtr im;
17371737
int e, st;
1738-
1738+
17391739
if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "rllllllll", &IM, &cx, &cy, &w, &h, &ST, &E, &col, &style) == FAILURE) {
17401740
return;
17411741
}
@@ -1976,7 +1976,7 @@ PHP_FUNCTION(imagegrabwindow)
19761976
if ( handle == 0 ) {
19771977
goto clean;
19781978
}
1979-
pPrintWindow = (tPrintWindow) GetProcAddress(handle, "PrintWindow");
1979+
pPrintWindow = (tPrintWindow) GetProcAddress(handle, "PrintWindow");
19801980

19811981
if ( pPrintWindow ) {
19821982
pPrintWindow(window, memDC, (UINT) client_area);
@@ -3845,7 +3845,7 @@ static void php_imagettftext_common(INTERNAL_FUNCTION_PARAMETERS, int mode, int
38453845
if (zend_hash_get_current_data_ex(HASH_OF(EXT), (void **) &item, &pos) == FAILURE) {
38463846
continue;
38473847
}
3848-
3848+
38493849
if (strcmp("linespacing", key) == 0) {
38503850
convert_to_double_ex(item);
38513851
strex.flags |= gdFTEX_LINESPACE;
@@ -3866,8 +3866,9 @@ static void php_imagettftext_common(INTERNAL_FUNCTION_PARAMETERS, int mode, int
38663866
#endif /* VIRTUAL_DIR */
38673867

38683868
PHP_GD_CHECK_OPEN_BASEDIR(fontname, "Invalid font filename");
3869-
3870-
#ifdef HAVE_GD_FREETYPE
3869+
3870+
#ifdef USE_GD_IMGSTRTTF
3871+
# if HAVE_GD_STRINGFTEX
38713872
if (extended) {
38723873
error = gdImageStringFTEx(im, brect, col, fontname, ptsize, angle, x, y, str, &strex);
38733874
}
@@ -3924,7 +3925,7 @@ PHP_FUNCTION(imagepsloadfont)
39243925
struct stat st;
39253926
#endif
39263927

3927-
if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &file, &file_len) == FAILURE) {
3928+
if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p", &file, &file_len) == FAILURE) {
39283929
return;
39293930
}
39303931

@@ -4264,11 +4265,11 @@ PHP_FUNCTION(imagepsbbox)
42644265
if (argc != 3 && argc != 6) {
42654266
ZEND_WRONG_PARAM_COUNT();
42664267
}
4267-
4268+
42684269
if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "srl|lld", &str, &str_len, &fnt, &sz, &sp, &wd, &angle) == FAILURE) {
42694270
return;
42704271
}
4271-
4272+
42724273
if (argc == 6) {
42734274
space = sp;
42744275
add_width = wd;
@@ -4444,7 +4445,12 @@ static void _php_image_convert(INTERNAL_FUNCTION_PARAMETERS, int image_type )
44444445
int x, y;
44454446
float x_ratio, y_ratio;
44464447
long ignore_warning;
4448+
<<<<<<< HEAD
44474449

4450+
=======
4451+
#endif
4452+
4453+
>>>>>>> f7d7bef... Fix #69719 - more checks for nulls in paths
44484454
if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "pplll", &f_org, &f_org_len, &f_dest, &f_dest_len, &height, &width, &threshold) == FAILURE) {
44494455
return;
44504456
}

0 commit comments

Comments
 (0)