Skip to content

Commit cbf0890

Browse files
bukkabukka
committed
Merge branch 'PHP-8.1' into PHP-8.2
2 parents e3aa739 + 4058d20 commit cbf0890

File tree

7 files changed

+268
-13
lines changed

7 files changed

+268
-13
lines changed

‎NEWS

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
PHP NEWS
22
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
3-
?? ??? ????, PHP 8.2.3
3+
?? ??? ????, PHP 8.2.4
44

55
- Core:
66
. Fixed incorrect check condition in ZEND_YIELD. (nielsdos)
@@ -70,6 +70,18 @@ PHP NEWS
7070
. Fix memory leaks when attempting to open a non-existing file or a file over
7171
4GB. (Girgias)
7272

73+
14 Feb 2023, PHP 8.2.3
74+
75+
- Core:
76+
. Fixed bug #81744 (Password_verify() always return true with some hash).
77+
(CVE-2023-0567). (Tim Düsterhus)
78+
. Fixed bug #81746 (1-byte array overrun in common path resolve code).
79+
(CVE-2023-0568). (Niels Dossche)
80+
81+
- SAPI:
82+
. Fixed bug GHSA-54hq-v5wp-fqgv (DOS vulnerability when parsing multipart
83+
request body). (CVE-2023-0662) (Jakub Zelenka)
84+
7385
02 Feb 2023, PHP 8.2.2
7486

7587
- Core:

‎main/main.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -748,6 +748,7 @@ PHP_INI_BEGIN()
748748
PHP_INI_ENTRY("disable_functions", "", PHP_INI_SYSTEM, NULL)
749749
PHP_INI_ENTRY("disable_classes", "", PHP_INI_SYSTEM, NULL)
750750
PHP_INI_ENTRY("max_file_uploads", "20", PHP_INI_SYSTEM|PHP_INI_PERDIR, NULL)
751+
PHP_INI_ENTRY("max_multipart_body_parts", "-1", PHP_INI_SYSTEM|PHP_INI_PERDIR, NULL)
751752

752753
STD_PHP_INI_BOOLEAN("allow_url_fopen", "1", PHP_INI_SYSTEM, OnUpdateBool, allow_url_fopen, php_core_globals, core_globals)
753754
STD_PHP_INI_BOOLEAN("allow_url_include", "0", PHP_INI_SYSTEM, OnUpdateBool, allow_url_include, php_core_globals, core_globals)

‎main/rfc1867.c

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -686,6 +686,7 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_post_handler) /* {{{ */
686686
void *event_extra_data = NULL;
687687
unsigned int llen = 0;
688688
int upload_cnt = INI_INT("max_file_uploads");
689+
int body_parts_cnt = INI_INT("max_multipart_body_parts");
689690
const zend_encoding *internal_encoding = zend_multibyte_get_internal_encoding();
690691
php_rfc1867_getword_t getword;
691692
php_rfc1867_getword_conf_t getword_conf;
@@ -707,6 +708,11 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_post_handler) /* {{{ */
707708
return;
708709
}
709710

711+
if (body_parts_cnt < 0) {
712+
body_parts_cnt = PG(max_input_vars) + upload_cnt;
713+
}
714+
int body_parts_limit = body_parts_cnt;
715+
710716
/* Get the boundary */
711717
boundary = strstr(content_type_dup, "boundary");
712718
if (!boundary) {
@@ -791,6 +797,11 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_post_handler) /* {{{ */
791797
char *pair = NULL;
792798
int end = 0;
793799

800+
if (--body_parts_cnt < 0) {
801+
php_error_docref(NULL, E_WARNING, "Multipart body parts limit exceeded %d. To increase the limit change max_multipart_body_parts in php.ini.", body_parts_limit);
802+
goto fileupload_done;
803+
}
804+
794805
while (isspace(*cd)) {
795806
++cd;
796807
}
@@ -910,7 +921,10 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_post_handler) /* {{{ */
910921
skip_upload = 1;
911922
} else if (upload_cnt <= 0) {
912923
skip_upload = 1;
913-
sapi_module.sapi_error(E_WARNING, "Maximum number of allowable file uploads has been exceeded");
924+
if (upload_cnt == 0) {
925+
--upload_cnt;
926+
sapi_module.sapi_error(E_WARNING, "Maximum number of allowable file uploads has been exceeded");
927+
}
914928
}
915929

