Skip to content

Commit 38a4b93

Browse files
weltlingweltling
committed
Merge remote-tracking branch 'origin/PHP-5.6' into str_size_and_int64_56_backport
* origin/PHP-5.6: backport the fix for bug #67739 Fix bug #67705 (extensive backtracking in rule regular expression) add test Fix bug #67705 (extensive backtracking in rule regular expression)
2 parents dccbb79 + d730675 commit 38a4b93

File tree

6 files changed

+121
-13
lines changed

6 files changed

+121
-13
lines changed

‎NEWS

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,10 @@ PHP NEWS
77
. Removed inconsistency regarding behaviour of array in constants at
88
run-time. (Bob)
99

10+
- Fileinfo:
11+
. Fixed bug #67705 (extensive backtracking in rule regular expression).
12+
(CVE-2014-3538) (Remi)
13+
1014
- Milter:
1115
. Fixed bug #67715 (php-milter does not build and crashes randomly). (Mike)
1216

‎ext/fileinfo/data_file.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -121057,7 +121057,7 @@ const unsigned char php_magic_database[2803888] = {
121057121057
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
121058121058
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
121059121059
0x00, 0x00, 0x40, 0x00, 0x3D, 0x1B, 0x11, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
121060-
0x00, 0x00, 0x00, 0x00, 0x34, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
121060+
0x00, 0x00, 0x00, 0x00, 0x34, 0x00, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
121061121061
0x5E, 0x5C, 0x73, 0x7B, 0x30, 0x2C, 0x31, 0x30, 0x30, 0x7D, 0x42, 0x45, 0x47, 0x49, 0x4E, 0x5C,
121062121062
0x73, 0x7B, 0x30, 0x2C, 0x31, 0x30, 0x30, 0x7D, 0x5B, 0x7B, 0x5D, 0x00, 0x00, 0x00, 0x00, 0x00,
121063121063
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,

‎ext/fileinfo/libmagic/softmagic.c

Lines changed: 18 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,7 @@ private int32_t mprint(struct magic_set *, struct magic *);
6767
private int32_t moffset(struct magic_set *, struct magic *);
6868
private void mdebug(uint32_t, const char *, size_t);
6969
private int mcopy(struct magic_set *, union VALUETYPE *, int, int,
70-
const unsigned char *, uint32_t, size_t, size_t);
70+
const unsigned char *, uint32_t, size_t, struct magic *);
7171
private int mconvert(struct magic_set *, struct magic *, int);
7272
private int print_sep(struct magic_set *, int);
7373
private int handle_annotation(struct magic_set *, struct magic *);
@@ -1038,7 +1038,7 @@ mdebug(uint32_t offset, const char *str, size_t len)
10381038

10391039
private int
10401040
mcopy(struct magic_set *ms, union VALUETYPE *p, int type, int indir,
1041-
const unsigned char *s, uint32_t offset, size_t nbytes, size_t linecnt)
1041+
const unsigned char *s, uint32_t offset, size_t nbytes, struct magic *m)
10421042
{
10431043
/*
10441044
* Note: FILE_SEARCH and FILE_REGEX do not actually copy
@@ -1058,15 +1058,24 @@ mcopy(struct magic_set *ms, union VALUETYPE *p, int type, int indir,
10581058
const char *last; /* end of search region */
10591059
const char *buf; /* start of search region */
10601060
const char *end;
1061-
size_t lines;
1061+
size_t lines, linecnt, bytecnt;
10621062

1063+
linecnt = m->str_range;
1064+
bytecnt = linecnt * 80;
1065+
1066+
if (bytecnt == 0) {
1067+
bytecnt = 8192;
1068+
}
1069+
if (bytecnt > nbytes) {
1070+
bytecnt = nbytes;
1071+
}
10631072
if (s == NULL) {
10641073
ms->search.s_len = 0;
10651074
ms->search.s = NULL;
10661075
return 0;
10671076
}
10681077
buf = RCAST(const char *, s) + offset;
1069-
end = last = RCAST(const char *, s) + nbytes;
1078+
end = last = RCAST(const char *, s) + bytecnt;
10701079
/* mget() guarantees buf <= last */
10711080
for (lines = linecnt, b = buf; lines && b < end &&
10721081
((b = CAST(const char *,
@@ -1079,7 +1088,7 @@ mcopy(struct magic_set *ms, union VALUETYPE *p, int type, int indir,
10791088
b++;
10801089
}
10811090
if (lines)
1082-
last = RCAST(const char *, s) + nbytes;
1091+
last = RCAST(const char *, s) + bytecnt;
10831092

