diff options
| author | Christoph M. Becker <cmbecker69@gmx.de> | 2019-11-25 16:56:34 +0100 |
|---|---|---|
| committer | Stanislav Malyshev <stas@php.net> | 2019-12-16 00:02:57 -0800 |
| commit | a5a15965da23c8e97657278fc8dfbf1dfb20c016 (patch) | |
| tree | 1ade216c45ecbb3343f0763aeb15e70a8ef541b6 | |
| parent | d2cfb63f020a6f39de5d6c7189f65d2191432877 (diff) | |
| download | php-git-a5a15965da23c8e97657278fc8dfbf1dfb20c016.tar.gz | |
Fix #78863: DirectoryIterator class silently truncates after a null byte
Since the constructor of DirectoryIterator and friends is supposed to
accepts paths (i.e. strings without NUL bytes), we must not accept
arbitrary strings.
| -rw-r--r-- | ext/spl/spl_directory.c | 4 | ||||
| -rw-r--r-- | ext/spl/tests/bug78863.phpt | 31 |
2 files changed, 33 insertions, 2 deletions
diff --git a/ext/spl/spl_directory.c b/ext/spl/spl_directory.c index 91ea2e0265..56e809b1c7 100644 --- a/ext/spl/spl_directory.c +++ b/ext/spl/spl_directory.c @@ -708,10 +708,10 @@ void spl_filesystem_object_construct(INTERNAL_FUNCTION_PARAMETERS, zend_long cto if (SPL_HAS_FLAG(ctor_flags, DIT_CTOR_FLAGS)) { flags = SPL_FILE_DIR_KEY_AS_PATHNAME|SPL_FILE_DIR_CURRENT_AS_FILEINFO; - parsed = zend_parse_parameters(ZEND_NUM_ARGS(), "s|l", &path, &len, &flags); + parsed = zend_parse_parameters(ZEND_NUM_ARGS(), "p|l", &path, &len, &flags); } else { flags = SPL_FILE_DIR_KEY_AS_PATHNAME|SPL_FILE_DIR_CURRENT_AS_SELF; - parsed = zend_parse_parameters(ZEND_NUM_ARGS(), "s", &path, &len); + parsed = zend_parse_parameters(ZEND_NUM_ARGS(), "p", &path, &len); } if (SPL_HAS_FLAG(ctor_flags, SPL_FILE_DIR_SKIPDOTS)) { flags |= SPL_FILE_DIR_SKIPDOTS; diff --git a/ext/spl/tests/bug78863.phpt b/ext/spl/tests/bug78863.phpt new file mode 100644 index 0000000000..dc88d98dee --- /dev/null +++ b/ext/spl/tests/bug78863.phpt @@ -0,0 +1,31 @@ +--TEST-- +Bug #78863 (DirectoryIterator class silently truncates after a null byte) +--FILE-- +<?php +$dir = __DIR__ . '/bug78863'; +mkdir($dir); +touch("$dir/bad"); +mkdir("$dir/sub"); +touch("$dir/sub/good"); + +$it = new DirectoryIterator(__DIR__ . "/bug78863\0/sub"); +foreach ($it as $fileinfo) { + if (!$fileinfo->isDot()) { + var_dump($fileinfo->getFilename()); + } +} +?> +--EXPECTF-- +Fatal error: Uncaught UnexpectedValueException: DirectoryIterator::__construct() expects parameter 1 to be a valid path, string given in %s:%d +Stack trace: +#0 %s(%d): DirectoryIterator->__construct('%s') +#1 {main} + thrown in %s on line %d +--CLEAN-- +<?php +$dir = __DIR__ . '/bug78863'; +unlink("$dir/sub/good"); +rmdir("$dir/sub"); +unlink("$dir/bad"); +rmdir($dir); +?> |