Skip to content

Commit e2ed487

Browse files
smalyshevsmalyshev
committed
Merge branch 'PHP-5.4' into PHP-5.5
* PHP-5.4: 5.4.30 Better fix for bug #67072 with more BC provisions Fix bug #67498 - phpinfo() Type Confusion Information Leak Vulnerability update CVE Fix bug #67492: unserialize() SPL ArrayObject / SPLObjectStorage Type Confusion Fix bug #67397 (Buffer overflow in locale_get_display_name->uloc_getDisplayName (libicu 4.8.1)) Fix bug #67349: Locale::parseLocale Double Free add CVEs Fix potential segfault in dns_get_record() Fix bug #66127 (Segmentation fault with ArrayObject unset) 5.4.30 rc1 Conflicts: ext/intl/locale/locale_methods.c
2 parents 7ffcb48 + 3488cf6 commit e2ed487

File tree

8 files changed

+62
-12
lines changed

8 files changed

+62
-12
lines changed

‎ext/intl/locale/locale_methods.c‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -269,8 +269,7 @@ static char* get_icu_value_internal( const char* loc_name , char* tag_name, int*
269269
grOffset = findOffset( LOC_GRANDFATHERED , loc_name );
270270
if( grOffset >= 0 ){
271271
if( strcmp(tag_name , LOC_LANG_TAG)==0 ){
272-
tag_value = estrdup(loc_name);
273-
return tag_value;
272+
return estrdup(loc_name);
274273
} else {
275274
/* Since Grandfathered , no value , do nothing , retutn NULL */
276275
return NULL;
@@ -280,8 +279,8 @@ static char* get_icu_value_internal( const char* loc_name , char* tag_name, int*
280279
if( fromParseLocale==1 ){
281280
/* Handle singletons */
282281
if( strcmp(tag_name , LOC_LANG_TAG)==0 ){
283-
if( strlen(loc_name)>1 && (isIDPrefix(loc_name) ==1 ) ){
284-
return (char *)loc_name;
282+
if( strlen(loc_name)>1 && (isIDPrefix(loc_name) == 1) ){
283+
return estrdup(loc_name);
285284
}
286285
}
287286

@@ -498,6 +497,14 @@ static void get_icu_disp_value_src_php( char* tag_name, INTERNAL_FUNCTION_PARAME
498497
RETURN_FALSE;
499498
}
500499

500+
if(loc_name_len > ULOC_FULLNAME_CAPACITY) {
501+
/* See bug 67397: overlong locale names cause trouble in uloc_getDisplayName */
502+
spprintf(&msg , 0, "locale_get_display_%s : name too long", tag_name );
503+
intl_error_set( NULL, U_ILLEGAL_ARGUMENT_ERROR, msg , 1 TSRMLS_CC );
504+
efree(msg);
505+
RETURN_FALSE;
506+
}
507+
501508
if(loc_name_len == 0) {
502509
loc_name = intl_locale_get_default(TSRMLS_C);
503510
}

‎ext/intl/tests/bug67397.phpt‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
--TEST--
2+
Bug #67397 (Buffer overflow in locale_get_display_name->uloc_getDisplayName (libicu 4.8.1))
3+
--SKIPIF--
4+
<?php if( !extension_loaded( 'intl' ) ) print 'skip'; ?>
5+
--FILE--
6+
<?php
7+
8+
function ut_main()
9+
{
10+
$ret = var_export(ut_loc_get_display_name(str_repeat('*', 256), 'en_us'), true);
11+
$ret .= "\n";
12+
$ret .= var_export(intl_get_error_message(), true);
13+
return $ret;
14+
}
15+
16+
include_once( 'ut_common.inc' );
17+
ut_run();
18+
?>
19+
--EXPECTF--
20+
false
21+
'locale_get_display_name : name too long: U_ILLEGAL_ARGUMENT_ERROR'

‎ext/intl/tests/locale_parse_locale2.phpt‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,8 @@ function ut_main()
6363
//Some Invalid Tags:
6464
'de-419-DE',
6565
'a-DE',
66-
'ar-a-aaa-b-bbb-a-ccc'
66+
'ar-a-aaa-b-bbb-a-ccc',
67+
'x-AAAAAA',
6768
);
6869

6970

@@ -201,3 +202,6 @@ No values found from Locale parsing.
201202
---------------------
202203
ar-a-aaa-b-bbb-a-ccc:
203204
language : 'ar' ,
205+
---------------------
206+
x-AAAAAA:
207+
private0 : 'AAAAAA' ,

‎ext/spl/spl_array.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1796,7 +1796,7 @@ SPL_METHOD(Array, unserialize)
17961796
++p;
17971797

17981798
ALLOC_INIT_ZVAL(pmembers);
1799-
if (!php_var_unserialize(&pmembers, &p, s + buf_len, &var_hash TSRMLS_CC)) {
1799+
if (!php_var_unserialize(&pmembers, &p, s + buf_len, &var_hash TSRMLS_CC) || Z_TYPE_P(pmembers) != IS_ARRAY) {
18001800
zval_ptr_dtor(&pmembers);
18011801
goto outexcept;
18021802
}