916930
/* Return with an error if the posted data is garbled */

‎sapi/fpm/tests/ghsa-54hq-v5wp-fqgv-max-body-parts-custom.phpt

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
--TEST--
2+
FPM: GHSA-54hq-v5wp-fqgv - max_multipart_body_parts ini custom value
3+
--SKIPIF--
4+
<?php include "skipif.inc"; ?>
5+
--FILE--
6+
<?php
7+
8+
require_once "tester.inc";
9+
10+
$cfg = <<<EOT
11+
[global]
12+
error_log = {{FILE:LOG}}
13+
[unconfined]
14+
listen = {{ADDR}}
15+
pm = dynamic
16+
pm.max_children = 5
17+
pm.start_servers = 1
18+
pm.min_spare_servers = 1
19+
pm.max_spare_servers = 3
20+
php_admin_value[html_errors] = false
21+
php_admin_value[max_input_vars] = 20
22+
php_admin_value[max_file_uploads] = 5
23+
php_admin_value[max_multipart_body_parts] = 10
24+
php_flag[display_errors] = On
25+
EOT;
26+
27+
$code = <<<EOT
28+
<?php
29+
var_dump(count(\$_POST));
30+
EOT;
31+
32+
$tester = new FPM\Tester($cfg, $code);
33+
$tester->start();
34+
$tester->expectLogStartNotices();
35+
echo $tester
36+
->request(stdin: [
37+
'parts' => [
38+
'count' => 30,
39+
]
40+
])
41+
->getBody();
42+
$tester->terminate();
43+
$tester->close();
44+
45+
?>
46+
--EXPECT--
47+
Warning: PHP Request Startup: Multipart body parts limit exceeded 10. To increase the limit change max_multipart_body_parts in php.ini. in Unknown on line 0
48+
int(10)
49+
--CLEAN--
50+
<?php
51+
require_once "tester.inc";
52+
FPM\Tester::clean();
53+
?>

‎sapi/fpm/tests/ghsa-54hq-v5wp-fqgv-max-body-parts-default.phpt

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
--TEST--
2+
FPM: GHSA-54hq-v5wp-fqgv - max_multipart_body_parts ini default
3+
--SKIPIF--
4+
<?php include "skipif.inc"; ?>
5+
--FILE--
6+
<?php
7+
8+
require_once "tester.inc";
9+
10+
$cfg = <<<EOT
11+
[global]
12+
error_log = {{FILE:LOG}}
13+
[unconfined]
14+
listen = {{ADDR}}
15+
pm = dynamic
16+
pm.max_children = 5
17+
pm.start_servers = 1
18+
pm.min_spare_servers = 1
19+
pm.max_spare_servers = 3
20+
php_admin_value[html_errors] = false
21+
php_admin_value[max_input_vars] = 20
22+
php_admin_value[max_file_uploads] = 5
23+
php_flag[display_errors] = On
24+
EOT;
25+
26+
$code = <<<EOT
27+
<?php
28+
var_dump(count(\$_POST));
29+
EOT;
30+
31+
$tester = new FPM\Tester($cfg, $code);
32+
$tester->start();
33+
$tester->expectLogStartNotices();
34+
echo $tester
35+
->request(stdin: [
36+
'parts' => [
37+
'count' => 30,
38+
]
39+
])
40+
->getBody();
41+
$tester->terminate();
42+
$tester->close();
43+
44+
?>
45+
--EXPECT--
46+
Warning: PHP Request Startup: Input variables exceeded 20. To increase the limit change max_input_vars in php.ini. in Unknown on line 0
47+
48+
Warning: PHP Request Startup: Multipart body parts limit exceeded 25. To increase the limit change max_multipart_body_parts in php.ini. in Unknown on line 0
49+
int(20)
50+
--CLEAN--
51+
<?php
52+
require_once "tester.inc";
53+
FPM\Tester::clean();
54+
?>

‎sapi/fpm/tests/ghsa-54hq-v5wp-fqgv-max-file-uploads.phpt

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
--TEST--
2+
FPM: GHSA-54hq-v5wp-fqgv - exceeding max_file_uploads
3+
--SKIPIF--
4+
<?php include "skipif.inc"; ?>
5+
--FILE--
6+
<?php
7+
8+
require_once "tester.inc";
9+
10+
$cfg = <<<EOT
11+
[global]
12+
error_log = {{FILE:LOG}}
13+
[unconfined]
14+
listen = {{ADDR}}
15+
pm = dynamic
16+
pm.max_children = 5
17+
pm.start_servers = 1
18+
pm.min_spare_servers = 1
19+
pm.max_spare_servers = 3
20+
php_admin_value[html_errors] = false
21+
php_admin_value[max_file_uploads] = 5
22+
php_flag[display_errors] = On
23+
EOT;
24+
25+
$code = <<<EOT
26+
<?php
27+
var_dump(count(\$_FILES));
28+
EOT;
29+
30+
$tester = new FPM\Tester($cfg, $code);
31+
$tester->start();
32+
$tester->expectLogStartNotices();
33+
echo $tester
34+
->request(stdin: [
35+
'parts' => [
36+
'count' => 10,
37+
'param' => 'filename'
38+
]
39+
])
40+
->getBody();
41+
$tester->terminate();
42+
$tester->close();
43+
44+
?>
45+
--EXPECT--
46+
Warning: Maximum number of allowable file uploads has been exceeded in Unknown on line 0
47+
int(5)
48+
--CLEAN--
49+
<?php
50+
require_once "tester.inc";
51+
FPM\Tester::clean();
52+
?>

