Skip to content

Commit 332e9a4

Browse files
GirgiasGirgias
authored
ext/ldap: Use "p" ZPP specifier for all strings that must be null terminated (#16091)
1 parent 181ea64 commit 332e9a4

File tree

2 files changed

+36
-60
lines changed

2 files changed

+36
-60
lines changed

‎ext/ldap/ldap.c

Lines changed: 35 additions & 59 deletions
Original file line numberDiff line numberDiff line change
@@ -1102,18 +1102,6 @@ static int _get_lderrno(LDAP *ldap)
11021102
}
11031103
/* }}} */
11041104

1105-
/* {{{ _set_lderrno */
1106-
static void _set_lderrno(LDAP *ldap, int lderr)
1107-
{
1108-
#if LDAP_API_VERSION > 2000 || defined(HAVE_ORALDAP)
1109-
/* New versions of OpenLDAP do it this way */
1110-
ldap_set_option(ldap, LDAP_OPT_ERROR_NUMBER, &lderr);
1111-
#else
1112-
ldap->ld_errno = lderr;
1113-
#endif
1114-
}
1115-
/* }}} */
1116-
11171105
/* {{{ Bind to LDAP directory */
11181106
PHP_FUNCTION(ldap_bind)
11191107
{
@@ -1123,25 +1111,13 @@ PHP_FUNCTION(ldap_bind)
11231111
ldap_linkdata *ld;
11241112
int rc;
11251113

1126-
if (zend_parse_parameters(ZEND_NUM_ARGS(), "O|s!s!", &link, ldap_link_ce, &ldap_bind_dn, &ldap_bind_dnlen, &ldap_bind_pw, &ldap_bind_pwlen) != SUCCESS) {
1114+
if (zend_parse_parameters(ZEND_NUM_ARGS(), "O|p!p!", &link, ldap_link_ce, &ldap_bind_dn, &ldap_bind_dnlen, &ldap_bind_pw, &ldap_bind_pwlen) != SUCCESS) {
11271115
RETURN_THROWS();
11281116
}
11291117

11301118
ld = Z_LDAP_LINK_P(link);
11311119
VERIFY_LDAP_LINK_CONNECTED(ld);
11321120

1133-
if (ldap_bind_dn != NULL && memchr(ldap_bind_dn, '\0', ldap_bind_dnlen) != NULL) {
1134-
_set_lderrno(ld->link, LDAP_INVALID_CREDENTIALS);
1135-
zend_argument_type_error(2, "must not contain null bytes");
1136-
RETURN_THROWS();
1137-
}
1138-
1139-
if (ldap_bind_pw != NULL && memchr(ldap_bind_pw, '\0', ldap_bind_pwlen) != NULL) {
1140-
_set_lderrno(ld->link, LDAP_INVALID_CREDENTIALS);
1141-
zend_argument_type_error(3, "must not contain null bytes");
1142-
RETURN_THROWS();
1143-
}
1144-
11451121
{
11461122
#ifdef LDAP_API_FEATURE_X_OPENLDAP
11471123
/* ldap_simple_bind_s() is deprecated, use ldap_sasl_bind_s() instead.
@@ -1179,25 +1155,13 @@ PHP_FUNCTION(ldap_bind_ext)
11791155
LDAPMessage *ldap_res;
11801156
int rc;
11811157

1182-
if (zend_parse_parameters(ZEND_NUM_ARGS(), "O|s!s!a!", &link, ldap_link_ce, &ldap_bind_dn, &ldap_bind_dnlen, &ldap_bind_pw, &ldap_bind_pwlen, &serverctrls) != SUCCESS) {
1158+
if (zend_parse_parameters(ZEND_NUM_ARGS(), "O|p!p!a!", &link, ldap_link_ce, &ldap_bind_dn, &ldap_bind_dnlen, &ldap_bind_pw, &ldap_bind_pwlen, &serverctrls) != SUCCESS) {
11831159
RETURN_THROWS();
11841160
}
11851161

