Skip to content

Commit f7d7bef

Browse files
smalyshevsmalyshev
committed
Fix #69719 - more checks for nulls in paths
1 parent 531c306 commit f7d7bef

File tree

2 files changed

+25
-13
lines changed

2 files changed

+25
-13
lines changed

‎ext/dom/document.c

Lines changed: 17 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1761,7 +1761,7 @@ PHP_FUNCTION(dom_document_save)
17611761
char *file;
17621762
long options = 0;
17631763

1764-
if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Os|l", &id, dom_document_class_entry, &file, &file_len, &options) == FAILURE) {
1764+
if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Op|l", &id, dom_document_class_entry, &file, &file_len, &options) == FAILURE) {
17651765
return;
17661766
}
17671767

@@ -1990,7 +1990,7 @@ static void _dom_document_schema_validate(INTERNAL_FUNCTION_PARAMETERS, int type
19901990
int is_valid;
19911991
char resolved_path[MAXPATHLEN + 1];
19921992

1993-
if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Op", &id, dom_document_class_entry, &source, &source_len) == FAILURE) {
1993+
if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Os", &id, dom_document_class_entry, &source, &source_len) == FAILURE) {
19941994
return;
19951995
}
19961996

@@ -2003,6 +2003,10 @@ static void _dom_document_schema_validate(INTERNAL_FUNCTION_PARAMETERS, int type
20032003

20042004
switch (type) {
20052005
case DOM_LOAD_FILE:
2006+
if (CHECK_NULL_PATH(source, source_len)) {
2007+
php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid Schema file source");
2008+
RETURN_FALSE;
2009+
}
20062010
valid_file = _dom_get_valid_file_path(source, resolved_path, MAXPATHLEN TSRMLS_CC);
20072011
if (!valid_file) {
20082012
php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid Schema file source");
@@ -2079,7 +2083,7 @@ static void _dom_document_relaxNG_validate(INTERNAL_FUNCTION_PARAMETERS, int typ
20792083
int is_valid;
20802084
char resolved_path[MAXPATHLEN + 1];
20812085

2082-
if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Op", &id, dom_document_class_entry, &source, &source_len) == FAILURE) {
2086+
if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Os", &id, dom_document_class_entry, &source, &source_len) == FAILURE) {
20832087
return;
20842088
}
20852089

@@ -2092,6 +2096,10 @@ static void _dom_document_relaxNG_validate(INTERNAL_FUNCTION_PARAMETERS, int typ
20922096

20932097
switch (type) {
20942098
case DOM_LOAD_FILE:
2099+
if (CHECK_NULL_PATH(source, source_len)) {
2100+
php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid RelaxNG file source");
2101+
RETURN_FALSE;
2102+
}
20952103
valid_file = _dom_get_valid_file_path(source, resolved_path, MAXPATHLEN TSRMLS_CC);
20962104
if (!valid_file) {
20972105
php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid RelaxNG file source");
@@ -2172,7 +2180,7 @@ static void dom_load_html(INTERNAL_FUNCTION_PARAMETERS, int mode) /* {{{ */
21722180

21732181
id = getThis();
21742182

2175-
if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p|l", &source, &source_len, &options) == FAILURE) {
2183+
if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|l", &source, &source_len, &options) == FAILURE) {
21762184
return;
21772185
}
21782186

@@ -2182,6 +2190,10 @@ static void dom_load_html(INTERNAL_FUNCTION_PARAMETERS, int mode) /* {{{ */
21822190
}
21832191

21842192
if (mode == DOM_LOAD_FILE) {
2193+
if (CHECK_NULL_PATH(source, source_len)) {
2194+
php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid file source");
2195+
RETURN_FALSE;
2196+
}
21852197
ctxt = htmlCreateFileParserCtxt(source, NULL);
21862198
} else {
21872199
source_len = xmlStrlen(source);
@@ -2270,7 +2282,7 @@ PHP_FUNCTION(dom_document_save_html_file)
22702282
char *file;
22712283
const char *encoding;
22722284

2273-
if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Os", &id, dom_document_class_entry, &file, &file_len) == FAILURE) {
2285+
if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Op", &id, dom_document_class_entry, &file, &file_len) == FAILURE) {
22742286
return;
22752287
}
22762288

‎ext/gd/gd.c

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1790,7 +1790,7 @@ PHP_FUNCTION(imagefilledarc)
17901790
long cx, cy, w, h, ST, E, col, style;
17911791
gdImagePtr im;
17921792
int e, st;
1793-
1793+
17941794
if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "rllllllll", &IM, &cx, &cy, &w, &h, &ST, &E, &col, &style) == FAILURE) {
17951795
return;
17961796
}
@@ -2033,7 +2033,7 @@ PHP_FUNCTION(imagegrabwindow)
20332033
if ( handle == 0 ) {
20342034
goto clean;
20352035
}
2036-
pPrintWindow = (tPrintWindow) GetProcAddress(handle, "PrintWindow");
2036+
pPrintWindow = (tPrintWindow) GetProcAddress(handle, "PrintWindow");
20372037

20382038
if ( pPrintWindow ) {
20392039
pPrintWindow(window, memDC, (UINT) client_area);
@@ -3984,7 +3984,7 @@ static void php_imagettftext_common(INTERNAL_FUNCTION_PARAMETERS, int mode, int
39843984
if (zend_hash_get_current_data_ex(HASH_OF(EXT), (void **) &item, &pos) == FAILURE) {
39853985
continue;
39863986
}
3987-
3987+
39883988
if (strcmp("linespacing", key) == 0) {
39893989
convert_to_double_ex(item);
39903990
strex.flags |= gdFTEX_LINESPACE;
@@ -4006,7 +4006,7 @@ static void php_imagettftext_common(INTERNAL_FUNCTION_PARAMETERS, int mode, int
40064006
#endif
40074007

40084008
PHP_GD_CHECK_OPEN_BASEDIR(fontname, "Invalid font filename");
4009-
4009+
40104010
#ifdef USE_GD_IMGSTRTTF
40114011
# if HAVE_GD_STRINGFTEX
40124012
if (extended) {
@@ -4071,7 +4071,7 @@ PHP_FUNCTION(imagepsloadfont)
40714071
struct stat st;
40724072
#endif
40734073

4074-
if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &file, &file_len) == FAILURE) {
4074+
if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p", &file, &file_len) == FAILURE) {
40754075
return;
40764076
}
40774077

@@ -4411,11 +4411,11 @@ PHP_FUNCTION(imagepsbbox)
44114411
if (argc != 3 && argc != 6) {
44124412
ZEND_WRONG_PARAM_COUNT();
44134413
}
4414-
4414+
44154415
if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "srl|lld", &str, &str_len, &fnt, &sz, &sp, &wd, &angle) == FAILURE) {
44164416
return;
44174417
}
4418-
4418+
44194419
if (argc == 6) {
44204420
space = sp;
44214421
add_width = wd;
@@ -4600,7 +4600,7 @@ static void _php_image_convert(INTERNAL_FUNCTION_PARAMETERS, int image_type )
46004600
#ifdef HAVE_GD_JPG
46014601
long ignore_warning;
46024602
#endif
4603-
4603+
46044604
if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "pplll", &f_org, &f_org_len, &f_dest, &f_dest_len, &height, &width, &threshold) == FAILURE) {
46054605
return;
46064606
}

0 commit comments

Comments
 (0)