Skip to content

Commit 0623574

Browse files
cjbjcjbj
committed
Merge branch 'PHP-5.4' of https://git.php.net/repository/php-src into PHP-5.4
* 'PHP-5.4' of https://git.php.net/repository/php-src: Fixed bug61115-1.phpt for debug build version. Fixed bug #60718 Complie problem with libpq (PostgreSQL 7.3 or less) Fixed bug #60718 Complie problem with libpq (PostgreSQL 7.3 or less) This will be PHP 5.3.12 ext/pcntl/pcntl.c: Fix typo in comment Revert "ext/pcntl/pcntl.c: Fix typo in comment" (apply correct workflow) Revert "ext/pcntl/pcntl.c: Fix typo in comment" (apply correct workflow) ext/pcntl/pcntl.c: Fix typo in comment ext/pcntl/pcntl.c: Fix typo in comment - fix bug #61541, Segfault when using ob_* in output_callback - fix bug #61541, Segfault when using ob_* in output_callback update NEWS fix bug #61367 - open_basedir bypass using libxml RSHUTDOWN open_basedir check for linkinfo NEWS entry for readline fix NEWS entry for readline fix Add open_basedir checks to readline_write_history and readline_read_history
2 parents 4b72d50 + c02aa08 commit 0623574

File tree

8 files changed

+137
-8
lines changed

8 files changed

+137
-8
lines changed

‎ext/libxml/libxml.c

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -86,8 +86,8 @@ ZEND_GET_MODULE(libxml)
8686
static PHP_MINIT_FUNCTION(libxml);
8787
static PHP_RINIT_FUNCTION(libxml);
8888
static PHP_MSHUTDOWN_FUNCTION(libxml);
89-
static PHP_RSHUTDOWN_FUNCTION(libxml);
9089
static PHP_MINFO_FUNCTION(libxml);
90+
static int php_libxml_post_deactivate();
9191

9292
/* }}} */
9393

@@ -137,13 +137,13 @@ zend_module_entry libxml_module_entry = {
137137
PHP_MINIT(libxml), /* extension-wide startup function */
138138
PHP_MSHUTDOWN(libxml), /* extension-wide shutdown function */
139139
PHP_RINIT(libxml), /* per-request startup function */
140-
PHP_RSHUTDOWN(libxml), /* per-request shutdown function */
140+
NULL, /* per-request shutdown function */
141141
PHP_MINFO(libxml), /* information function */
142142
NO_VERSION_YET,
143143
PHP_MODULE_GLOBALS(libxml), /* globals descriptor */
144144
PHP_GINIT(libxml), /* globals ctor */
145145
NULL, /* globals dtor */
146-
NULL, /* post deactivate */
146+
php_libxml_post_deactivate, /* post deactivate */
147147
STANDARD_MODULE_PROPERTIES_EX
148148
};
149149

@@ -861,9 +861,9 @@ static PHP_MSHUTDOWN_FUNCTION(libxml)
861861
return SUCCESS;
862862
}
863863

864-
865-
static PHP_RSHUTDOWN_FUNCTION(libxml)
864+
static int php_libxml_post_deactivate()
866865
{
866+
TSRMLS_FETCH();
867867
/* reset libxml generic error handling */
868868
if (_php_libxml_per_request_initialization) {
869869
xmlSetGenericErrorFunc(NULL, NULL);

‎ext/libxml/tests/bug61367-read.phpt

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
--TEST--
2+
Bug #61367: open_basedir bypass in libxml RSHUTDOWN: read test
3+
--SKIPIF--
4+
<?php if(!extension_loaded('dom')) echo 'skip'; ?>
5+
--INI--
6+
open_basedir=.
7+
; Suppress spurious "Trying to get property of non-object" notices
8+
error_reporting=E_ALL & ~E_NOTICE
9+
--FILE--
10+
<?php
11+
12+
class StreamExploiter {
13+
public function stream_close ( ) {
14+
$doc = new DOMDocument;
15+
$doc->resolveExternals = true;
16+
$doc->substituteEntities = true;
17+
$dir = htmlspecialchars(dirname(getcwd()));
18+
$doc->loadXML( <<<XML
19+
<!DOCTYPE doc [
20+
<!ENTITY file SYSTEM "file:///$dir/bad">
21+
]>
22+
<doc>&file;</doc>
23+
XML
24+
);
25+
print $doc->documentElement->firstChild->nodeValue;
26+
}
27+
28+
public function stream_open ( $path , $mode , $options , &$opened_path ) {
29+
return true;
30+
}
31+
}
32+
33+
var_dump(mkdir('test_bug_61367'));
34+
var_dump(mkdir('test_bug_61367/base'));
35+
var_dump(file_put_contents('test_bug_61367/bad', 'blah'));
36+
var_dump(chdir('test_bug_61367/base'));
37+
38+
stream_wrapper_register( 'exploit', 'StreamExploiter' );
39+
$s = fopen( 'exploit://', 'r' );
40+
41+
?>
42+
--CLEAN--
43+
<?php
44+
unlink('test_bug_61367/bad');
45+
rmdir('test_bug_61367/base');
46+
rmdir('test_bug_61367');
47+
?>
48+
--EXPECTF--
49+
bool(true)
50+
bool(true)
51+
int(4)
52+
bool(true)
53+
54+
Warning: DOMDocument::loadXML(): I/O warning : failed to load external entity "file:///%s/test_bug_61367/bad" in %s on line %d
55+
56+
Warning: DOMDocument::loadXML(): Failure to process entity file in Entity, line: 4 in %s on line %d
57+
58+
Warning: DOMDocument::loadXML(): Entity 'file' not defined in Entity, line: 4 in %s on line %d

