From 36239fee3638a8f4cfe3ca3aba597cb1699abd90 Mon Sep 17 00:00:00 2001 From: Stanislav Malyshev Date: Tue, 20 Feb 2018 15:34:43 -0800 Subject: Fix bug #75981: prevent reading beyond buffer start --- ext/standard/http_fopen_wrapper.c | 4 ++-- ext/standard/tests/http/bug75981.phpt | 32 ++++++++++++++++++++++++++++++++ 2 files changed, 34 insertions(+), 2 deletions(-) create mode 100644 ext/standard/tests/http/bug75981.phpt diff --git a/ext/standard/http_fopen_wrapper.c b/ext/standard/http_fopen_wrapper.c index ed6adc0039..78bd935a0e 100644 --- a/ext/standard/http_fopen_wrapper.c +++ b/ext/standard/http_fopen_wrapper.c @@ -737,9 +737,9 @@ finish: tmp_line, response_code); } } - if (tmp_line[tmp_line_len - 1] == '\n') { + if (tmp_line_len >= 1 && tmp_line[tmp_line_len - 1] == '\n') { --tmp_line_len; - if (tmp_line[tmp_line_len - 1] == '\r') { + if (tmp_line_len >= 1 &&tmp_line[tmp_line_len - 1] == '\r') { --tmp_line_len; } } diff --git a/ext/standard/tests/http/bug75981.phpt b/ext/standard/tests/http/bug75981.phpt new file mode 100644 index 0000000000..d415de66b9 --- /dev/null +++ b/ext/standard/tests/http/bug75981.phpt @@ -0,0 +1,32 @@ +--TEST-- +Bug #75981 (stack-buffer-overflow while parsing HTTP response) +--INI-- +allow_url_fopen=1 +--SKIPIF-- + +--FILE-- + [ + 'protocol_version' => '1.1', + 'header' => 'Connection: Close' + ], +]; + +$ctx = stream_context_create($options); + +$responses = [ + "data://text/plain,000000000100\xA\xA" +]; +$pid = http_server('tcp://127.0.0.1:12342', $responses); + +echo @file_get_contents('http://127.0.0.1:12342/', false, $ctx); + +http_server_kill($pid); + +?> +DONE +--EXPECT-- +DONE -- cgit v1.2.1 From b4e4788c4461449b4587e19ef1f474ce938e4980 Mon Sep 17 00:00:00 2001 From: "Christoph M. Becker" Date: Tue, 27 Mar 2018 18:42:55 +0200 Subject: Fix #76130: Heap Buffer Overflow (READ: 1786) in exif_iif_add_value The MakerNote is not necessarily null-terminated, so we must not use `strlen()` to avoid OOB reads. Instead `php_strnlen()` is the proper way to handle this. --- ext/exif/exif.c | 2 +- ext/exif/tests/bug76130.phpt | 20 ++++++++++++++++++++ ext/exif/tests/bug76130_1.jpg | Bin 0 -> 3396 bytes ext/exif/tests/bug76130_2.jpg | Bin 0 -> 1632 bytes 4 files changed, 21 insertions(+), 1 deletion(-) create mode 100644 ext/exif/tests/bug76130.phpt create mode 100644 ext/exif/tests/bug76130_1.jpg create mode 100644 ext/exif/tests/bug76130_2.jpg diff --git a/ext/exif/exif.c b/ext/exif/exif.c index 1c8772f76b..e535278fc9 100644 --- a/ext/exif/exif.c +++ b/ext/exif/exif.c @@ -1710,7 +1710,7 @@ static void exif_iif_add_value(image_info_type *image_info, int section_index, c case TAG_FMT_UNDEFINED: if (value) { if (tag == TAG_MAKER_NOTE) { - length = MIN(length, strlen(value)); + length = (int) php_strnlen(value, length); } /* do not recompute length here */ diff --git