10841093
ms->search.s = buf;
10851094
ms->search.s_len = last - buf;
@@ -1150,7 +1159,6 @@ mget(struct magic_set *ms, const unsigned char *s, struct magic *m,
11501159
int *need_separator, int *returnval)
11511160
{
11521161
uint32_t soffset, offset = ms->offset;
1153-
uint32_t count = m->str_range;
11541162
int rv, oneed_separator, in_type;
11551163
char *sbuf, *rbuf;
11561164
union VALUETYPE *p = &ms->ms_value;
@@ -1162,13 +1170,12 @@ mget(struct magic_set *ms, const unsigned char *s, struct magic *m,
11621170
}
11631171

11641172
if (mcopy(ms, p, m->type, m->flag & INDIR, s, (uint32_t)(offset + o),
1165-
(uint32_t)nbytes, count) == -1)
1173+
(uint32_t)nbytes, m) == -1)
11661174
return -1;
11671175

11681176
if ((ms->flags & MAGIC_DEBUG) != 0) {
11691177
fprintf(stderr, "mget(type=%d, flag=%x, offset=%u, o=%zu, "
1170-
"nbytes=%zu, count=%u)\n", m->type, m->flag, offset, o,
1171-
nbytes, count);
1178+
"nbytes=%zu)\n", m->type, m->flag, offset, o, nbytes);
11721179
mdebug(offset, (char *)(void *)p, sizeof(union VALUETYPE));
11731180
}
11741181

@@ -1661,7 +1668,7 @@ mget(struct magic_set *ms, const unsigned char *s, struct magic *m,
16611668
if ((ms->flags & MAGIC_DEBUG) != 0)
16621669
fprintf(stderr, "indirect +offs=%u\n", offset);
16631670
}
1664-
if (mcopy(ms, p, m->type, 0, s, offset, nbytes, count) == -1)
1671+
if (mcopy(ms, p, m->type, 0, s, offset, nbytes, m) == -1)
16651672
return -1;
16661673
ms->offset = offset;
16671674

@@ -2093,7 +2100,7 @@ magiccheck(struct magic_set *ms, struct magic *m)
20932100
zval *retval;
20942101
zval *subpats;
20952102
char *haystack;
2096-
2103+
20972104
MAKE_STD_ZVAL(retval);
20982105
ALLOC_INIT_ZVAL(subpats);
20992106

‎ext/fileinfo/magicdata.patch

Lines changed: 55 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,58 @@
1-
Patches applied to file sources tree before generating magic.mgc
1+
Patches applied to file 5.17 sources tree before generating magic.mgc
22
and before running create_data_file.php to create data_file.c.
33