‎ext/spl/spl_observer.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -898,7 +898,7 @@ SPL_METHOD(SplObjectStorage, unserialize)
898898
++p;
899899

900900
ALLOC_INIT_ZVAL(pmembers);
901-
if (!php_var_unserialize(&pmembers, &p, s + buf_len, &var_hash TSRMLS_CC)) {
901+
if (!php_var_unserialize(&pmembers, &p, s + buf_len, &var_hash TSRMLS_CC) || Z_TYPE_P(pmembers) != IS_ARRAY) {
902902
zval_ptr_dtor(&pmembers);
903903
goto outexcept;
904904
}

‎ext/spl/tests/SplObjectStorage_unserialize_bad.phpt‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ $badblobs = array(
77
'x:i:2;i:0;,i:1;;i:0;,i:2;;m:a:0:{}',
88
'x:i:3;O:8:"stdClass":0:{},O:8:"stdClass":0:{};R:2;,i:1;;O:8:"stdClass":0:{},r:2;;m:a:0:{}',
99
'x:i:3;O:8:"stdClass":0:{},O:8:"stdClass":0:{};r:2;,i:1;;O:8:"stdClass":0:{},r:2;;m:a:0:{}',
10+
'x:i:1;O:8:"stdClass":0:{},N;;m:s:40:"1234567890123456789012345678901234567890"',
1011
);
1112
foreach($badblobs as $blob) {
1213
try {
@@ -17,6 +18,7 @@ try {
1718
echo $e->getMessage()."\n";
1819
}
1920
}
21+
echo "DONE\n";
2022
--EXPECTF--
2123
Error at offset 6 of 34 bytes
2224
Error at offset 46 of 89 bytes
@@ -42,4 +44,5 @@ object(SplObjectStorage)#2 (1) {
4244
}
4345
}
4446
}
45-
47+
Error at offset 79 of 78 bytes
48+
DONE

‎ext/standard/info.c‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -866,16 +866,16 @@ PHPAPI void php_print_info(int flag TSRMLS_DC)
866866

867867
php_info_print_table_start();
868868
php_info_print_table_header(2, "Variable", "Value");
869-
if (zend_hash_find(&EG(symbol_table), "PHP_SELF", sizeof("PHP_SELF"), (void **) &data) != FAILURE) {
869+
if (zend_hash_find(&EG(symbol_table), "PHP_SELF", sizeof("PHP_SELF"), (void **) &data) != FAILURE && Z_TYPE_PP(data) == IS_STRING) {
870870
php_info_print_table_row(2, "PHP_SELF", Z_STRVAL_PP(data));
871871
}
872-
if (zend_hash_find(&EG(symbol_table), "PHP_AUTH_TYPE", sizeof("PHP_AUTH_TYPE"), (void **) &data) != FAILURE) {
872+
if (zend_hash_find(&EG(symbol_table), "PHP_AUTH_TYPE", sizeof("PHP_AUTH_TYPE"), (void **) &data) != FAILURE && Z_TYPE_PP(data) == IS_STRING) {
873873
php_info_print_table_row(2, "PHP_AUTH_TYPE", Z_STRVAL_PP(data));
874874
}
875-
if (zend_hash_find(&EG(symbol_table), "PHP_AUTH_USER", sizeof("PHP_AUTH_USER"), (void **) &data) != FAILURE) {
875+
if (zend_hash_find(&EG(symbol_table), "PHP_AUTH_USER", sizeof("PHP_AUTH_USER"), (void **) &data) != FAILURE && Z_TYPE_PP(data) == IS_STRING) {
876876
php_info_print_table_row(2, "PHP_AUTH_USER", Z_STRVAL_PP(data));
877877
}
878-
if (zend_hash_find(&EG(symbol_table), "PHP_AUTH_PW", sizeof("PHP_AUTH_PW"), (void **) &data) != FAILURE) {
878+
if (zend_hash_find(&EG(symbol_table), "PHP_AUTH_PW", sizeof("PHP_AUTH_PW"), (void **) &data) != FAILURE && Z_TYPE_PP(data) == IS_STRING) {
879879
php_info_print_table_row(2, "PHP_AUTH_PW", Z_STRVAL_PP(data));
880880
}
881881
php_print_gpcse_array(ZEND_STRL("_REQUEST") TSRMLS_CC);

‎ext/standard/tests/general_functions/bug67498.phpt‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
--TEST--
2+
phpinfo() Type Confusion Information Leak Vulnerability
3+
--FILE--
4+
<?php
5+
$PHP_SELF = 1;
6+
phpinfo(INFO_VARIABLES);
7+
8+
?>
9+
==DONE==
10+
--EXPECTF--
11+
phpinfo()
12+
13+
PHP Variables
14+
%A
15+
==DONE==

0 commit comments

Comments
 (0)