‎ext/libxml/tests/bug61367-write.phpt

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
--TEST--
2+
Bug #61367: open_basedir bypass in libxml RSHUTDOWN: write test
3+
--SKIPIF--
4+
<?php if(!extension_loaded('dom')) echo 'skip'; ?>
5+
--INI--
6+
open_basedir=.
7+
; Suppress spurious "Trying to get property of non-object" notices
8+
error_reporting=E_ALL & ~E_NOTICE
9+
--FILE--
10+
<?php
11+
12+
class StreamExploiter {
13+
public function stream_close ( ) {
14+
$doc = new DOMDocument;
15+
$doc->appendChild($doc->createTextNode('hello'));
16+
var_dump($doc->save(dirname(getcwd()) . '/bad'));
17+
}
18+
19+
public function stream_open ( $path , $mode , $options , &$opened_path ) {
20+
return true;
21+
}
22+
}
23+
24+
var_dump(mkdir('test_bug_61367'));
25+
var_dump(mkdir('test_bug_61367/base'));
26+
var_dump(file_put_contents('test_bug_61367/bad', 'blah'));
27+
var_dump(chdir('test_bug_61367/base'));
28+
29+
stream_wrapper_register( 'exploit', 'StreamExploiter' );
30+
$s = fopen( 'exploit://', 'r' );
31+
32+
?>
33+
--CLEAN--
34+
<?php
35+
@unlink('test_bug_61367/bad');
36+
rmdir('test_bug_61367/base');
37+
rmdir('test_bug_61367');
38+
?>
39+
--EXPECTF--
40+
bool(true)
41+
bool(true)
42+
int(4)
43+
bool(true)
44+
45+
Warning: DOMDocument::save(): open_basedir restriction in effect. File(%s) is not within the allowed path(s): (.) in %s on line %d
46+
47+
Warning: DOMDocument::save(%s): failed to open stream: Operation not permitted in %s on line %d
48+
bool(false)

‎ext/pcntl/pcntl.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -760,7 +760,7 @@ PHP_FUNCTION(pcntl_exec)
760760
}
761761

762762
if (ZEND_NUM_ARGS() > 1) {
763-
/* Build argumnent list */
763+
/* Build argument list */
764764
args_hash = HASH_OF(args);
765765
argc = zend_hash_num_elements(args_hash);
766766

‎ext/pgsql/pgsql.c

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4787,7 +4787,9 @@ PHP_FUNCTION(pg_get_notify)
47874787
#else
47884788
if (atof(PG_VERSION) >= 9.0) {
47894789
#endif
4790+
#if HAVE_PQPARAMETERSTATUS
47904791
add_index_string(return_value, 2, pgsql_notify->extra, 1);
4792+
#endif
47914793
}
47924794
}
47934795
if (result_type & PGSQL_ASSOC) {
@@ -4798,7 +4800,9 @@ PHP_FUNCTION(pg_get_notify)
47984800
#else
47994801
if (atof(PG_VERSION) >= 9.0) {
48004802
#endif
4803+
#if HAVE_PQPARAMETERSTATUS
48014804
add_assoc_string(return_value, "payload", pgsql_notify->extra, 1);
4805+
#endif
48024806
}
48034807
}
48044808
PQfreemem(pgsql_notify);

‎ext/readline/readline.c

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -384,6 +384,10 @@ PHP_FUNCTION(readline_read_history)
384384
return;
385385
}
386386

387+
if (php_check_open_basedir(arg TSRMLS_CC)) {
388+
RETURN_FALSE;
389+
}
390+
387391
/* XXX from & to NYI */
388392
if (read_history(arg)) {
389393
RETURN_FALSE;
@@ -404,6 +408,10 @@ PHP_FUNCTION(readline_write_history)
404408
return;
405409
}
406410

411+
if (php_check_open_basedir(arg TSRMLS_CC)) {
412+
RETURN_FALSE;
413+
}
414+
407415
if (write_history(arg)) {
408416
RETURN_FALSE;
409417
} else {

‎ext/standard/link.c

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -85,20 +85,31 @@ PHP_FUNCTION(readlink)
8585
PHP_FUNCTION(linkinfo)
8686
{
8787
char *link;
88-
int link_len;
88+
char *dirname;
89+
int link_len, dir_len;
8990
struct stat sb;
9091
int ret;
9192

9293
if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p", &link, &link_len) == FAILURE) {
9394
return;
9495
}
9596

97+
dirname = estrndup(link, link_len);
98+
dir_len = php_dirname(dirname, link_len);
99+
100+
if (php_check_open_basedir(dirname TSRMLS_CC)) {
101+
efree(dirname);
102+
RETURN_FALSE;
103+
}
104+
96105
ret = VCWD_LSTAT(link, &sb);
97106
if (ret == -1) {
98107
php_error_docref(NULL TSRMLS_CC, E_WARNING, "%s", strerror(errno));
108+
efree(dirname);
99109
RETURN_LONG(-1L);
100110
}
101111

112+
efree(dirname);
102113
RETURN_LONG((long) sb.st_dev);
103114
}
104115
/* }}} */

‎ext/standard/tests/streams/bug61115-1.phpt

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,4 +8,4 @@ stream_context_get_options($fileResourceTemp);
88
ftruncate($fileResourceTemp, PHP_INT_MAX);
99
?>
1010
--EXPECTF--
11-
Fatal error: Allowed memory size of %d bytes exhausted (tried to allocate %d bytes) in %s on line %d
11+
Fatal error: Allowed memory size of %d bytes exhausted %s (tried to allocate %d bytes) in %s on line %d

0 commit comments

Comments
 (0)