Skip to content

Commit 3488cf6

Browse files
smalyshevsmalyshev
committed
Merge branch 'PHP-5.4.30' into PHP-5.4
* PHP-5.4.30: 5.4.30 Better fix for bug #67072 with more BC provisions Fix bug #67498 - phpinfo() Type Confusion Information Leak Vulnerability update CVE Fix bug #67492: unserialize() SPL ArrayObject / SPLObjectStorage Type Confusion Fix bug #67397 (Buffer overflow in locale_get_display_name->uloc_getDisplayName (libicu 4.8.1)) Fix bug #67349: Locale::parseLocale Double Free add CVEs Fix potential segfault in dns_get_record() Fix bug #66127 (Segmentation fault with ArrayObject unset) 5.4.30 rc1 Conflicts: configure.in main/php_version.h
2 parents 08e7252 + 79457d1 commit 3488cf6

File tree

8 files changed

+63
-13
lines changed

8 files changed

+63
-13
lines changed

‎ext/intl/locale/locale_methods.c‎

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -272,8 +272,7 @@ static char* get_icu_value_internal( char* loc_name , char* tag_name, int* resul
272272
grOffset = findOffset( LOC_GRANDFATHERED , loc_name );
273273
if( grOffset >= 0 ){
274274
if( strcmp(tag_name , LOC_LANG_TAG)==0 ){
275-
tag_value = estrdup(loc_name);
276-
return tag_value;
275+
return estrdup(loc_name);
277276
} else {
278277
/* Since Grandfathered , no value , do nothing , retutn NULL */
279278
return NULL;
@@ -283,8 +282,8 @@ static char* get_icu_value_internal( char* loc_name , char* tag_name, int* resul
283282
if( fromParseLocale==1 ){
284283
/* Handle singletons */
285284
if( strcmp(tag_name , LOC_LANG_TAG)==0 ){
286-
if( strlen(loc_name)>1 && (isIDPrefix(loc_name) ==1 ) ){
287-
return loc_name;
285+
if( strlen(loc_name)>1 && isIDPrefix(loc_name) ){
286+
return estrdup(loc_name);
288287
}
289288
}
290289

@@ -501,8 +500,16 @@ static void get_icu_disp_value_src_php( char* tag_name, INTERNAL_FUNCTION_PARAME
501500
RETURN_FALSE;
502501
}
503502

503+
if(loc_name_len > ULOC_FULLNAME_CAPACITY) {
504+
/* See bug 67397: overlong locale names cause trouble in uloc_getDisplayName */
505+
spprintf(&msg , 0, "locale_get_display_%s : name too long", tag_name );
506+
intl_error_set( NULL, U_ILLEGAL_ARGUMENT_ERROR, msg , 1 TSRMLS_CC );
507+
efree(msg);
508+
RETURN_FALSE;
509+
}
510+
504511
if(loc_name_len == 0) {
505-
loc_name = INTL_G(default_locale);
512+
loc_name = INTL_G(default_locale);
506513
}
507514

508515
if( strcmp(tag_name, DISP_NAME) != 0 ){

‎ext/intl/tests/bug67397.phpt‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
--TEST--
2+
Bug #67397 (Buffer overflow in locale_get_display_name->uloc_getDisplayName (libicu 4.8.1))
3+
--SKIPIF--
4+
<?php if( !extension_loaded( 'intl' ) ) print 'skip'; ?>
5+
--FILE--
6+
<?php
7+
8+
function ut_main()
9+
{
10+
$ret = var_export(ut_loc_get_display_name(str_repeat('*', 256), 'en_us'), true);
11+
$ret .= "\n";
12+
$ret .= var_export(intl_get_error_message(), true);
13+
return $ret;
14+
}
15+
16+
include_once( 'ut_common.inc' );
17+
ut_run();
18+
?>
19+
--EXPECTF--
20+
false
21+
'locale_get_display_name : name too long: U_ILLEGAL_ARGUMENT_ERROR'

‎ext/intl/tests/locale_parse_locale2.phpt‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,8 @@ function ut_main()
6363
//Some Invalid Tags:
6464
'de-419-DE',
6565
'a-DE',
66-
'ar-a-aaa-b-bbb-a-ccc'
66+
'ar-a-aaa-b-bbb-a-ccc',
67+
'x-AAAAAA',
6768
);
6869

6970

@@ -201,3 +202,6 @@ No values found from Locale parsing.
201202
---------------------
202203
ar-a-aaa-b-bbb-a-ccc:
203204
language : 'ar' ,
205+
---------------------
206+
x-AAAAAA:
207+
private0 : 'AAAAAA' ,

‎ext/spl/spl_array.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1808,7 +1808,7 @@ SPL_METHOD(Array, unserialize)
18081808
++p;
18091809

18101810
ALLOC_INIT_ZVAL(pmembers);
1811-
if (!php_var_unserialize(&pmembers, &p, s + buf_len, &var_hash TSRMLS_CC)) {
1811+
if (!php_var_unserialize(&pmembers, &p, s + buf_len, &var_hash TSRMLS_CC) || Z_TYPE_P(pmembers) != IS_ARRAY) {
18121812
zval_ptr_dtor(&pmembers);
18131813
goto outexcept;
18141814
}