44

5+
6+
From 0b478f445b6b7540b58af5d1fe583fa9e48fd745 Mon Sep 17 00:00:00 2001
7+
From: Christos Zoulas <christos@zoulas.com>
8+
Date: Wed, 28 May 2014 19:52:36 +0000
9+
Subject: [PATCH] further optimize awk by not looking for the BEGIN regex until
10+
we found the BEGIN (Jan Kaluza)
11+
12+
---
13+
magic/Magdir/commands | 5 +++--
14+
1 file changed, 3 insertions(+), 2 deletions(-)
15+
16+
diff --git a/magic/Magdir/commands b/magic/Magdir/commands
17+
index bfffdef..26b2869 100644
18+
--- a/magic/Magdir/commands
19+
+++ b/magic/Magdir/commands
20+
@@ -49,7 +49,8 @@
21+
!:mime text/x-awk
22+
0 string/wt #!\ /usr/bin/awk awk script text executable
23+
!:mime text/x-awk
24+
-0 regex =^\\s{0,100}BEGIN\\s{0,100}[{] awk script text
25+
+0 search/16384 BEGIN
26+
+>0 regex =^\\s{0,100}BEGIN\\s{0,100}[{] awk script text
27+
28+
# AT&T Bell Labs' Plan 9 shell
29+
0 string/wt #!\ /bin/rc Plan 9 rc shell script text executable
30+
--
31+
2.0.3
32+
33+
From 71a8b6c0d758acb0f73e2e51421a711b5e9d6668 Mon Sep 17 00:00:00 2001
34+
From: Christos Zoulas <christos@zoulas.com>
35+
Date: Fri, 30 May 2014 16:48:44 +0000
36+
Subject: [PATCH] Limit regex search for BEGIN to the first 4K of the file.
37+
38+
---
39+
magic/Magdir/commands | 5 ++---
40+
1 file changed, 2 insertions(+), 3 deletions(-)
41+
42+
diff --git a/magic/Magdir/commands b/magic/Magdir/commands
43+
index 26b2869..bcd0f43 100644
44+
--- a/magic/Magdir/commands
45+
+++ b/magic/Magdir/commands
46+
@@ -49,8 +49,7 @@
47+
!:mime text/x-awk
48+
0 string/wt #!\ /usr/bin/awk awk script text executable
49+
!:mime text/x-awk
50+
-0 search/16384 BEGIN
51+
->0 regex =^\\s{0,100}BEGIN\\s{0,100}[{] awk script text
52+
+0 regex/4096 =^\\s{0,100}BEGIN\\s{0,100}[{] awk script text
53+
54+
# AT&T Bell Labs' Plan 9 shell
55+
0 string/wt #!\ /bin/rc Plan 9 rc shell script text executable
56+
--
57+
2.0.3
58+

‎ext/fileinfo/tests/cve-2014-3538.phpt

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
--TEST--
2+
Bug #66731: file: extensive backtraking
3+
--SKIPIF--
4+
<?php
5+
if (!class_exists('finfo'))
6+
die('skip no fileinfo extension');
7+
--FILE--
8+
<?php
9+
$fd = __DIR__.'/cve-2014-3538.data';
10+
11+
file_put_contents($fd,
12+
'try:' .
13+
str_repeat("\n", 1000000));
14+
15+
$fi = finfo_open(FILEINFO_NONE);
16+
$t = microtime(true);
17+
var_dump(finfo_file($fi, $fd));
18+
$t = microtime(true) - $t;
19+
finfo_close($fi);
20+
if ($t < 1) {
21+
echo "Ok\n";
22+
} else {
23+
printf("Failed, time=%.2f\n", $t);
24+
}
25+
26+
?>
27+
Done
28+
--CLEAN--
29+
<?php
30+
@unlink(__DIR__.'/cve-2014-3538.data');
31+
?>
32+
--EXPECTF--
33+
string(%d) "%s"
34+
Ok
35+
Done

‎ext/standard/info.c

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -592,6 +592,14 @@ PHPAPI char *php_get_uname(char mode)
592592

593593
php_get_windows_cpu(wincpu, sizeof(wincpu));
594594
dwBuild = (DWORD)(HIWORD(dwVersion));
595+
596+
/* Windows "version" 6.2 could be Windows 8/Windows Server 2012, but also Windows 8.1/Windows Server 2012 R2 */
597+
if (dwWindowsMajorVersion == 6 && dwWindowsMinorVersion == 2) {
598+
if (strncmp(winver, "Windows 8.1", 11) == 0 || strncmp(winver, "Windows Server 2012 R2", 22) == 0) {
599+
dwWindowsMinorVersion = 3;
600+
}
601+
}
602+
595603
snprintf(tmp_uname, sizeof(tmp_uname), "%s %s %d.%d build %d (%s) %s",
596604
"Windows NT", ComputerName,
597605
dwWindowsMajorVersion, dwWindowsMinorVersion, dwBuild, winver?winver:"unknown", wincpu);

0 commit comments

Comments
 (0)