diff options
| author | Ilia Alshanetsky <iliaa@php.net> | 2007-01-09 15:31:12 +0000 |
|---|---|---|
| committer | Ilia Alshanetsky <iliaa@php.net> | 2007-01-09 15:31:12 +0000 |
| commit | 81729c1eced27796390e73566963be2a3a1ee82e (patch) | |
| tree | acb2928032717e067799571deb15ae76033f323f /ext/session | |
| parent | 38f942b88013b203129825329e84581d0ae330b3 (diff) | |
| download | php-git-81729c1eced27796390e73566963be2a3a1ee82e.tar.gz | |
Prevent SESSION/GLOBALS overload via session decoding
Diffstat (limited to 'ext/session')
| -rw-r--r-- | ext/session/session.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/ext/session/session.c b/ext/session/session.c index 87c6384d31..0a0c19979a 100644 --- a/ext/session/session.c +++ b/ext/session/session.c @@ -331,6 +331,10 @@ PHPAPI void php_add_session_var(char *name, size_t namelen TSRMLS_DC) zend_hash_find(&EG(symbol_table), name, namelen + 1, (void *) &sym_global); + if ((Z_TYPE_PP(sym_global) == IS_ARRAY && Z_ARRVAL_PP(sym_global) == &EG(symbol_table)) || *sym_global == PS(http_session_vars)) { + return; + } + if (sym_global == NULL && sym_track == NULL) { zval *empty_var; @@ -360,7 +364,10 @@ PHPAPI void php_set_session_var(char *name, size_t namelen, zval *state_val, php if (PG(register_globals)) { zval **old_symbol; if (zend_hash_find(&EG(symbol_table),name,namelen+1,(void *)&old_symbol) == SUCCESS) { - + if ((Z_TYPE_PP(old_symbol) == IS_ARRAY && Z_ARRVAL_PP(old_symbol) == &EG(symbol_table)) || *old_symbol == PS(http_session_vars)) { + return; + } + /* * A global symbol with the same name exists already. That * symbol might have been created by other means (e.g. $_GET). |