11861162
ld = Z_LDAP_LINK_P(link);
11871163
VERIFY_LDAP_LINK_CONNECTED(ld);
11881164

1189-
if (ldap_bind_dn != NULL && memchr(ldap_bind_dn, '\0', ldap_bind_dnlen) != NULL) {
1190-
_set_lderrno(ld->link, LDAP_INVALID_CREDENTIALS);
1191-
zend_argument_type_error(2, "must not contain null bytes");
1192-
RETURN_THROWS();
1193-
}
1194-
1195-
if (ldap_bind_pw != NULL && memchr(ldap_bind_pw, '\0', ldap_bind_pwlen) != NULL) {
1196-
_set_lderrno(ld->link, LDAP_INVALID_CREDENTIALS);
1197-
zend_argument_type_error(3, "must not contain null bytes");
1198-
RETURN_THROWS();
1199-
}
1200-
12011165
if (serverctrls) {
12021166
lserverctrls = _php_ldap_controls_from_array(ld->link, serverctrls, 4);
12031167
if (lserverctrls == NULL) {
@@ -1342,7 +1306,18 @@ PHP_FUNCTION(ldap_sasl_bind)
13421306
size_t rc, dn_len, passwd_len, mech_len, realm_len, authc_id_len, authz_id_len, props_len;
13431307
php_ldap_bictx *ctx;
13441308

1345-
if (zend_parse_parameters(ZEND_NUM_ARGS(), "O|s!s!s!s!s!s!s!", &link, ldap_link_ce, &binddn, &dn_len, &passwd, &passwd_len, &sasl_mech, &mech_len, &sasl_realm, &realm_len, &sasl_authc_id, &authc_id_len, &sasl_authz_id, &authz_id_len, &props, &props_len) != SUCCESS) {
1309+
if (zend_parse_parameters(ZEND_NUM_ARGS(), "O|p!p!p!p!p!p!p!",
1310+
&link, ldap_link_ce,
1311+
&binddn, &dn_len,
1312+
&passwd, &passwd_len,
1313+
&sasl_mech, &mech_len,
1314+
&sasl_realm, &realm_len,
1315+
&sasl_authc_id,
1316+
&authc_id_len,
1317+
&sasl_authz_id,
1318+
&authz_id_len,
1319+
&props, &props_len
1320+
) != SUCCESS) {
13461321
RETURN_THROWS();
13471322
}
13481323

@@ -1521,6 +1496,7 @@ static void php_ldap_do_search(INTERNAL_FUNCTION_PARAMETERS, int scope)
15211496
ret = 0;
15221497
goto cleanup;
15231498
}
1499+
// TODO check filter does not have any nul bytes
15241500
}
15251501

15261502
if (filter_ht) {
@@ -1534,6 +1510,7 @@ static void php_ldap_do_search(INTERNAL_FUNCTION_PARAMETERS, int scope)
15341510
} else {
15351511
nfilters = 0; /* this means string, not array */
15361512
ldap_filter = zend_string_copy(filter_str);
1513+
// TODO check filter does not have any nul bytes
15371514
}
15381515

15391516
lds = safe_emalloc(nlinks, sizeof(ldap_linkdata), 0);
@@ -1564,6 +1541,7 @@ static void php_ldap_do_search(INTERNAL_FUNCTION_PARAMETERS, int scope)
15641541
ret = 0;
15651542
goto cleanup_parallel;
15661543
}
1544+
// TODO check dn does not have any nul bytes
15671545
}
15681546
if (nfilters != 0) { /* filter an array? */
15691547
entry = zend_hash_get_current_data(filter_ht);
@@ -1573,6 +1551,7 @@ static void php_ldap_do_search(INTERNAL_FUNCTION_PARAMETERS, int scope)
15731551
ret = 0;
15741552
goto cleanup_parallel;
15751553
}
1554+
// TODO check filter does not have any nul bytes
15761555
}
15771556

15781557
if (serverctrls) {
@@ -2059,7 +2038,7 @@ PHP_FUNCTION(ldap_get_values_len)
20592038
int i, num_values;
20602039
size_t attr_len;
20612040