a/ext/exif/tests/bug76130.phpt b/ext/exif/tests/bug76130.phpt new file mode 100644 index 0000000000..9c826af629 --- /dev/null +++ b/ext/exif/tests/bug76130.phpt @@ -0,0 +1,20 @@ +--TEST-- +Bug #76130 (Heap Buffer Overflow (READ: 1786) in exif_iif_add_value) +--DESCRIPTION-- +This test is meant to exhibit memory issues with the `-m` option. Since a lot of +notices and warnings are to be expected anyway, we suppress these, since the are +not relevant for this test. +--INI-- +error_reporting=E_ALL & ~E_WARNING & ~E_NOTICE +--SKIPIF-- + +--FILE-- + +===DONE=== +--EXPECT-- +===DONE=== diff --git a/ext/exif/tests/bug76130_1.jpg b/ext/exif/tests/bug76130_1.jpg new file mode 100644 index 0000000000..e063e46d22 Binary files /dev/null and b/ext/exif/tests/bug76130_1.jpg differ diff --git a/ext/exif/tests/bug76130_2.jpg b/ext/exif/tests/bug76130_2.jpg new file mode 100644 index 0000000000..a9e79dca5c Binary files /dev/null and b/ext/exif/tests/bug76130_2.jpg differ -- cgit v1.2.1 From 06d309fd7a917575d65c7a6f4f57b0e6bb0f9711 Mon Sep 17 00:00:00 2001 From: Stanislav Malyshev Date: Sun, 22 Apr 2018 21:26:06 -0700 Subject: Fix bug #76249 - fail on invalid sequences --- ext/iconv/iconv.c | 3 +++ ext/iconv/tests/bug76249.phpt | 16 ++++++++++++++++ 2 files changed, 19 insertions(+) create mode 100644 ext/iconv/tests/bug76249.phpt diff --git a/ext/iconv/iconv.c b/ext/iconv/iconv.c index 69dd8c1cf7..fca5331541 100644 --- a/ext/iconv/iconv.c +++ b/ext/iconv/iconv.c @@ -2672,6 +2672,9 @@ static int php_iconv_stream_filter_append_bucket( tcnt = 0; break; } + } else { + php_error_docref(NULL, E_WARNING, "iconv stream filter (\"%s\"=>\"%s\"): invalid multibyte sequence", self->from_charset, self->to_charset); + goto out_failure; } break; diff --git a/ext/iconv/tests/bug76249.phpt b/ext/iconv/tests/bug76249.phpt new file mode 100644 index 0000000000..5a9d8f171e --- /dev/null +++ b/ext/iconv/tests/bug76249.phpt @@ -0,0 +1,16 @@ +--TEST-- +Bug #76249 (stream filter convert.iconv leads to infinite loop on invalid sequence) +--SKIPIF-- + +--FILE-- + +DONE +--EXPECTF-- +Warning: stream_get_contents(): iconv stream filter ("ucs-2"=>"utf8//IGNORE"): invalid multibyte sequence in %sbug76249.php on line %d +慢DONE -- cgit v1.2.1 From 49782c54994ecca2ef2a061063bd5a7079c43527 Mon Sep 17 00:00:00 2001 From: Stanislav Malyshev Date: Sun, 22 Apr 2018 22:01:35 -0700 Subject: Fix bug #76248 - Malicious LDAP-Server Response causes Crash --- ext/ldap/ldap.c | 6 +++++- ext/ldap/tests/bug76248.phpt | 40 ++++++++++++++++++++++++++++++++++++++++ 2 files changed, 45 insertions(+), 1 deletion(-) create mode 100644 ext/ldap/tests/bug76248.phpt diff --git a/ext/ldap/ldap.c b/ext/ldap/ldap.c index 8ab0fe0727..03ca03d3ad 100644 --- a/ext/ldap/ldap.c +++ b/ext/ldap/ldap.c @@ -1103,7 +1103,11 @@ PHP_FUNCTION(ldap_get_entries) add_assoc_long(tmp1, "count", num_attrib); dn = ldap_get_dn(ldap, ldap_result_entry); - add_assoc_string(tmp1, "dn", dn, 1); + if (dn) { + add_assoc_string(tmp1, "dn", dn, 1); + } else { + add_assoc_null(tmp1, "dn"); + } #if (LDAP_API_VERSION > 2000) || HAVE_NSLDAP || HAVE_ORALDAP || WINDOWS ldap_memfree(dn); #else diff --git a/ext/ldap/tests/bug76248.phpt b/ext/ldap/tests/bug76248.phpt new file mode 100644 index 0000000000..45a7f83efb --- /dev/null +++ b/ext/ldap/tests/bug76248.phpt @@ -0,0 +1,40 @@ +--TEST-- +Bug #76248 (Malicious LDAP-Server Response causes Crash) +--SKIPIF-- + +--FILE-- + +--EXPECT-- +array(2) { + ["count"]=> + int(1) + [0]=> + array(2) { + ["count"]=> + int(0) + ["dn"]=> + NULL + } +} \ No newline at end of file -- cgit v1.2.1 From 8dca5ae5ece54dde2e303df26fe291282a342798 Mon Sep 17 00:00:00 2001 From: Stanislav Malyshev Date: Sun, 22 Apr 2018 22:19:51 -0700 Subject: Fix test --- ext/iconv/tests/bug76249.phpt | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/ext/iconv/tests/bug76249.phpt b/ext/iconv/tests/bug76249.phpt index 5a9d8f171e..1503f0bc81 100644 --- a/ext/iconv/tests/bug76249.phpt +++ b/ext/iconv/tests/bug76249.phpt @@ -8,9 +8,11 @@ $fh = fopen('php://memory', 'rw'); fwrite($fh, "abc"); rewind($fh); stream_filter_append($fh, 'convert.iconv.ucs-2/utf8//IGNORE', STREAM_FILTER_READ, []); -echo stream_get_contents($fh); +$a = stream_get_contents($fh); +var_dump(strlen($a)); ?> DONE --EXPECTF-- Warning: stream_get_contents(): iconv stream filter ("ucs-2"=>"utf8//IGNORE"): invalid multibyte sequence in %sbug76249.php on line %d -慢DONE +int(3) +DONE -- cgit v1.2.1 From 6e64aba47f4e41d97c4d010024c68320c0855f45 Mon Sep 17 00:00:00 2001 From: Stanislav Malyshev Date: Tue, 27 Mar 2018 21:22:28 -0700 Subject: Fix #76129 - remove more potential unfiltered outputs for phar --- ext/phar/phar_object.c | 6 ++---- ext/phar/tests/cache_list/frontcontroller10.phpt | 2 +- ext/phar/tests/cache_list/frontcontroller6.phpt | 2 +- ext/phar/tests/cache_list/frontcontroller8.phpt | 2 +- ext/phar/tests/frontcontroller10.phpt | 2 +- ext/phar/tests/frontcontroller6.phpt | 2 +- ext/phar/tests/frontcontroller8.phpt | 2 +- ext/phar/tests/tar/frontcontroller10.phar.phpt | 2 +- ext/phar/tests/tar/frontcontroller6.phar.phpt | 2 +- ext/phar/tests/tar/frontcontroller8.phar.phpt | 2 +- ext/phar/tests/zip/frontcontroller10.phar.phpt | 2 +- ext/phar/tests/zip/frontcontroller6.phar.phpt | 2 +- ext/phar/tests/zip/frontcontroller8.phar.phpt | 2 +- 13 files changed, 14 insertions(+), 16 deletions(-) diff --git a/ext/phar/phar_object.c b/ext/phar/phar_object.c index 64d7a6c76e..a6f56ac8af 100644 --- a/ext/phar/phar_object.c +++ b/ext/phar/phar_object.c @@ -340,8 +340,7 @@ static void phar_do_403(char *entry, int entry_len TSRMLS_DC) /* {{{ */ sapi_header_op(SAPI_HEADER_REPLACE, &ctr TSRMLS_CC); sapi_send_headers(TSRMLS_C); PHPWRITE("\n \n Access Denied\n \n \n

