From b4a4db467b6a1e90131705832f1a3613a60c4259 Mon Sep 17 00:00:00 2001 From: Stanislav Malyshev Date: Sun, 27 Jul 2014 02:40:27 -0700 Subject: Fix missing type checks in various functions --- NEWS | 9 +++++++++ ext/com_dotnet/com_com.c | 4 ++-- ext/openssl/openssl.c | 13 +++++++------ ext/openssl/tests/026.phpt | 12 ++++++++++++ ext/session/session.c | 3 ++- 5 files changed, 32 insertions(+), 9 deletions(-) create mode 100644 ext/openssl/tests/026.phpt diff --git a/NEWS b/NEWS index 47ab0bd683..97c9ae2852 100644 --- a/NEWS +++ b/NEWS @@ -2,17 +2,26 @@ PHP NEWS ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ?? ??? 2014, PHP 5.4.32 +- COM: + . Fixed missing type checks in com_event_sink (Yussuf Khalil, Stas). + - Readline: . Fixed bug #55496 (Interactive mode doesn't force a newline before the prompt). (Bob, Johannes) . Fixed bug #67496 (Save command history when exiting interactive shell with control-c). (Dmitry Saprykin, Johannes) +- Sessions: + . Fixed missing type checks in php_session_create_id (Yussuf Khalil, Stas). + - SPL: . Fixed bug #67539 (ArrayIterator use-after-free due to object change during sorting). (research at insighti dot org, Laruence) . Fixed bug #67538 (SPL Iterators use-after-free). (CVE-2014-4670) (Laruence) +- OpenSSL: + . Fixed missing type checks in OpenSSL options (Yussuf Khalil, Stas). + 24 Jul 2014, PHP 5.4.31 - Core: diff --git a/ext/com_dotnet/com_com.c b/ext/com_dotnet/com_com.c index f77779d691..500cabd41c 100644 --- a/ext/com_dotnet/com_com.c +++ b/ext/com_dotnet/com_com.c @@ -698,9 +698,9 @@ PHP_FUNCTION(com_event_sink) /* 0 => typelibname, 1 => dispname */ zval **tmp; - if (zend_hash_index_find(Z_ARRVAL_P(sink), 0, (void**)&tmp) == SUCCESS) + if (zend_hash_index_find(Z_ARRVAL_P(sink), 0, (void**)&tmp) == SUCCESS && Z_TYPE_PP(tmp) == IS_STRING) typelibname = Z_STRVAL_PP(tmp); - if (zend_hash_index_find(Z_ARRVAL_P(sink), 1, (void**)&tmp) == SUCCESS) + if (zend_hash_index_find(Z_ARRVAL_P(sink), 1, (void**)&tmp) == SUCCESS && Z_TYPE_PP(tmp) == IS_STRING) dispname = Z_STRVAL_PP(tmp); } else if (sink != NULL) { convert_to_string(sink); diff --git a/ext/openssl/openssl.c b/ext/openssl/openssl.c index 0ec2a9a6bd..05d946a548 100755 --- a/ext/openssl/openssl.c +++ b/ext/openssl/openssl.c @@ -654,7 +654,7 @@ static time_t asn1_time_to_time_t(ASN1_UTCTIME * timestr TSRMLS_DC) /* {{{ */ return (time_t)-1; } - if (ASN1_STRING_length(timestr) != strlen(ASN1_STRING_data(timestr))) { + if (ASN1_STRING_length(timestr) != strlen((char *)ASN1_STRING_data(timestr))) { php_error_docref(NULL TSRMLS_CC, E_WARNING, "illegal length in timestamp"); return (time_t)-1; } @@ -782,13 +782,13 @@ static int add_oid_section(struct php_x509_request * req TSRMLS_DC) /* {{{ */ req->config_filename, req->var, req->req_config TSRMLS_CC) == FAILURE) return FAILURE #define SET_OPTIONAL_STRING_ARG(key, varname, defval) \ - if (optional_args && zend_hash_find(Z_ARRVAL_P(optional_args), key, sizeof(key), (void**)&item) == SUCCESS) \ + if (optional_args && zend_hash_find(Z_ARRVAL_P(optional_args), key, sizeof(key), (void**)&item) == SUCCESS && Z_TYPE_PP(item) == IS_STRING) \ varname = Z_STRVAL_PP(item); \ else \ varname = defval #define SET_OPTIONAL_LONG_ARG(key, varname, defval) \ - if (optional_args && zend_hash_find(Z_ARRVAL_P(optional_args), key, sizeof(key), (void**)&item) == SUCCESS) \ + if (optional_args && zend_hash_find(Z_ARRVAL_P(optional_args), key, sizeof(key), (void**)&item) == SUCCESS && Z_TYPE_PP(item) == IS_LONG) \ varname = Z_LVAL_PP(item); \ else \ varname = defval @@ -847,7 +847,8 @@ static int php_openssl_parse_config(struct php_x509_request * req, zval * option } } - if (req->priv_key_encrypt && optional_args && zend_hash_find(Z_ARRVAL_P(optional_args), "encrypt_key_cipher", sizeof("encrypt_key_cipher"), (void**)&item) == SUCCESS) { + if (req->priv_key_encrypt && optional_args && zend_hash_find(Z_ARRVAL_P(optional_args), "encrypt_key_cipher", sizeof("encrypt_key_cipher"), (void**)&item) == SUCCESS + && Z_TYPE_PP(item) == IS_LONG) { long cipher_algo = Z_LVAL_PP(item); const EVP_CIPHER* cipher = php_openssl_get_evp_cipher_from_algo(cipher_algo); if (cipher == NULL) { @@ -1962,7 +1963,7 @@ PHP_FUNCTION(openssl_pkcs12_export_to_file) } /* parse extra config from args array, promote this to an extra function */ - if (args && zend_hash_find(Z_ARRVAL_P(args), "friendly_name", sizeof("friendly_name"), (void**)&item) == SUCCESS) + if (args && zend_hash_find(Z_ARRVAL_P(args), "friendly_name", sizeof("friendly_name"), (void**)&item) == SUCCESS && Z_TYPE_PP(item) == IS_STRING) friendly_name = Z_STRVAL_PP(item); /* certpbe (default RC2-40) keypbe (default 3DES) @@ -2040,7 +2041,7 @@ PHP_FUNCTION(openssl_pkcs12_export) } /* parse extra config from args array, promote this to an extra function */ - if (args && zend_hash_find(Z_ARRVAL_P(args), "friendly_name", sizeof("friendly_name"), (void**)&item) == SUCCESS) + if (args && zend_hash_find(Z_ARRVAL_P(args), "friendly_name", sizeof("friendly_name"), (void**)&item) == SUCCESS && Z_TYPE_PP(item) == IS_STRING) friendly_name = Z_STRVAL_PP(item); if (args && zend_hash_find(Z_ARRVAL_P(args), "extracerts", sizeof("extracerts"), (void**)&item) == SUCCESS) diff --git a/ext/openssl/tests/026.phpt b/ext/openssl/tests/026.phpt new file mode 100644 index 0000000000..38d626d742 --- /dev/null +++ b/ext/openssl/tests/026.phpt @@ -0,0 +1,12 @@ +--TEST-- +Options type checks +--SKIPIF-- + +--FILE-- + "DE"], $x, ["x509_extensions" => 0xDEADBEEF]); +?> +DONE +--EXPECT-- +DONE diff --git a/ext/session/session.c b/ext/session/session.c index 7d145c362b..306aba3a7d 100644 --- a/ext/session/session.c +++ b/ext/session/session.c @@ -296,7 +296,8 @@ PHPAPI char *php_session_create_id(PS_CREATE_SID_ARGS) /* {{{ */ if (zend_hash_find(&EG(symbol_table), "_SERVER", sizeof("_SERVER"), (void **) &array) == SUCCESS && Z_TYPE_PP(array) == IS_ARRAY && - zend_hash_find(Z_ARRVAL_PP(array), "REMOTE_ADDR", sizeof("REMOTE_ADDR"), (void **) &token) == SUCCESS + zend_hash_find(Z_ARRVAL_PP(array), "REMOTE_ADDR", sizeof("REMOTE_ADDR"), (void **) &token) == SUCCESS && + Z_TYPE_PP(token) == IS_STRING ) { remote_addr = Z_STRVAL_PP(token); } -- cgit v1.2.1 From 3e167ba990afc1f46739dfed9d4ba42e9389b2f2 Mon Sep 17 00:00:00 2001 From: Stanislav Malyshev Date: Mon, 28 Jul 2014 00:38:10 -0700 Subject: fix NEWS --- NEWS | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/NEWS b/NEWS index 97c9ae2852..c2b6a97532 100644 --- a/NEWS +++ b/NEWS @@ -5,6 +5,9 @@ PHP NEWS - COM: . Fixed missing type checks in com_event_sink (Yussuf Khalil, Stas). +- OpenSSL: + . Fixed missing type checks in OpenSSL options (Yussuf Khalil, Stas). + - Readline: . Fixed bug #55496 (Interactive mode doesn't force a newline before the prompt). (Bob, Johannes) @@ -19,9 +22,6 @@ PHP NEWS sorting). (research at insighti dot org, Laruence) . Fixed bug #67538 (SPL Iterators use-after-free). (CVE-2014-4670) (Laruence) -- OpenSSL: - . Fixed missing type checks in OpenSSL options (Yussuf Khalil, Stas). - 24 Jul 2014, PHP 5.4.31 - Core: -- cgit v1.2.1