2062-
if (zend_parse_parameters(ZEND_NUM_ARGS(), "OOs", &link, ldap_link_ce, &result_entry, ldap_result_entry_ce, &attr, &attr_len) != SUCCESS) {
2041+
if (zend_parse_parameters(ZEND_NUM_ARGS(), "OOp", &link, ldap_link_ce, &result_entry, ldap_result_entry_ce, &attr, &attr_len) != SUCCESS) {
20632042
RETURN_THROWS();
20642043
}
20652044

@@ -2125,7 +2104,7 @@ PHP_FUNCTION(ldap_explode_dn)
21252104
int i, count;
21262105
size_t dn_len;
21272106

2128-
if (zend_parse_parameters(ZEND_NUM_ARGS(), "sl", &dn, &dn_len, &with_attrib) != SUCCESS) {
2107+
if (zend_parse_parameters(ZEND_NUM_ARGS(), "pl", &dn, &dn_len, &with_attrib) != SUCCESS) {
21292108
RETURN_THROWS();
21302109
}
21312110

@@ -2155,7 +2134,7 @@ PHP_FUNCTION(ldap_dn2ufn)
21552134
char *dn, *ufn;
21562135
size_t dn_len;
21572136

2158-
if (zend_parse_parameters(ZEND_NUM_ARGS(), "s", &dn, &dn_len) != SUCCESS) {
2137+
if (zend_parse_parameters(ZEND_NUM_ARGS(), "p", &dn, &dn_len) != SUCCESS) {
21592138
RETURN_THROWS();
21602139
}
21612140

@@ -2193,7 +2172,7 @@ static void php_ldap_do_modify(INTERNAL_FUNCTION_PARAMETERS, int oper, int ext)
21932172
zend_ulong index;
21942173
int is_full_add=0; /* flag for full add operation so ldap_mod_add can be put back into oper, gerrit THomson */
21952174

2196-
if (zend_parse_parameters(ZEND_NUM_ARGS(), "Osa/|a!", &link, ldap_link_ce, &dn, &dn_len, &entry, &serverctrls) != SUCCESS) {
2175+
if (zend_parse_parameters(ZEND_NUM_ARGS(), "Opa/|a!", &link, ldap_link_ce, &dn, &dn_len, &entry, &serverctrls) != SUCCESS) {
21972176
RETURN_THROWS();
21982177
}
21992178

@@ -2428,7 +2407,7 @@ static void php_ldap_do_delete(INTERNAL_FUNCTION_PARAMETERS, int ext)
24282407
int rc, msgid;
24292408
size_t dn_len;
24302409

2431-
if (zend_parse_parameters(ZEND_NUM_ARGS(), "Os|a!", &link, ldap_link_ce, &dn, &dn_len, &serverctrls) != SUCCESS) {
2410+
if (zend_parse_parameters(ZEND_NUM_ARGS(), "Op|a!", &link, ldap_link_ce, &dn, &dn_len, &serverctrls) != SUCCESS) {
24322411
RETURN_THROWS();
24332412
}
24342413

@@ -2525,20 +2504,14 @@ PHP_FUNCTION(ldap_modify_batch)
25252504
];
25262505
*/
25272506

2528-
if (zend_parse_parameters(ZEND_NUM_ARGS(), "Osh/|a!", &link, ldap_link_ce, &dn, &dn_len, &modifications, &server_controls_zv) != SUCCESS) {
2507+
if (zend_parse_parameters(ZEND_NUM_ARGS(), "Oph/|a!", &link, ldap_link_ce, &dn, &dn_len, &modifications, &server_controls_zv) != SUCCESS) {
25292508
RETURN_THROWS();
25302509
}
25312510

25322511
ldap_linkdata *ld = Z_LDAP_LINK_P(link);
25332512
VERIFY_LDAP_LINK_CONNECTED(ld);
25342513

