diff options
| -rwxr-xr-x | ext/phar/tests/bug70433.zip | bin | 264 -> 269 bytes | |||
| -rw-r--r-- | ext/phar/tests/bug71488.phpt | 1 | ||||
| -rw-r--r-- | ext/phar/tests/bug71498.phpt | 17 | ||||
| -rw-r--r-- | ext/phar/tests/bug71498.zip | bin | 0 -> 65677 bytes | |||
| -rw-r--r-- | ext/phar/zip.c | 2 | ||||
| -rw-r--r-- | ext/wddx/tests/bug71587.phpt | 43 | ||||
| -rw-r--r-- | ext/wddx/wddx.c | 17 | ||||
| -rw-r--r-- | sapi/cli/php_cli_server.c | 2 |
8 files changed, 77 insertions, 5 deletions
diff --git a/ext/phar/tests/bug70433.zip b/ext/phar/tests/bug70433.zip Binary files differindex 3994a30a8e..232a2210f5 100755 --- a/ext/phar/tests/bug70433.zip +++ b/ext/phar/tests/bug70433.zip diff --git a/ext/phar/tests/bug71488.phpt b/ext/phar/tests/bug71488.phpt index 05fdd8f481..22d2bf098f 100644 --- a/ext/phar/tests/bug71488.phpt +++ b/ext/phar/tests/bug71488.phpt @@ -7,6 +7,7 @@ Phar: bug #71488: Stack overflow when decompressing tar archives $p = new PharData(__DIR__."/bug71488.tar"); $newp = $p->decompress("test"); ?> + DONE --CLEAN-- <?php diff --git a/ext/phar/tests/bug71498.phpt b/ext/phar/tests/bug71498.phpt new file mode 100644 index 0000000000..de6283c8dc --- /dev/null +++ b/ext/phar/tests/bug71498.phpt @@ -0,0 +1,17 @@ +--TEST-- +Phar: bug #71498: Out-of-Bound Read in phar_parse_zipfile() +--SKIPIF-- +<?php if (!extension_loaded("phar")) die("skip"); ?> +--FILE-- +<?php +try { +$p = new PharData(__DIR__."/bug71498.zip"); +} catch(UnexpectedValueException $e) { + echo $e->getMessage(); +} +?> + +DONE +--EXPECTF-- +phar error: end of central directory not found in zip-based phar "%s/bug71498.zip" +DONE
\ No newline at end of file diff --git a/ext/phar/tests/bug71498.zip b/ext/phar/tests/bug71498.zip Binary files differnew file mode 100644 index 0000000000..ae78dd871e --- /dev/null +++ b/ext/phar/tests/bug71498.zip diff --git a/ext/phar/zip.c b/ext/phar/zip.c index bd088cf4fa..764f2b133d 100644 --- a/ext/phar/zip.c +++ b/ext/phar/zip.c @@ -199,7 +199,7 @@ int phar_parse_zipfile(php_stream *fp, char *fname, int fname_len, char *alias, } while ((p=(char *) memchr(p + 1, 'P', (size_t) (size - (p + 1 - buf)))) != NULL) { - if (!memcmp(p + 1, "K\5\6", 3)) { + if ((p - buf) + sizeof(locator) <= size && !memcmp(p + 1, "K\5\6", 3)) { memcpy((void *)&locator, (void *) p, sizeof(locator)); if (PHAR_GET_16(locator.centraldisk) != 0 || PHAR_GET_16(locator.disknumber) != 0) { /* split archives not handled */ diff --git a/ext/wddx/tests/bug71587.phpt b/ext/wddx/tests/bug71587.phpt new file mode 100644 index 0000000000..3fdfc35c16 --- /dev/null +++ b/ext/wddx/tests/bug71587.phpt @@ -0,0 +1,43 @@ +--TEST-- +Bug #71587 (Use-After-Free / Double-Free in WDDX Deserialize) +--SKIPIF-- +<?php +if (!extension_loaded("wddx")) print "skip"; +?> +--FILE-- +<?php + +$xml = <<<EOF +<?xml version='1.0' ?> +<!DOCTYPE wddxPacket SYSTEM 'wddx_0100.dtd'> +<wddxPacket version='1.0'> + <array> + <var name='ML'></var> + <string>manhluat</string> + <var name='ML2'></var> + <boolean value='a'/> + <boolean value='true'/> + </array> +</wddxPacket> +EOF; + +$wddx = wddx_deserialize($xml); +var_dump($wddx); +// Print mem leak +foreach($wddx as $k=>$v) + printf("Key: %s\nValue: %s\n",bin2hex($k),bin2hex($v)); + +?> +DONE +--EXPECTF-- +array(2) { + [0]=> + string(8) "manhluat" + [1]=> + bool(true) +} +Key: 30 +Value: 6d616e686c756174 +Key: 31 +Value: 31 +DONE diff --git a/ext/wddx/wddx.c b/ext/wddx/wddx.c index ca7b711682..539ed57662 100644 --- a/ext/wddx/wddx.c +++ b/ext/wddx/wddx.c @@ -877,6 +877,16 @@ static void php_wddx_pop_element(void *user_data, const XML_Char *name) !strcmp((char *)name, EL_DATETIME)) { wddx_stack_top(stack, (void**)&ent1); + if (!ent1->data) { + if (stack->top > 1) { + stack->top--; + } else { + stack->done = 1; + } + efree(ent1); + return; + } + if (!strcmp((char *)name, EL_BINARY)) { zend_string *new_str = php_base64_decode( (unsigned char *)Z_STRVAL(ent1->data), Z_STRLEN(ent1->data)); @@ -964,6 +974,7 @@ static void php_wddx_pop_element(void *user_data, const XML_Char *name) } } else if (!strcmp((char *)name, EL_VAR) && stack->varname) { efree(stack->varname); + stack->varname = NULL; } else if (!strcmp((char *)name, EL_FIELD)) { st_entry *ent; wddx_stack_top(stack, (void **)&ent); @@ -1005,11 +1016,11 @@ static void php_wddx_process_data(void *user_data, const XML_Char *s, int len) } else if (!strcmp((char *)s, "false")) { Z_LVAL(ent->data) = 0; } else { - stack->top--; zval_ptr_dtor(&ent->data); - if (ent->varname) + if (ent->varname) { efree(ent->varname); - efree(ent); + } + ent->data = NULL; } break; diff --git a/sapi/cli/php_cli_server.c b/sapi/cli/php_cli_server.c index ac41c44def..f94ac74741 100644 --- a/sapi/cli/php_cli_server.c +++ b/sapi/cli/php_cli_server.c @@ -1964,7 +1964,7 @@ static int php_cli_server_begin_send_static(php_cli_server *server, php_cli_serv if (client->request.path_translated && ('.' == client->request.path_translated[client->request.path_translated_len-1] || ' ' == client->request.path_translated[client->request.path_translated_len-1])) { - return php_cli_server_send_error_page(server, client, 500); + return php_cli_server_send_error_page(server, client, 500 TSRMLS_CC); } #endif |