403 - File ", sizeof("\n \n Access Denied\n \n \n

403 - File ") - 1); - PHPWRITE(entry, entry_len); - PHPWRITE(" Access Denied

\n \n", sizeof(" Access Denied\n \n") - 1); + PHPWRITE("Access Denied\n \n", sizeof("Access Denied\n \n") - 1); } /* }}} */ @@ -365,8 +364,7 @@ static void phar_do_404(phar_archive_data *phar, char *fname, int fname_len, cha sapi_header_op(SAPI_HEADER_REPLACE, &ctr TSRMLS_CC); sapi_send_headers(TSRMLS_C); PHPWRITE("\n \n File Not Found\n \n \n

404 - File ", sizeof("\n \n File Not Found\n \n \n

404 - File ") - 1); - PHPWRITE(entry, entry_len); - PHPWRITE(" Not Found

\n \n", sizeof(" Not Found\n \n") - 1); + PHPWRITE("Not Found\n \n", sizeof("Not Found\n \n") - 1); } /* }}} */ diff --git a/ext/phar/tests/cache_list/frontcontroller10.phpt b/ext/phar/tests/cache_list/frontcontroller10.phpt index 00177d4ff5..5fd986895d 100644 --- a/ext/phar/tests/cache_list/frontcontroller10.phpt +++ b/ext/phar/tests/cache_list/frontcontroller10.phpt @@ -20,6 +20,6 @@ Status: 403 Access Denied Access Denied -

403 - File /hi Access Denied

+

403 - File Access Denied

diff --git a/ext/phar/tests/cache_list/frontcontroller6.phpt b/ext/phar/tests/cache_list/frontcontroller6.phpt index 2480be4129..a79c958517 100644 --- a/ext/phar/tests/cache_list/frontcontroller6.phpt +++ b/ext/phar/tests/cache_list/frontcontroller6.phpt @@ -18,6 +18,6 @@ Status: 404 Not Found File Not Found -

404 - File /notfound.php Not Found

+

404 - File Not Found

\ No newline at end of file diff --git a/ext/phar/tests/cache_list/frontcontroller8.phpt b/ext/phar/tests/cache_list/frontcontroller8.phpt index bf9b390def..e04f9e5a3a 100644 --- a/ext/phar/tests/cache_list/frontcontroller8.phpt +++ b/ext/phar/tests/cache_list/frontcontroller8.phpt @@ -18,6 +18,6 @@ Status: 404 Not Found File Not Found -

404 - File /index.php Not Found

+

404 - File Not Found

\ No newline at end of file diff --git a/ext/phar/tests/frontcontroller10.phpt b/ext/phar/tests/frontcontroller10.phpt index 667d5c243c..b3f5e640dd 100644 --- a/ext/phar/tests/frontcontroller10.phpt +++ b/ext/phar/tests/frontcontroller10.phpt @@ -19,6 +19,6 @@ Status: 403 Access Denied Access Denied -

403 - File /hi Access Denied

+

403 - File Access Denied

diff --git a/ext/phar/tests/frontcontroller6.phpt b/ext/phar/tests/frontcontroller6.phpt index 1a2cc2cd23..c5dd382b10 100644 --- a/ext/phar/tests/frontcontroller6.phpt +++ b/ext/phar/tests/frontcontroller6.phpt @@ -16,6 +16,6 @@ Status: 404 Not Found File Not Found -

404 - File /notfound.php Not Found

+

404 - File Not Found

\ No newline at end of file diff --git a/ext/phar/tests/frontcontroller8.phpt b/ext/phar/tests/frontcontroller8.phpt index 36e3206d66..77d33dac38 100644 --- a/ext/phar/tests/frontcontroller8.phpt +++ b/ext/phar/tests/frontcontroller8.phpt @@ -16,6 +16,6 @@ Status: 404 Not Found File Not Found -

404 - File /index.php Not Found

+

404 - File Not Found

\ No newline at end of file diff --git a/ext/phar/tests/tar/frontcontroller10.phar.phpt b/ext/phar/tests/tar/frontcontroller10.phar.phpt index f1fc6e3d0f..23ce6f37e2 100644 --- a/ext/phar/tests/tar/frontcontroller10.phar.phpt +++ b/ext/phar/tests/tar/frontcontroller10.phar.phpt @@ -19,6 +19,6 @@ Status: 403 Access Denied Access Denied -