25352514
/* perform validation */
2536-
/* make sure the DN contains no NUL bytes */
2537-
if (zend_char_has_nul_byte(dn, dn_len)) {
2538-
zend_argument_value_error(2, "must not contain null bytes");
2539-
RETURN_THROWS();
2540-
}
2541-
25422515
/* make sure the top level is a normal array */
25432516
if (zend_hash_num_elements(modifications) == 0) {
25442517
zend_argument_must_not_be_empty_error(3);
@@ -2819,14 +2792,20 @@ PHP_FUNCTION(ldap_compare)
28192792
{
28202793
zval *serverctrls = NULL;
28212794
zval *link;
2822-
char *dn, *attr, *value;
2823-
size_t dn_len, attr_len, value_len;
2795+
char *dn, *attr;
2796+
size_t dn_len, attr_len;
28242797
ldap_linkdata *ld;
28252798
LDAPControl **lserverctrls = NULL;
28262799
int ldap_errno;
28272800
struct berval lvalue;
28282801

2829-
if (zend_parse_parameters(ZEND_NUM_ARGS(), "Osss|a!", &link, ldap_link_ce, &dn, &dn_len, &attr, &attr_len, &value, &value_len, &serverctrls) != SUCCESS) {
2802+
if (zend_parse_parameters(ZEND_NUM_ARGS(), "Opps|a!",
2803+
&link, ldap_link_ce,
2804+
&dn, &dn_len,
2805+
&attr, &attr_len,
2806+
&lvalue.bv_val, &lvalue.bv_len,
2807+
&serverctrls
2808+
) != SUCCESS) {
28302809
RETURN_THROWS();
28312810
}
28322811

@@ -2841,9 +2820,6 @@ PHP_FUNCTION(ldap_compare)
28412820
}
28422821
}
28432822

2844-
lvalue.bv_val = value;
2845-
lvalue.bv_len = value_len;
2846-
28472823
ldap_errno = ldap_compare_ext_s(ld->link, dn, attr, &lvalue, lserverctrls, NULL);
28482824

28492825
switch (ldap_errno) {
@@ -3489,7 +3465,7 @@ static void php_ldap_do_rename(INTERNAL_FUNCTION_PARAMETERS, int ext)
34893465
size_t dn_len, newrdn_len, newparent_len;
34903466
bool deleteoldrdn;
34913467

3492-
if (zend_parse_parameters(ZEND_NUM_ARGS(), "Osssb|a!", &link, ldap_link_ce, &dn, &dn_len, &newrdn, &newrdn_len, &newparent, &newparent_len, &deleteoldrdn, &serverctrls) != SUCCESS) {
3468+
if (zend_parse_parameters(ZEND_NUM_ARGS(), "Opppb|a!", &link, ldap_link_ce, &dn, &dn_len, &newrdn, &newrdn_len, &newparent, &newparent_len, &deleteoldrdn, &serverctrls) != SUCCESS) {
34933469
RETURN_THROWS();
34943470
}
34953471

@@ -3827,7 +3803,7 @@ static void php_ldap_exop(INTERNAL_FUNCTION_PARAMETERS, bool force_sync) {
38273803
}
38283804
}
38293805

3830-
if (zend_parse_parameters(ZEND_NUM_ARGS(), "OS|S!a!zz", &link, ldap_link_ce, &reqoid, &reqdata, &serverctrls, &retdata, &retoid) != SUCCESS) {
3806+
if (zend_parse_parameters(ZEND_NUM_ARGS(), "OP|S!a!zz", &link, ldap_link_ce, &reqoid, &reqdata, &serverctrls, &retdata, &retoid) != SUCCESS) {
38313807
RETURN_THROWS();
38323808
}
38333809

‎ext/ldap/tests/ldap_modify_batch_programming_error.phpt

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -255,7 +255,7 @@ try {
255255

256256
?>
257257
--EXPECT--
258-
ValueError: ldap_modify_batch(): Argument #2 ($dn) must not contain null bytes
258+
ValueError: ldap_modify_batch(): Argument #2 ($dn) must not contain any null bytes
259259
ValueError: ldap_modify_batch(): Argument #3 ($modifications_info) must not be empty
260260
ValueError: ldap_modify_batch(): Argument #3 ($modifications_info) must be a list
261261
ValueError: ldap_modify_batch(): Argument #3 ($modifications_info) must be a list

0 commit comments

Comments
 (0)