Skip to content

Commit 8b1919e

Browse files
smalyshevsmalyshev
committed
Merge branch 'PHP-5.5' into PHP-5.6
* PHP-5.5: Fix bug #69646 OS command injection vulnerability in escapeshellarg Fix #69719 - more checks for nulls in paths fix test description Fixed Buf #68812 Unchecked return value.
2 parents 8574290 + 4e2fb47 commit 8b1919e

File tree

3 files changed

+31
-11
lines changed

3 files changed

+31
-11
lines changed

‎ext/dom/document.c

Lines changed: 17 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1700,7 +1700,7 @@ PHP_FUNCTION(dom_document_save)
17001700
char *file;
17011701
long options = 0;
17021702

1703-
if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Os|l", &id, dom_document_class_entry, &file, &file_len, &options) == FAILURE) {
1703+
if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Op|l", &id, dom_document_class_entry, &file, &file_len, &options) == FAILURE) {
17041704
return;
17051705
}
17061706

@@ -1930,7 +1930,7 @@ static void _dom_document_schema_validate(INTERNAL_FUNCTION_PARAMETERS, int type
19301930
int is_valid;
19311931
char resolved_path[MAXPATHLEN + 1];
19321932

1933-
if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Op|l", &id, dom_document_class_entry, &source, &source_len, &flags) == FAILURE) {
1933+
if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Os|l", &id, dom_document_class_entry, &source, &source_len, &flags) == FAILURE) {
19341934
return;
19351935
}
19361936

@@ -1943,6 +1943,10 @@ static void _dom_document_schema_validate(INTERNAL_FUNCTION_PARAMETERS, int type
19431943

19441944
switch (type) {
19451945
case DOM_LOAD_FILE:
1946+
if (CHECK_NULL_PATH(source, source_len)) {
1947+
php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid Schema file source");
1948+
RETURN_FALSE;
1949+
}
19461950
valid_file = _dom_get_valid_file_path(source, resolved_path, MAXPATHLEN TSRMLS_CC);
19471951
if (!valid_file) {
19481952
php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid Schema file source");
@@ -2026,7 +2030,7 @@ static void _dom_document_relaxNG_validate(INTERNAL_FUNCTION_PARAMETERS, int typ
20262030
int is_valid;
20272031
char resolved_path[MAXPATHLEN + 1];
20282032

2029-
if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Op", &id, dom_document_class_entry, &source, &source_len) == FAILURE) {
2033+
if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Os", &id, dom_document_class_entry, &source, &source_len) == FAILURE) {
20302034
return;
20312035
}
20322036

@@ -2039,6 +2043,10 @@ static void _dom_document_relaxNG_validate(INTERNAL_FUNCTION_PARAMETERS, int typ
20392043

20402044
switch (type) {
20412045
case DOM_LOAD_FILE:
2046+
if (CHECK_NULL_PATH(source, source_len)) {
2047+
php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid RelaxNG file source");
2048+
RETURN_FALSE;
2049+
}
20422050
valid_file = _dom_get_valid_file_path(source, resolved_path, MAXPATHLEN TSRMLS_CC);
20432051
if (!valid_file) {
20442052
php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid RelaxNG file source");
@@ -2119,7 +2127,7 @@ static void dom_load_html(INTERNAL_FUNCTION_PARAMETERS, int mode) /* {{{ */
21192127

21202128
id = getThis();
21212129

2122-
if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p|l", &source, &source_len, &options) == FAILURE) {
2130+
if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|l", &source, &source_len, &options) == FAILURE) {
21232131
return;
21242132
}
21252133

@@ -2129,6 +2137,10 @@ static void dom_load_html(INTERNAL_FUNCTION_PARAMETERS, int mode) /* {{{ */
21292137
}
21302138

21312139
if (mode == DOM_LOAD_FILE) {
2140+
if (CHECK_NULL_PATH(source, source_len)) {
2141+
php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid file source");
2142+
RETURN_FALSE;
2143+
}
21322144
ctxt = htmlCreateFileParserCtxt(source, NULL);
21332145
} else {
21342146
source_len = xmlStrlen(source);
@@ -2217,7 +2229,7 @@ PHP_FUNCTION(dom_document_save_html_file)
22172229
char *file;
22182230
const char *encoding;
22192231

2220-
if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Os", &id, dom_document_class_entry, &file, &file_len) == FAILURE) {
2232+
if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Op", &id, dom_document_class_entry, &file, &file_len) == FAILURE) {
22212233
return;
22222234
}
22232235

‎ext/gd/gd.c

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1750,7 +1750,7 @@ PHP_FUNCTION(imagefilledarc)
17501750
long cx, cy, w, h, ST, E, col, style;
17511751
gdImagePtr im;
17521752
int e, st;
1753-
1753+
17541754
if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "rllllllll", &IM, &cx, &cy, &w, &h, &ST, &E, &col, &style) == FAILURE) {
17551755
return;
17561756
}
@@ -1991,7 +1991,7 @@ PHP_FUNCTION(imagegrabwindow)
19911991
if ( handle == 0 ) {
19921992
goto clean;
19931993
}
1994-
pPrintWindow = (tPrintWindow) GetProcAddress(handle, "PrintWindow");
1994+
pPrintWindow = (tPrintWindow) GetProcAddress(handle, "PrintWindow");
19951995

19961996
if ( pPrintWindow ) {
19971997
pPrintWindow(window, memDC, (UINT) client_area);
@@ -3860,7 +3860,7 @@ static void php_imagettftext_common(INTERNAL_FUNCTION_PARAMETERS, int mode, int
38603860
if (zend_hash_get_current_data_ex(HASH_OF(EXT), (void **) &item, &pos) == FAILURE) {
38613861
continue;
38623862
}
3863-
3863+
38643864
if (strcmp("linespacing", key) == 0) {
38653865
convert_to_double_ex(item);
38663866
strex.flags |= gdFTEX_LINESPACE;
@@ -3939,7 +3939,7 @@ PHP_FUNCTION(imagepsloadfont)
39393939
struct stat st;
39403940
#endif
39413941

3942-
if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &file, &file_len) == FAILURE) {
3942+
if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p", &file, &file_len) == FAILURE) {
39433943
return;
39443944
}
39453945

@@ -4279,11 +4279,11 @@ PHP_FUNCTION(imagepsbbox)
42794279
if (argc != 3 && argc != 6) {
42804280
ZEND_WRONG_PARAM_COUNT();
42814281
}
4282-
4282+
42834283
if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "srl|lld", &str, &str_len, &fnt, &sz, &sp, &wd, &angle) == FAILURE) {
42844284
return;
42854285
}
4286-
4286+
42874287
if (argc == 6) {
42884288
space = sp;
42894289
add_width = wd;

‎ext/standard/exec.c

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -380,6 +380,14 @@ PHPAPI char *php_escape_shell_arg(char *str)
380380
}
381381
}
382382
#ifdef PHP_WIN32
383+
if (y > 0 && '\\' == cmd[y - 1]) {
384+
int k = 0, n = y - 1;
385+
for (; n >= 0 && '\\' == cmd[n]; n--, k++);
386+
if (k % 2) {
387+
cmd[y++] = '\\';
388+
}
389+
}
390+
383391
cmd[y++] = '"';
384392
#else
385393
cmd[y++] = '\'';

0 commit comments

Comments
 (0)