403 - File /hi Access Denied

+

403 - File Access Denied

\ No newline at end of file diff --git a/ext/phar/tests/tar/frontcontroller6.phar.phpt b/ext/phar/tests/tar/frontcontroller6.phar.phpt index 5375beef8c..b811f00f75 100644 --- a/ext/phar/tests/tar/frontcontroller6.phar.phpt +++ b/ext/phar/tests/tar/frontcontroller6.phar.phpt @@ -16,6 +16,6 @@ Status: 404 Not Found File Not Found -

404 - File /notfound.php Not Found

+

404 - File Not Found

\ No newline at end of file diff --git a/ext/phar/tests/tar/frontcontroller8.phar.phpt b/ext/phar/tests/tar/frontcontroller8.phar.phpt index 19844cb199..a180e2010a 100644 --- a/ext/phar/tests/tar/frontcontroller8.phar.phpt +++ b/ext/phar/tests/tar/frontcontroller8.phar.phpt @@ -16,6 +16,6 @@ Status: 404 Not Found File Not Found -

404 - File /index.php Not Found

+

404 - File Not Found

\ No newline at end of file diff --git a/ext/phar/tests/zip/frontcontroller10.phar.phpt b/ext/phar/tests/zip/frontcontroller10.phar.phpt index 56d16c2064..5bbe9e1aff 100644 --- a/ext/phar/tests/zip/frontcontroller10.phar.phpt +++ b/ext/phar/tests/zip/frontcontroller10.phar.phpt @@ -19,6 +19,6 @@ Status: 403 Access Denied Access Denied -

403 - File /hi Access Denied

+

403 - File Access Denied

\ No newline at end of file diff --git a/ext/phar/tests/zip/frontcontroller6.phar.phpt b/ext/phar/tests/zip/frontcontroller6.phar.phpt index 15489f6ca7..63f7c62e88 100644 --- a/ext/phar/tests/zip/frontcontroller6.phar.phpt +++ b/ext/phar/tests/zip/frontcontroller6.phar.phpt @@ -17,6 +17,6 @@ Status: 404 Not Found File Not Found -

404 - File /notfound.php Not Found

+

404 - File Not Found

\ No newline at end of file diff --git a/ext/phar/tests/zip/frontcontroller8.phar.phpt b/ext/phar/tests/zip/frontcontroller8.phar.phpt index 1b0d133bc7..d4c3a3f9ea 100644 --- a/ext/phar/tests/zip/frontcontroller8.phar.phpt +++ b/ext/phar/tests/zip/frontcontroller8.phar.phpt @@ -16,6 +16,6 @@ Status: 404 Not Found File Not Found -

404 - File /index.php Not Found

+

404 - File Not Found

\ No newline at end of file -- cgit v1.2.1 From ee76a5ae5ad57bb9d0bc183bcbf9c4652331c2e3 Mon Sep 17 00:00:00 2001 From: Stanislav Malyshev Date: Mon, 23 Apr 2018 16:48:27 -0700 Subject: Fix tsrm_ls --- ext/iconv/iconv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ext/iconv/iconv.c b/ext/iconv/iconv.c index fca5331541..335dbd17e9 100644 --- a/ext/iconv/iconv.c +++ b/ext/iconv/iconv.c @@ -2673,7 +2673,7 @@ static int php_iconv_stream_filter_append_bucket( break; } } else { - php_error_docref(NULL, E_WARNING, "iconv stream filter (\"%s\"=>\"%s\"): invalid multibyte sequence", self->from_charset, self->to_charset); + php_error_docref(NULL TSRMLS_CC, E_WARNING, "iconv stream filter (\"%s\"=>\"%s\"): invalid multibyte sequence", self->from_charset, self->to_charset); goto out_failure; } break; -- cgit v1.2.1