‎sapi/fpm/tests/tester.inc

Lines changed: 80 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -651,21 +651,86 @@ class Tester
651651
});
652652
}
653653

654+
/**
655+
* Parse stdin and generate data for multipart config.
656+
*
657+
* @param array $stdin
658+
* @param array $headers
659+
*
660+
* @return void
661+
* @throws \Exception
662+
*/
663+
private function parseStdin(array $stdin, array &$headers)
664+
{
665+
$parts = $stdin['parts'] ?? null;
666+
if (empty($parts)) {
667+
throw new \Exception('The stdin array needs to contain parts');
668+
}
669+
$boundary = $stdin['boundary'] ?? 'AaB03x';
670+
if ( ! isset($headers['CONTENT_TYPE'])) {
671+
$headers['CONTENT_TYPE'] = 'multipart/form-data; boundary=' . $boundary;
672+
}
673+
$count = $parts['count'] ?? null;
674+
if ( ! is_null($count)) {
675+
$dispositionType = $parts['disposition'] ?? 'form-data';
676+
$dispositionParam = $parts['param'] ?? 'name';
677+
$namePrefix = $parts['prefix'] ?? 'f';
678+
$nameSuffix = $parts['suffix'] ?? '';
679+
$value = $parts['value'] ?? 'test';
680+
$parts = [];
681+
for ($i = 0; $i < $count; $i++) {
682+
$parts[] = [
683+
'disposition' => $dispositionType,
684+
'param' => $dispositionParam,
685+
'name' => "$namePrefix$i$nameSuffix",
686+
'value' => $value
687+
];
688+
}
689+
}
690+
$out = '';
691+
$nl = "\r\n";
692+
foreach ($parts as $part) {
693+
if (!is_array($part)) {
694+
$part = ['name' => $part];
695+
} elseif ( ! isset($part['name'])) {
696+
throw new \Exception('Each part has to have a name');
697+
}
698+
$name = $part['name'];
699+
$dispositionType = $part['disposition'] ?? 'form-data';
700+
$dispositionParam = $part['param'] ?? 'name';
701+
$value = $part['value'] ?? 'test';
702+
$partHeaders = $part['headers'] ?? [];
703+
704+
$out .= "--$boundary$nl";
705+
$out .= "Content-disposition: $dispositionType; $dispositionParam=\"$name\"$nl";
706+
foreach ($partHeaders as $headerName => $headerValue) {
707+
$out .= "$headerName: $headerValue$nl";
708+
}
709+
$out .= $nl;
710+
$out .= "$value$nl";
711+
}
712+
$out .= "--$boundary--$nl";
713+
714+
return $out;
715+
}
716+
654717
/**
655718
* Execute request.
656719
*
657-
* @param string $query
658-
* @param array $headers
659-
* @param string|null $uri
660-
* @param string|null $address
661-
* @param string|null $successMessage
662-
* @param string|null $errorMessagereadLimit
663-
* @param bool $connKeepAlive
664-
* @param string|null $scriptFilename = null
665-
* @param bool $expectError
666-
* @param int $readLimit
720+
* @param string $query
721+
* @param array $headers
722+
* @param string|null $uri
723+
* @param string|null $address
724+
* @param string|null $successMessage
725+
* @param string|null $errorMessage
726+
* @param bool $connKeepAlive
727+
* @param string|null $scriptFilename = null
728+
* @param string|array|null $stdin = null
729+
* @param bool $expectError
730+
* @param int $readLimit
667731
*
668732
* @return Response
733+
* @throws \Exception
669734
*/
670735
public function request(
671736
string $query = '',
@@ -676,14 +741,18 @@ class Tester
676741
string $errorMessage = null,
677742
bool $connKeepAlive = false,
678743
string $scriptFilename = null,
679-
string $stdin = null,
744+
string|array $stdin = null,
680745
bool $expectError = false,
681746
int $readLimit = -1,
682747
): Response {
683748
if ($this->hasError()) {
684749
return new Response(null, true);
685750
}
686751

752+
if (is_array($stdin)) {
753+
$stdin = $this->parseStdin($stdin, $headers);
754+
}
755+
687756
$params = $this->getRequestParams($query, $headers, $uri, $scriptFilename, $stdin);
688757
$this->trace('Request params', $params);
689758

0 commit comments

Comments
 (0)