‎ext/spl/spl_observer.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -898,7 +898,7 @@ SPL_METHOD(SplObjectStorage, unserialize)
898898
++p;
899899

900900
ALLOC_INIT_ZVAL(pmembers);
901-
if (!php_var_unserialize(&pmembers, &p, s + buf_len, &var_hash TSRMLS_CC)) {
901+
if (!php_var_unserialize(&pmembers, &p, s + buf_len, &var_hash TSRMLS_CC) || Z_TYPE_P(pmembers) != IS_ARRAY) {
902902
zval_ptr_dtor(&pmembers);
903903
goto outexcept;
904904
}

‎ext/spl/tests/SplObjectStorage_unserialize_bad.phpt‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ $badblobs = array(
77
'x:i:2;i:0;,i:1;;i:0;,i:2;;m:a:0:{}',
88
'x:i:3;O:8:"stdClass":0:{},O:8:"stdClass":0:{};R:2;,i:1;;O:8:"stdClass":0:{},r:2;;m:a:0:{}',
99
'x:i:3;O:8:"stdClass":0:{},O:8:"stdClass":0:{};r:2;,i:1;;O:8:"stdClass":0:{},r:2;;m:a:0:{}',
10+
'x:i:1;O:8:"stdClass":0:{},N;;m:s:40:"1234567890123456789012345678901234567890"',
1011
);
1112
foreach($badblobs as $blob) {
1213
try {
@@ -17,6 +18,7 @@ try {
1718
echo $e->getMessage()."\n";
1819
}
1920
}
21+
echo "DONE\n";
2022
--EXPECTF--
2123
Error at offset 6 of 34 bytes
2224
Error at offset 46 of 89 bytes
@@ -42,4 +44,5 @@ object(SplObjectStorage)#2 (1) {
4244
}
4345
}
4446
}
45-
47+
Error at offset 79 of 78 bytes
48+
DONE

‎ext/standard/info.c‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -875,16 +875,16 @@ PHPAPI void php_print_info(int flag TSRMLS_DC)
875875

876876
php_info_print_table_start();
877877
php_info_print_table_header(2, "Variable", "Value");
878-
if (zend_hash_find(&EG(symbol_table), "PHP_SELF", sizeof("PHP_SELF"), (void **) &data) != FAILURE) {
878+
if (zend_hash_find(&EG(symbol_table), "PHP_SELF", sizeof("PHP_SELF"), (void **) &data) != FAILURE && Z_TYPE_PP(data) == IS_STRING) {
879879
php_info_print_table_row(2, "PHP_SELF", Z_STRVAL_PP(data));
880880
}
881-
if (zend_hash_find(&EG(symbol_table), "PHP_AUTH_TYPE", sizeof("PHP_AUTH_TYPE"), (void **) &data) != FAILURE) {
881+
if (zend_hash_find(&EG(symbol_table), "PHP_AUTH_TYPE", sizeof("PHP_AUTH_TYPE"), (void **) &data) != FAILURE && Z_TYPE_PP(data) == IS_STRING) {
882882
php_info_print_table_row(2, "PHP_AUTH_TYPE", Z_STRVAL_PP(data));
883883
}
884-
if (zend_hash_find(&EG(symbol_table), "PHP_AUTH_USER", sizeof("PHP_AUTH_USER"), (void **) &data) != FAILURE) {
884+
if (zend_hash_find(&EG(symbol_table), "PHP_AUTH_USER", sizeof("PHP_AUTH_USER"), (void **) &data) != FAILURE && Z_TYPE_PP(data) == IS_STRING) {
885885
php_info_print_table_row(2, "PHP_AUTH_USER", Z_STRVAL_PP(data));
886886
}
887-
if (zend_hash_find(&EG(symbol_table), "PHP_AUTH_PW", sizeof("PHP_AUTH_PW"), (void **) &data) != FAILURE) {
887+
if (zend_hash_find(&EG(symbol_table), "PHP_AUTH_PW", sizeof("PHP_AUTH_PW"), (void **) &data) != FAILURE && Z_TYPE_PP(data) == IS_STRING) {
888888
php_info_print_table_row(2, "PHP_AUTH_PW", Z_STRVAL_PP(data));
889889
}
890890
php_print_gpcse_array(ZEND_STRL("_REQUEST") TSRMLS_CC);

‎ext/standard/tests/general_functions/bug67498.phpt‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
--TEST--
2+
phpinfo() Type Confusion Information Leak Vulnerability
3+
--FILE--
4+
<?php
5+
$PHP_SELF = 1;
6+
phpinfo(INFO_VARIABLES);
7+
8+
?>
9+
==DONE==
10+
--EXPECTF--
11+
phpinfo()
12+
13+
PHP Variables
14+
%A
15+
==DONE==

0 commit comments

Comments
 (0)